NIS 2 in the financial sector – what do non-banking firms need to know about the new requirements?

When people hear the term ‘cybersecurity in finance’, most think of banks. Large institutions, extensive IT departments, dedicated security teams, years of experience in digital risk management. Meanwhile, NIS 2 applies to a much wider range of entities in the financial sector — and it is precisely these smaller, less obvious companies that now find themselves in a situation where time is working against them.

Who in the financial sector is subject to NIS 2?

The NIS 2 Directive covers the financial sector much more broadly than one might think. Alongside banks and credit institutions, the scope of the Directive includes investment firms, payment institutions, investment fund companies, insurance and reinsurance undertakings, stock exchanges and trading platforms, as well as leasing and factoring service providers operating on a sufficient scale.

The criterion is not solely the size of the firm — the type of services provided and their significance for the stability of the financial system also matter. Firms that have hitherto operated outside the strict regulatory requirements for cybersecurity may find that NIS 2 applies to them directly — and that they have less time to respond than they thought.

Why is the non-banking financial sector particularly vulnerable?

Banks have been operating for years in an environment of intensive IT security regulations — the Polish Financial Supervision Authority (KNF), the European Banking Authority (EBA), and the Data Protection Act (DORA). They have established procedures, experienced teams and an organisational culture in which cybersecurity is taken seriously. Smaller financial entities — insurance companies, leasing firms, payment institutions — often start from a different position.

This is not a criticism. It is an observation with specific implications: these firms process vast amounts of sensitive customer financial data, are connected to the sector’s critical infrastructure, yet may lack the resources or experience that large banks have built up over years. This is precisely why attackers are increasingly targeting not the largest institutions — but the weaker links in the same ecosystem.

What does NIS 2 actually require of financial firms?

The requirements of the directive can be divided into two main areas. The first is cybersecurity risk management — a firm must have technical and organisational measures in place that are proportionate to the level of risk: security policies, access management, encryption, backup procedures and business continuity plans. The second area concerns reporting obligations — incidents of significant importance must be reported to the relevant authorities within specified timeframes, which requires efficient procedures for detecting and classifying incidents.

For companies that have not yet adopted a structured approach to cybersecurity, meeting these requirements is a significant undertaking — but one that yields concrete and measurable results: the organisation becomes more resilient, better prepared for incidents, and more credible in the eyes of customers and business partners.

NIS 2 as a starting point for building customer trust

In the financial sector, trust is currency. A customer who entrusts a company with their funds, data or policy wants to be sure that their information is secure. A cybersecurity incident at a financial institution — even a smaller one — destroys that trust in a way that is difficult to rebuild.

Companies that treat NIS 2 not as a box to tick, but as an opportunity to build solid security foundations, gain twice over. They meet regulatory requirements — and build an advantage that has real value in their relationship with the customer. In an industry where product offerings are becoming increasingly similar, operational reliability and data security may be what truly sets one company apart from another.