NIS 2 and DORA in the banking sector

Credit institutions hold two things an attacker wants equally: money and trust. An incident that stops payments, takes down the ATM network or disrupts internet banking has an immediate and visible effect on customers, while one that compromises data integrity can go undetected for a long time. Social engineering fraud, attacks on IT service providers and ransomware campaigns remain the main vectors, in a sector where the acceptable window of unavailability is measured in minutes.

Directive (EU) 2022/2555 (NIS 2) lists banking in Annex I, among the sectors of high criticality. For financial entities it must be read together with Regulation (EU) 2022/2554 (DORA), which governs ICT risk in detail and applies, within its scope, as the more specific rule. In practice a credit institution has to reconcile the requirements of both frameworks rather than choose between them.

Legal framework

At European level:

• Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
• Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex

At national level (Romania):

• GEO no. 155/2024: Official Gazette no. 1332/2024
• Law no. 124/2025: Official Gazette no. 638/2025
• DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
• Order on disruption criteria and risk assessment: Official Gazette no. 776/2025

The Banking sector

Essential entities:

Credit institutions as defined in point (1) of Article 4 of Regulation (EU) No 575/2013.

• Credit institutions authorised to take deposits and grant credit
• Branches of credit institutions established in other Member States
• Institutions operating card, ATM and payment acceptance networks
• Entities providing core banking and internet banking platforms

Sector-specific cyber threats

1. Ransomware affecting core banking or payment processing systems
2. Fraud through social engineering targeting customers and staff
3. Compromise of ICT third-party providers with privileged access
4. Attacks on ATM networks and card acceptance infrastructure
5. Data integrity attacks that alter balances or transaction records
6. Distributed denial of service against online banking channels

NIS 2 requirements for the banking sector

Mandatory measures:

• Inventory and classification of critical IT and OT assets
• Security policies approved at management level, with explicit responsibilities
• Network segmentation and separation of OT and IT communication channels
• Traffic monitoring and anomaly detection (IDS/IPS)
• Access control and multi-factor authentication, including for remote supplier access
• Incident response and business continuity plans, tested annually
• Cybersecurity training for operations and maintenance teams
• External security audits and attack simulations
• Monitoring of equipment and IT service suppliers

Critical interdependencies

• Dependency on payment and settlement infrastructure operated by third parties
• Reliance on communications networks and data centres for continuous availability
• Chain effects on commerce and public services when payments stop
• Overlap between NIS 2 obligations and DORA requirements on ICT third-party risk

For credit institutions, cyber resilience is inseparable from customer trust. NIS 2 and DORA together require documented risk management, tested continuity and close oversight of ICT providers, with responsibility for approving and supervising those measures resting explicitly with management.