NIS2 and DORA for end-of-life systems
Both EU laws expect you to know the weaknesses in your systems and to fix them. A system that no longer receives security updates makes that hard to show. Here is what each law asks, and how Forkward helps you answer it.
Request a server assessmentDORA
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to banks, insurers, investment firms and other financial entities since 17 January 2025. Two of its rules speak directly to old systems.
A yearly risk assessment of every legacy system
Article 8(7) requires financial entities, other than microenterprises, to run a specific ICT risk assessment on all legacy ICT systems at least once a year, and before and after connecting new technologies, applications or systems to them.
Vulnerability and patch management
The regulatory technical standards on the ICT risk management framework, Commission Delegated Regulation (EU) 2024/1774, set out in Article 10 how financial entities handle vulnerabilities and patches: identify and evaluate the available patches and updates, provide for emergency patching, test before deployment, and make sure third-party providers handle the vulnerabilities in the services they provide.
NIS2
The NIS2 Directive, Directive (EU) 2022/2555, covers essential and important entities in 18 sectors, from energy and transport to health, digital infrastructure and manufacturing. Member States had to apply it from 18 October 2024.
Article 21 requires appropriate measures to manage cybersecurity risks. They include security in the acquisition, development and maintenance of network and information systems, with vulnerability handling and disclosure, and the security of the supply chain. Under Article 34, the maximum fine must be at least €10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and at least €7 million or 1.4% for important ones.
Is there a NIS3?
No. There is no NIS3 directive. On 20 January 2026 the European Commission proposed targeted amendments to NIS2, COM(2026) 13, together with a revised Cybersecurity Act. The proposal is still being negotiated by the European Parliament and the Council, so NIS2 is the law that applies today.
How Forkward helps
- The assessment lists your end-of-life systems, their known vulnerabilities and a remediation plan: input for the yearly DORA assessment of legacy systems and for your NIS2 risk analysis.
- Backported fixes give you patches to evaluate, test and deploy for versions their vendor no longer patches.
- Every fix has a public status, so your auditor can see what was fixed and when.
- Priority delivery within 24 hours covers the emergency patching your procedures have to plan for.
Sources
- Regulation (EU) 2022/2554 (DORA)
- Commission Delegated Regulation (EU) 2024/1774, ICT risk management framework
- Directive (EU) 2022/2555 (NIS2)
This page is general information, not legal advice. Your own obligations depend on your sector, your size and your Member State.