NIS2 - DORA
In Hungary NIS2 is implemented by the Cybersecurity Act (Act LXIX of 2024); in the financial sector DORA has applied since January 2025. Both make management responsible. We help you decide what applies to you and turn the requirements into a working, audit-ready setup.
NIS2 or DORA – which one applies to you?
| NIS2 (Hungarian Cybersecurity Act) | DORA | |
|---|---|---|
| Who it covers | Medium-sized and large companies in the sectors listed in the Act, and public administration | Banks, insurers, investment and payment service providers and their ICT suppliers |
| Main requirements | Risk management, incident reporting, training, cybersecurity audit | ICT risk management, incident reporting, resilience testing, third-party risk |
| Accountable | Management, personally | The management body |
You can be affected as a supplier too: banks and clients covered by NIS2 ask their suppliers for evidence because of DORA and NIS2.
Important from 2026: the scope of the Hungarian Cybersecurity Act changed on 6 January 2026; company size is now assessed on the company’s own figures. If you decided earlier that you are in scope – or that you are not – it is worth checking again.
What you get
- Scope assessment: in writing, with reasons – in scope, out of scope, or affected as a supplier.
- Gap analysis: what is in place, what is missing and how much work it takes.
- Roadmap: tasks, owners, deadlines and costs – for management approval.
- Implementation: policies, incident response, supplier requirements, training.
- Audit readiness: so the auditor finds the evidence in one place.
How we work
Step 1
Scope and gap analysis
Step 2
Tasks in order
for management approval
Step 3
Implementation
with your team
Step 4
Leadership training
what to decide in an incident
Why us
We don’t produce documents for the drawer. We break the requirements into steps that make business sense and discuss them in the board’s language. We have worked with business leaders for 22 years and have taken part in regulatory inspections.
Frequently asked questions
How do I know if NIS2 applies to us?
Our quick check gives a first answer in 7 questions, about 2 minutes. A precise answer needs the sector, headcount and revenue.
What happens if we do not register?
Failing to register can in itself lead to a cybersecurity fine.
We are not in scope, but one of our clients is. What should we do?
Prepare for the client’s supplier questions: they will ask for the same evidence, only through the contract.
Partners
Related articles
Let’s talk about where your company stands today.
Book a consultation
