Security measures, reporting deadlines, management accountability and penalties: what NIS 2 and DORA mean, including for Moroccan companies.
NIS 2 requires many European organizations to implement cyber risk management measures, report incidents in three stages (24 hours, 72 hours, one month) and hold senior management directly accountable. DORA, applicable since January 17, 2025, sets comparable and more detailed rules for the financial sector. A Moroccan company is not directly subject to them as such, but it may be affected through its contracts with European clients, through its subsidiary or parent company, or because it provides certain digital services in the Union.
Directive (EU) 2022/2555, known as NIS 2, entered into force in early 2023. Member States had to transpose it by October 17, 2024 at the latest, the date from which it replaced the first NIS directive.
Its scope covers eighteen sectors, including energy, transport, health, banking, water, digital infrastructure and public administration. As a general rule, it targets medium-sized and large companies in these sectors, with exceptions for certain activities considered sensitive regardless of size.
Organizations are classified into two categories:
Practical arrangements vary according to each Member State's transposition, and amendments to the text were proposed at European level in 2026: check the version applicable in the country concerned.
Article 21 requires technical, operational and organizational measures proportionate to the risks. It sets a minimum baseline:
The supply chain requirement is the one that most directly affects providers outside the Union: a European client subject to NIS 2 must assess the security of its suppliers.
Article 23 sets out how significant incidents are reported to the CSIRT or competent authority:
Article 20 requires management bodies to approve risk management measures and oversee their implementation, and provides that they can be held liable for infringements. Members of management must also undergo training, and entities are encouraged to offer training regularly to their staff.
For infringements of Articles 21 and 23, Article 34 sets minimum maximums that Member States must provide for:
Regulation (EU) 2022/2554, known as DORA, has applied since January 17, 2025. Directly applicable in all Member States, it covers around twenty categories of financial entities (banks, insurers, investment firms, payment institutions, etc.) as well as ICT third-party service providers designated as critical.
Its requirements are organized around several pillars:
For a major incident, the technical standards require an initial notification within 4 hours of its classification as major and no later than 24 hours after its detection, an intermediate report within 72 hours of the initial notification, then a final report within one month of the last intermediate report.
Penalties applicable to financial entities are set by each Member State. For critical providers, the regulation provides for periodic penalty payments of up to 1% of average daily worldwide turnover, for a maximum of six months.
Several situations expose an organization based in Morocco to these regulations:
Morocco has its own framework. Law No. 05-20 on cybersecurity, promulgated by Dahir No. 1-20-69 of July 25, 2020, applies to public administrations and institutions, critical infrastructure, as well as operators of public telecommunications networks, internet service providers, digital service providers and internet platform operators.
Its obligations include appointing an information systems security officer, implementing protective measures, business continuity and recovery plans, reporting incidents to the national authority and, for critical infrastructure, the accreditation and audit of sensitive systems.
Decree No. 2-21-406 of July 15, 2021 sets out how the law is applied. It confirms the role of the DGSSI as the national cybersecurity authority, provides for the classification of assets and systems, and establishes the qualification framework for audit providers and detection and response service providers.
The underlying logic is close to that of NIS 2: governance, risk management, incident reporting, oversight. An approach based on ISO/IEC 27001 makes it possible to address both frameworks consistently.
As a PECB Authorized Silver Partner, Securevalley Training offers PECB certification courses on these topics in Casablanca, in Témara or remotely:
For managers weighing up governance certifications, our CISSP vs CISM comparison provides additional guidance.
In most cases, no: penalties apply to entities under the jurisdiction of a Member State. The risk for a Moroccan company is mainly contractual (penalties, loss of a contract). The situation is different for certain digital service providers that operate in the Union without being established there.
For financial entities, DORA is the sector-specific reference text and takes precedence over the equivalent NIS 2 provisions on risk management and incident reporting.
On its own, it does not guarantee compliance, but it provides a solid foundation: risk analysis, security controls, incident management and continual improvement. The requirements specific to each regulation, such as notification deadlines, still need to be covered.
NIS 2 and DORA rest on the same idea: cybersecurity is a governance matter and extends across the entire supplier chain. For a Moroccan company working with Europe, anticipating these requirements while complying with Law 05-20 makes client audits easier and strengthens its commercial position.