DORA + NIS-2 + ISO 27001: How a CISO Manages Three Mandates Without Burnout

Picture a typical mid-market CISO in 2026. In one month, three letters arrive:

• NIS-2 applies to the company. This is now confirmed.
• The holding company wants ISO 27001 certification.
• A financial services customer asks whether the company meets DORA.

None of the three mandates is optional. And the CISO is still one person.

Where the Three Frameworks Overlap, and Where They Don't

The good news: about 70 % of the rules overlap. The bad news: the other 30 % belong to just one framework, and you can't ignore them.

• ISO 27001 (general, Annex A): 93 controls that cover all areas of security. The ISMS is at the center.
• NIS-2 (EU, Art. 21): 10 areas of minimum measures. It is aimed at critical infrastructure and has binding duties to report.
• DORA (EU, Art. 5–14, for finance): ICT risk management, incident reporting, ICT third-party risk and tests of operational resilience.

The Three Causes of Burnout, and How to Counter Them

Cause 1: The Same Work for Each Framework

The classic setup: the CISO keeps three risk registers, three control lists and three audit preparations side by side. The fix is a multi-framework module with cross-mapping. One control meets the rules of all three frameworks, and its evidence counts for all three. This cuts upkeep by 60–70 %.

Cause 2: Different Report Formats

The board wants a report in line with ISO. The regulator wants a NIS-2 early warning. The finance customer wants a DORA self-assessment. The fix is reports you can configure, all from one data source. A board tab, a regulator tab, a customer tab: one platform, three views.

Cause 3: Waves of Audits

Three mandates mean three yearly audits, three surveillance dates and three re-certifications. Without a platform, that is three times 3 months of preparation. With audit prep in 4 weeks, it is 12 weeks instead of 36. That cuts the time to a third.

The Five Concrete Levers

1. Cross-mapping as a list of duties: ISO A.5.34 ↔ NIS-2 Art. 21(2)(a) ↔ DORA Art. 9. One control meets all three.
2. Supplier module with DORA duties: DORA has its own rules for ICT third parties, such as concentration analysis and an exit strategy. These extend the TPRM data model, with no need for a separate tool.
3. Incident reports from one source: One incident feeds several report templates: BSI for NIS-2, the regulator for DORA and data protection for GDPR.
4. Resilience tests on record: DORA Art. 24 asks for pen tests in the style of TIBER-EU. ISO 27001 asks for reviews of how well controls work. Both go into one test calendar, with evidence.
5. Management sign-off just once: NIS-2 Art. 20 and DORA Art. 5 both need clear approval from management. One approval signed with eIDAS counts for both.

What Only DORA Requires

For financial services firms and their suppliers:

• ICT risk management framework: written down, approved by management and updated each year.
• Incident classification with RTS: Regulatory technical standards define when an incident is "significant." That triggers the duty to report.
• ICT third-party register: one central list with concentration risks, exit plans and control rights.
• Threat-led penetration testing (TLPT): for large financial firms, every 3 years.
• Tests of operational resilience: each year, on record, with lessons learned.

Some platforms add DORA fields to the supplier module and a TLPT workflow to the test calendar. Such a platform covers all of this without a separate tool.

What the CISO Must Tell Management

• "Without a platform with cross-mapping, we run three worlds side by side. One person can't keep that up."
• "Setting up an integrated platform costs less than the extra FTE I would need otherwise."
• "Without a platform, the yearly audit waves mean 36 weeks of risk of a bottleneck we can see coming."
• "Reports to the board, the regulator and customers must come from one data source. Otherwise they will contradict each other sooner or later."

Compliance Mapping

• ISO 27001 Annex A: 93 controls across the whole ISMS.
• NIS-2 Art. 20–23: duties of management, minimum measures, reporting.
• DORA Art. 5–14: ICT risk, incidents, resilience tests.
• DORA Art. 28–44: ICT third-party risk and oversight.

Conclusion

Three mandates at once, with no platform to help, are a recipe for burnout. An integrated multi-framework GRC platform changes that. You handle 70 % of the duties once and count them for all three frameworks. You add the other 30 % for each framework on its own. The CISO keeps time for strategic work. And management can be sure that all three mandates are met and on record.