🏦NIS2 for Banking — deadlines, obligations, fines

A documented framework covering risk policies, system security, cryptographic controls and MFA, training and effectiveness assessment. NIS2 Art. 21(2) imposes the ten minimum measures (a-j) under an all-hazards approach, aligned with European and international standards including ISO/IEC 27001 and ISO/IEC 27002 [C3]. DORA layers sector-specific requirements on top (policies, asset identification, cryptographic protection, detection, response). EBA/GL/2019/04 remains applicable to credit institutions and investment firms in a narrowed scope after DORA enters into application [C12]. The management body approves and oversees implementation (NIS2 Art. 20) [C14].

For a bank under both NIS2 and DORA, the same category of event can trigger two parallel reporting flows. NIS2 Art. 23: early warning to the CSIRT within 24 hours of awareness, incident notification within 72 hours, and final report within one month [C4]. DORA Art. 19 (Joint Committee RTS): initial notification within 4 hours after classifying the incident as major and within 24 hours of detection, intermediate report within 72 hours, final report within one month [C8]. In practice, the CISO needs a single runbook that produces both filings in parallel — covering BNR/ASF on the DORA side and DNSC on the NIS2 side.

Significant financial entities (including banks above a defined threshold) must carry out advanced testing via TLPT at least every three years [C9]. Where internal testers are used, every third cycle must be subcontracted to external testers (DORA Art. 26(8)) [C9]. The technical reference framework is TIBER-EU, updated in February 2025 to align with the DORA RTS on TLPT [C11]. Romania is among the Member States that have adopted TIBER-EU, so we can run domestic TLPT engagements compatible with the European framework [C11]. Scope covers critical or important functions in production — not pre-prod.

DORA Art. 28(3) requires financial entities to maintain a register of ICT third-party contractual arrangements at entity, sub-consolidated and consolidated level, using the standard template imposed by Comm. Impl. Reg. (EU) 2024/2956 [C10]. Competent authorities and the ESAs use the register to designate Critical ICT Third-Party Providers (CTPPs) subject to the DORA oversight regime. NIS2 Art. 21(2)(d) overlays a supply-chain security requirement that applies to every essential entity, not only financial ones [C3]. Concretely: mandatory contract clauses (exit strategy, audit rights, sub-outsourcing), continuous monitoring, concentration assessment.

DORA requires ICT business continuity policies, response and recovery plans, and regular scenario testing (including switch-over, recovery, and crisis communication). NIS2 Art. 21(2)(c) adds business continuity and crisis management as minimum measures [C3]. For credit institutions, EBA/GL/2019/04 (BCM and DR) remains the operational reference in the post-DORA narrowed scope [C12]. A bank must demonstrate documented RTO/RPO for every critical function and annual plan testing (DORA Art. 25 — basic testing). The ICBC and Evolve incidents show the lesson plainly: continuity plans you have not exercised for real do not work under crisis conditions.

Type: LockBit ransomware exploiting CitrixBleed (CVE-2023-4966)

Impact: Decuplare a sistemelor financiare; SIFMA a notificat membrii ca tranzactiile US Treasury nu pot fi decontate prin ICBC; restaurare partiala in 8-9 noiembrie 2023.

Lesson: Poor patch management on a publicly known vulnerability (Citrix patch released 10 October 2023) shut down settlements on global markets. NIS2 Art. 21(2)(e) and DORA Art. 9 require timely vulnerability handling.

Type: Ransomware (LockBit suspected) at a third-party ICT supplier

Impact: 57.028 persoane afectate; date privind planurile de compensatie amanata gestionate pentru Bank of America compromise; disclosure SEC Infosys pe 3 noiembrie 2023; notificare Bank of America pe 24 noiembrie 2023.

Lesson: ICT supply chain: a compromised vendor (Infosys McCamish) exposed sensitive data of a major customer. DORA Chapter V and NIS2 Art. 21(2)(d) require continuous contractual evaluation and monitoring of every ICT provider.

Type: LockBit ransomware (incident discovered 29 May 2024)

Impact: 7,6 milioane persoane afectate; SSN, numere de cont bancar si contact pentru majoritatea clientilor de retail; partenerii Banking-as-a-Service (Affirm, Wise) au raportat la randul lor expunere prin contracte ICT.

Lesson: The Banking-as-a-Service model propagated the incident to dozens of fintech partners through ICT contracts. DORA Art. 28 (third-party register) plus concentration testing reduce the blast radius.

Type: Zero-day SQL injection exploit CVE-2023-34362, operated by Clop ransomware

Impact: Pana in iulie 2023: 383 organizatii si 20+ milioane persoane afectate; in 2024, totalul a depasit 2.700 de organizatii si ~95 milioane persoane. Victime confirmate in finance: Tesco Bank, Putnam Investments, multiple firme financiare prin furnizori (ex. Zellis payroll).

Lesson: A supply-chain attack on a widely deployed file-transfer product. NIS2 Art. 21(2)(d) and DORA Chapter V require an ICT supply-chain inventory and response procedures for critical providers.

DORA — Regulamentul (UE) 2022/2554 · Directly applicable from 17 January 2025; no national transposition required [C7]

Fully overlaps with NIS2 for credit institutions. Key differences: DORA requires initial notification within 4 hours after classification (NIS2: 24-hour early warning) [C4][C8]; DORA mandates TLPT every 3 years for significant entities (NIS2 has no mandatory TLPT) [C9]; DORA imposes a standardised ICT third-party register (NIS2 only requires proportionate supply-chain measures) [C10][C3].

EBA/GL/2019/04 — Guidelines on ICT and security risk management · Applicable through BNR/ASF regulations; scope narrowed after DORA enters into application (EBA/GL/2025/02) [C12]

Baseline framework for credit institutions and investment firms on ICT risk management and BCM. After 17 January 2025, certain requirements migrated under DORA, but the guidelines remain the reference in areas not covered by DORA.

PSD2 — Directiva (UE) 2015/2366 + RTS SCA (Reg. delegat 2018/389) · RTS on Strong Customer Authentication applicable from 14 September 2019 [C15]

For any bank operating payment services, SCA is mandatory for electronic remote transactions. Customer authentication mechanisms must sit within the broader ICT risk-management framework required by DORA and NIS2.

MiCA — Regulamentul (UE) 2023/1114 · Fully applicable from 30 December 2024 [C16]

Relevant for banks issuing electronic-money tokens (EMTs) or offering crypto-asset custody. Cybersecurity requirements for CASPs overlap with DORA obligations, since most CASPs will be treated as financial entities under DORA.

TIBER-EU — Cadrul ECB pentru threat-led red teaming · Adopted in Romania; framework version 2025 aligned with DORA [C11]

Technical reference framework for the TLPTs required by DORA Art. 26. Provides methodology, criteria for the threat intelligence provider and the red team, and reporting structure.