NIS2 and DORA: What They Mean for Your SOC and SIEM
ClaireChains ·
NIS2 and DORA give EU organisations strict incident reporting deadlines: 24 hours for a first NIS2 warning, and as little as 4 hours after classifying a major incident under DORA. A SIEM that detects, investigates and documents incidents quickly is how a SOC meets those deadlines with evidence to back them.
NIS2 and DORA in brief
| Aspect | NIS2 | DORA |
|---|---|---|
| Legal form | Directive (EU) 2022/2555, applied through national laws | Regulation (EU) 2022/2554, directly applicable |
| In force | National transposition deadline: 17 October 2024 | Applies from 17 January 2025 |
| Who | Essential and important entities in 18 sectors, such as energy, transport, health, digital infrastructure and public administration | Financial entities such as banks, insurers and investment firms, plus critical ICT providers to them |
| Incident reporting | Early warning within 24 hours, notification within 72 hours, final report within one month | Initial notification within 4 hours of classification (no later than 24 hours after awareness), intermediate report within 72 hours, final report within one month |
| Penalties | Maximum fines of at least €10 million or 2% of worldwide turnover (essential), €7 million or 1.4% (important) | Set by national competent authorities |
Financial entities covered by DORA follow DORA’s incident rules, which take precedence over NIS2 for those entities. Check your national law: NIS2 is applied through each member state’s own legislation, and details vary.
What the deadlines mean for a SOC
A 24-hour early warning, or a 4-hour DORA notification, leaves no time for an alert to sit in a queue. The clock starts when you become aware of an incident, so the SOC has to:
- Spot significant incidents quickly, even outside office hours.
- Tell real incidents from noise fast enough to classify them correctly.
- Collect the facts a report needs: what happened, which systems, likely cause, cross-border impact.
- Keep a record of every step for the final report and for later supervision.
How an AI SIEM helps
Detection around the clock
Claire Security monitors connected systems 24/7 and investigates alerts as they arrive, so a significant incident is not waiting for the morning shift.
Faster, more accurate triage
Its agentic reasoning loop gathers evidence and reaches a verdict for each alert. In our six-month measurement, triage was ten times faster and false positives fell by 90% compared with the same team before Claire Security.
Evidence for every decision
Every investigation keeps its full reasoning chain. That is the raw material for incident reports, for the one-month final report and for questions from supervisors.
Data under your control
Running on-premise or hybrid keeps logs and investigations inside your environment, which simplifies the supply-chain and third-party questions both laws ask.
What a SIEM does not cover
Neither law is met by buying a tool. NIS2 Article 21 and DORA’s ICT risk management framework also cover governance, risk analysis, business continuity, supplier security, staff training and testing. A SIEM supports several of these with evidence, but your organisation still owns them.
For Southeast Asia, see our guide to Malaysia’s Act 854.
See Claire Security on your own data
Book a demo and we will show you triage, audit trails and reporting in your environment.
Request a demoFAQ
Frequently asked questions
What are the NIS2 incident reporting deadlines?
For a significant incident, NIS2 requires an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month. Reports go to the national CSIRT or competent authority.
What are the DORA incident reporting deadlines?
For a major ICT-related incident, DORA requires an initial notification within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours, and a final report within one month.
What are the fines under NIS2?
Member states must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. Management can also be held personally accountable.
Does a SIEM make us NIS2 or DORA compliant?
No single tool makes an organisation compliant. A SIEM supports key obligations: detecting incidents early enough to meet reporting deadlines, keeping logs and audit trails, and producing evidence for supervisors. Governance, risk management and supplier controls still need their own work.