Three regimes shape what critical entities in Europe and the United States must prepare for a major cyber incident: NIS2 and DORA in the EU, and CIRCIA in the US. They differ in status. Two are already law and being enforced, and one still waits for a final rule.
This post compares them using the regulators' own pages. It is a summary, not legal advice.
NIS2
The Commission's page says NIS2 came into force in January 2023, and Member States had until 17 October 2024 to transpose it. It covers 18 sectors, including energy, transport, health, finance, water, digital infrastructure, public administration and space. All medium and large entities in the listed sectors are in scope, and Member States may add smaller ones with a high risk profile.
Duties, per the Commission's FAQ: appropriate risk management measures, including supply chain security, and a three stage incident report. An early warning is due within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. Senior management can be held liable. Maximum fines are set by Member States and must be at least 10 million euros or 2 percent of worldwide turnover for essential entities, and at least 7 million euros or 1.4 percent for important entities.
Status: in November 2024 the Commission sent formal notices to 23 Member States for incomplete transposition. We found conflicting counts of how many have now completed it, so check the Commission's tracker for your country. On 20 January 2026 the Commission proposed targeted amendments that it says would ease obligations for about 28,700 companies.
DORA
The Digital Operational Resilience Act applies to EU financial entities and has applied since 17 January 2025, according to the ESAs. It has six topics: ICT risk management, ICT third party risk, resilience testing including advanced testing, incident management and reporting, information sharing, and oversight of critical third party providers.
On 18 November 2025 the European Supervisory Authorities published the list of designated critical ICT third party providers, assessed on systemic importance, support for critical functions and substitutability. The ESAs will engage directly with those providers. Financial entities must also keep a register of information on their ICT contracts.
CIRCIA
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 sets two statutory clocks: covered incidents within 72 hours of reasonably believing one occurred, and ransom payments within 24 hours of payment. CISA says reporting is not required until the final rule takes effect. It encourages voluntary reporting meanwhile.
Status: CISA published its proposed rule on 4 April 2024 and held four town halls on 15 to 18 June 2026. Its page says it continues to work on the final rule, cites funding lapses, and gives no date. Secondary outlets report that the draft final rule went to the White House Office of Management and Budget on 1 October 2026. We could not confirm that from a primary source, so treat it as reported.
Side by side
| NIS2 | DORA | CIRCIA | |
|---|---|---|---|
| Region | EU | EU financial sector | US |
| Status | In force, uneven national laws | Applying since 17 Jan 2025 | Final rule pending |
| Incident clock | 24h, 72h, one month | Reporting of major incidents, details in technical standards | 72h incident, 24h ransom payment |
| Supplier focus | Supply chain measures | Register, critical provider oversight | Not the focus |
What to do now
- Work out which regimes apply to you, including as a supplier to a regulated customer.
- Write one incident timeline that can meet the shortest clock: the 24 hour early warning.
- Build a dependency inventory and a contract register. Regulators and customers will ask for both.
- Name who decides that an incident is significant, and who files.
- For software suppliers, keep an SBOM current. The free scan at https://gold.safeguard.sh/scan runs in the browser, needs no login, and accepts package.json, requirements.txt, CycloneDX or SPDX files, up to 100 dependencies.
Try it yourself
Map one control set to several frameworks and see where the same evidence serves more than one rule.
Click through it at your own pace, or open it full screen.
Quick check
Is CIRCIA reporting mandatory today?
No. CISA says reporting is not required until the final rule takes effect. Voluntary reporting is encouraged.
What is the NIS2 incident reporting sequence?
An early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after the notification.
