You have a solid SOC 2 report, the German bank’s security team seems satisfied, and then their risk team asks: “Are you DORA compliant, and what about NIS2?”
A SOC 2 Type 2 report shows your controls work. German financial institutions, however, must prove their entire ICT supply chain can withstand disruption, which is a different question.
What DORA requires. DORA is an EU regulation that has applied to financial entities since January 2025. For vendors, four things matter most: a Register of Information covering every ICT arrangement and subcontractor chain, direct oversight of critical ICT providers, threat-led penetration testing for systemically important institutions, and incident classification within four hours with reporting to BaFin.
What NIS2 adds. Germany transposed NIS2 through its NIS-2 Implementation and Cybersecurity Strengthening Act, in force since December 2025. It focuses on supply chain security, with incident reporting running through the BSI, a separate channel from DORA’s BaFin notification.
DORA takes precedence. Where the two overlap for a financial entity, DORA works as lex specialis, so banks, insurers and payment providers usually have DORA driving their vendor questions.
Where SOC 2 falls short. It does not cover DORA’s contractual requirements (audit rights, exit strategies, subcontracting disclosure), the four-hour incident timeline or threat-led penetration testing.
What to prepare: DORA-ready contract terms, an incident process that supports a four-hour window, a current subprocessor list, and honest wording about what your SOC 2 report covers.
Read the full guide with the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-for-german-financial-clients-where-dora-and-nis2-actually-fit-in
Top comments (0)