Most lists of NIS2 and DORA "common gaps" come from consultancies' own client work, which cannot be checked; supervisors and ENISA have now published findings that can. This page ranks ten readiness gaps using only published evidence: the European Supervisory Authorities' (ESAs) 2024 dry run of DORA registers of information, the European Central Bank's 2024 cyber resilience stress test and 2025 SREP results, and ENISA's NIS Investments 2025 survey. Each gap names the source, the obligation it touches in Directive (EU) 2022/2555 (NIS2) or Regulation (EU) 2022/2554 (DORA), and the checklist section that closes it. It is for compliance leads, CISOs and internal auditors in entities subject to either regime. Note that most evidence comes from the financial sector and from a survey of 1,080 organisations, so treat it as a strong signal, not a census. For how the two regimes overlap, see the DORA and NIS2 Overlap Mapping Guide.
The Top 10 at a glance
The table lists each gap, the published source and the obligations it affects. Each is explained below.
| # | Gap | Published source | NIS2 | DORA |
|---|---|---|---|---|
| 1 | Third-party provider data missing from the register | ESAs dry run 2024 | Art. 21(2)(d) | Art. 28(3) |
| 2 | Entity identifiers that do not resolve | ESAs dry run 2024 | Art. 21(2)(d) | Art. 28(3) |
| 3 | Exit strategies and substitutability not worked out | ESAs dry run 2024; ECB SREP 2025 | Art. 21(2)(c), (d) | Art. 28(8) |
| 4 | Third-party strategy and risk assessment weak | ECB SREP 2025; ENISA 2025 | Art. 21(2)(d) | Art. 28(2) |
| 5 | Continuity plans tested against too few scenarios | ECB stress test 2024; ENISA 2025 | Art. 21(2)(c) | Art. 11, 12 |
| 6 | Slow patching of critical vulnerabilities | ENISA 2025; ECB SREP 2025 | Art. 21(2)(e) | Art. 9(4)(f) |
| 7 | Identity and access management weaknesses | ECB SREP 2025 | Art. 21(2)(i), (j) | Art. 9 |
| 8 | Hardening and network segmentation | ECB SREP 2025 | Art. 21(2)(a), (e) | Art. 9 |
| 9 | No recent assessment of control effectiveness | ENISA 2025 | Art. 21(2)(f) | Art. 11(6), 24 |
| 10 | Skills capacity and management training | ENISA 2025 | Art. 20(2), 21(2)(g) | Art. 5 |
1. Third-party provider data missing from the register
The finding: almost 1,000 financial entities submitted registers of information in the ESAs' 2024 dry run, and only 6.5% passed all data quality checks. The summary report says missing mandatory information made up 86% of all data errors, concentrated in identification codes for ICT third-party service providers and their parent undertakings; template B_02.02 had the highest share of missing information at 60%.
The obligation: DORA Article 28(3) requires a register of information on all ICT third-party contractual arrangements, maintained at entity, sub-consolidated and consolidated level. NIS2 Article 21(2)(d) needs the same supplier inventory for supply chain security.
What closes it: make procurement capture provider identifiers at contract signature rather than reconstructing them at reporting time. See section 5 of the DORA Readiness Checklist and the DORA ICT Third-Party Risk and Register of Information Guide.
2. Entity identifiers that do not resolve
The finding: invalid LEI codes accounted for 6.5% of failures. The ESAs found more invalid codes for financial entities themselves (close to 9,000) than for providers (close to 6,000), often because national or other codes were reported instead of LEIs. They also noted high variability in provider names, which makes matching hard when identifiers are absent.
Why it matters: supervisors use the registers to map concentration on providers across the sector. An entry that cannot be matched to a provider does not count towards that picture.
What closes it: validate LEIs against the public register before submission, keep one golden record per provider and its ultimate parent, and run the ESAs' published validation rules in your own pipeline.
3. Exit strategies and substitutability not worked out
The finding: template B_07.01, the assessment of ICT services, held 20% of all missing values in the dry run, including substitutability, reintegration and alternative providers. Separately, the ECB's 2025 SREP results say its 2024 targeted review of ten significant institutions found outsourcing deficiencies similar to 2023, including exit strategies and business continuity management.
The obligation: DORA Article 28(8) requires exit strategies for ICT services supporting critical or important functions. Under NIS2, the same thinking belongs in business continuity, Article 21(2)(c).
What closes it: for each critical function, record a named alternative provider or in-house fallback, an estimated transition time and a tested data return route. See the DORA Article 30 Contract Provisions Guide.
4. Third-party strategy and risk assessment weak
The finding: the same ECB review found deficiencies in the outsourcing strategy and risk assessment framework, and the SREP report notes third-party risk has a growing impact on scores. Outside finance, ENISA's NIS Investments 2025 report found 37% of organisations name supply chain risk management as the hardest NIS2 requirement to implement, and 43% of ICT service management entities reported no cybersecurity testing in the past year.
The obligation: DORA Article 28(2) requires a strategy on ICT third-party risk; NIS2 Article 21(2)(d) covers supply chain security, including security aspects of relationships with direct suppliers.
What closes it: tier providers by the functions they support and set assessment depth by tier. See section 6 of the NIS2 Readiness Checklist and the NIS2 Supply Chain Security Guide.
5. Continuity plans tested against too few scenarios
The finding: the ECB's 2024 cyber resilience stress test of 109 banks concluded that banks "have response and recovery frameworks in place, but areas for improvement remain". It asked banks to make sure plans consider a wide enough range of cyber scenarios, that they can meet their own recovery objectives, and that they can estimate direct and indirect losses. ENISA found 49% of organisations name business continuity and disaster recovery among the hardest NIS2 requirements.
The obligation: DORA Article 11(6) requires ICT business continuity and response and recovery plans to be tested at least yearly, Article 11(10) requires an estimate of aggregated annual costs and losses from major ICT-related incidents on request, and Article 12 covers backup and restoration. NIS2 Article 21(2)(c) names backup management and disaster recovery.
What closes it: include a destructive cyber scenario (encrypted or wiped primary and backup systems) in the annual test, measure achieved recovery time against the stated objective, and keep a loss estimation method. See the DORA Resilience Testing Guide.
6. Slow patching of critical vulnerabilities
The finding: ENISA reports that 28% of organisations take more than three months to patch critical vulnerabilities, rising to 51% among SMEs, and 50% name vulnerability and patch management as the hardest NIS2 requirement. The ECB's targeted cyber review lists vulnerability scanning and testing among the weak areas.
The obligation: DORA Article 9(4)(f) requires documented policies for patches and updates; NIS2 Article 21(2)(e) covers security in acquisition, development and maintenance, including vulnerability handling.
What closes it: set patch deadlines by severity and exposure, report the share of critical vulnerabilities past deadline to management, and record exceptions with compensating controls. See section 7 of the NIS2 Readiness Checklist.
7. Identity and access management weaknesses
The finding: the ECB's 2025 SREP results name identity and access management among the specific weak areas from its targeted cyber review, and report that operational and ICT risk had the worst average SREP score, with the ICT component at 3.03.
The obligation: NIS2 Article 21(2)(i) covers access control policies and asset management, and 21(2)(j) multi-factor or continuous authentication. DORA addresses access within the protection and prevention requirements of Article 9.
What closes it: enforce MFA on all remote and privileged access, review privileged and machine identities (service accounts, API keys) on a fixed cycle, and remove standing administrator rights. See section 8 of the NIS2 Readiness Checklist and the DORA ICT Risk Management Framework Guide.
8. Hardening and network segmentation
The finding: hardening and network segmentation are the other two weak areas the ECB names from its targeted cyber review.
The obligation: NIS2 Article 21(2)(a) and (e); DORA Article 9 protection and prevention.
What closes it: adopt secure configuration baselines per platform, measure drift, and separate administrative, production and third-party access paths so one compromised supplier connection cannot reach critical systems.
9. No recent assessment of control effectiveness
The finding: ENISA found 30% of organisations had not conducted a cybersecurity assessment in the past 12 months, and 63% of SMEs.
The obligation: NIS2 Article 21(2)(f) requires policies and procedures to assess the effectiveness of risk management measures. DORA requires a resilience testing programme (Article 24) and yearly testing of continuity plans (Article 11(6)); qualifying entities also run threat-led penetration testing at least every three years under Article 26.
What closes it: run at least one independent assessment a year against the Article 21(2) measures, and track findings to closure. See section 3 of the NIS2 Readiness Checklist.
10. Skills capacity and management training
The finding: ENISA reports that organisations struggle to attract (76%) and retain (71%) cybersecurity staff, and 81% say hiring difficulties raise their exposure to attacks.
The obligation: NIS2 Article 20(2) requires members of management bodies to follow training, and Article 21(2)(g) covers cyber hygiene and training. DORA Article 5 places responsibility for the ICT risk management framework on the management body.
What closes it: record board training with dates and content, and name a deputy for every critical security role. See the NIS2 Management Liability Executive Briefing.
Mapping to frameworks
Many entities evidence both regimes from one ISO/IEC 27001 control set. The table groups the ten gaps by the checklist section that closes them.
| Gaps | NIS2 Readiness Checklist | DORA Readiness Checklist |
|---|---|---|
| 1, 2, 3, 4 | 6. Supply chain security | 5. ICT third-party risk |
| 5 | 5. Business continuity, backup and crisis management | 2. ICT risk management; 4. Resilience testing |
| 6, 8 | 7. Secure systems, vulnerabilities and cryptography | 2. ICT risk management |
| 7 | 8. People, access control, MFA and assets | 2. ICT risk management |
| 9 | 3. Risk management and security policy | 4. Resilience testing |
| 10 | 2. Governance and management body accountability | 1. Scope, proportionality and governance |
Scope itself remains a moving target for NIS2: on 7 May 2025 the European Commission sent reasoned opinions to 19 Member States for failing to fully transpose the directive by its 17 October 2024 deadline. Check national status in the NIS2 Transposition Tracker.
Where to start
- Run the ESAs' validation rules on your register now and fix missing provider identifiers and LEIs (gaps 1 and 2). These are the cheapest fixes and are visible to supervisors.
- For each critical or important function, write down the exit route and test one (gap 3).
- Add a destructive cyber scenario to this year's continuity test and compare achieved recovery against objectives (gap 5).
- Report the share of critical vulnerabilities past deadline and the MFA coverage of privileged access to management monthly (gaps 6 and 7).
Track five numbers: register records passing validation (target 100%), critical functions with a tested exit plan, recovery time achieved versus objective, critical vulnerabilities past deadline, and privileged accounts without MFA (target zero).
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- ESAs: DORA dry run exercise summary report
- EIOPA: ESAs dry run exercise on registers of information
- ECB Banking Supervision: ECB concludes cyber resilience stress test
- ECB Banking Supervision: Aggregated results of SREP 2025
- ENISA: NIS Investments 2025
- European Commission: Commission calls on 19 Member States to fully transpose the NIS2 Directive
Related NHI Mgmt Group resources: NIS2 Readiness Checklist · DORA Readiness Checklist · DORA and NIS2 Overlap Mapping Guide · DORA Guide. This guide summarises published supervisory and ENISA findings against NIS2 and DORA and is not legal advice.