Financial-sector customers are asking for DORA compliance: can GAWEL Legal help?

Yes. DORA, the EU Digital Operational Resilience Act, binds financial entities such as banks, insurers and investment firms, and it reaches their ICT third-party providers through requirements those customers must push down by contract: security and resilience terms, audit and access rights, incident reporting, subcontracting controls and exit arrangements. For an ICT or SaaS provider serving financial entities, GAWEL Legal assesses what DORA requires of the provider in that role, negotiates the contractual terms its customers present, and builds the supporting governance, so the provider can meet what its financial customers are obliged to demand.

Do NIS2 and the Cyber Resilience Act apply to a Swiss company?

They can. The CRA applies to products with digital elements made available on the EU market, wherever the manufacturer is established (Art. 2(1) CRA). NIS2 reaches a Swiss company directly mainly through an EU establishment or, for certain digital services offered in the EU such as cloud or managed services, through the duty to designate an EU representative (Art. 26 NIS2); more often it reaches a Swiss supplier indirectly, through the supply-chain security terms its EU customers must put into their contracts (Art. 21(2)(d) NIS2). Scoping determines which route applies.

How do these regimes relate, and where does Swiss law fit?

They target different things: NIS2 sets baseline cybersecurity and incident-reporting duties for essential and important entities; DORA is the financial-sector operational-resilience regime that reaches ICT providers by contract; the CRA governs the cybersecurity of products with digital elements. Swiss information-security obligations (including under the ISG) sit alongside all three. GAWEL Legal maps them together so a cross-border business has one coherent framework.

Does GAWEL Legal implement the technical security measures?

No. GAWEL Legal provides legal advice on which regimes apply and in which capacity, the governance and incident-reporting frameworks they require (for example the risk-management measures under Art. 21 NIS2 and the reporting duties under Art. 23 NIS2), the contractual terms under Art. 30 DORA, and the legal side of incident response. The technical implementation, from network controls to vulnerability handling, sits with the client's security function or its providers, and GAWEL Legal works alongside them so the documentation reflects the controls in place.

Cyber and digital resilience

GAWEL Legal advises regulated entities, ICT providers and manufacturers on NIS2, DORA, the CRA and the Swiss ISG, on a retainer. The work covers per-regime applicability assessments, governance and incident-reporting frameworks and contractual terms, billed as fixed-fee modules with an ongoing advisory retainer.

Discuss cyber-resilience obligations View scope

Different rules, coordinated advice

NIS2: Entity governance and reporting
DORA: ICT third-party contracts
CRA: Product cybersecurity
Swiss ISG: Information-security obligations

Applicability is assessed before the work is scoped.

Who this is for

EU-regulated entities and their ICT providers subject to NIS2 or DORA
Manufacturers of products with digital elements under the Cyber Resilience Act
Swiss entities with information-security obligations under the ISG

Scope

Applicability and scoping:
determining whether the client is an essential or important entity under NIS2 or a supplier that NIS2 reaches through its customers' contracts, a financial entity or ICT third-party provider under DORA, or a manufacturer of products with digital elements under the CRA, and in which capacity
Governance and risk-management frameworks:
the technical, operational and organizational risk-management measures NIS2 requires of essential and important entities (Art. 21 NIS2), translated into governance documents, policies and accountability lines
Incident-reporting frameworks:
the notification duties for significant incidents (Art. 23 NIS2), the corresponding DORA incident regime and the manufacturer's duty to report actively exploited vulnerabilities and severe incidents, which has applied since 11 September 2026 (Art. 14 CRA), built into playbooks that legal, security and management can execute under deadline pressure
ICT third-party contracting under DORA:
financial entities must manage ICT third-party risk (Art. 28 DORA) and carry defined key contractual provisions in their ICT contracts (Art. 30 DORA); GAWEL Legal negotiates those terms for financial entities or their ICT providers.
Product cybersecurity under the CRA:
the manufacturer's obligation to design, develop and produce products with digital elements in accordance with the essential cybersecurity requirements (Art. 13 and Annex I CRA), and the supporting documentation and vulnerability-handling processes
Swiss ISG obligations:
the duty of operators of critical infrastructure to report a cyberattack to the BACS within 24 hours of discovering it (Art. 74a, Art. 74b and Art. 74e ISG), mapped alongside the EU regimes

How the work proceeds

Applicability The initial review determines which of NIS2, DORA, the CRA and the ISG apply, and in which capacity.
Gap assessment Current governance and controls are compared against each applicable regime.
Frameworks The work establishes the governance, incident-reporting and third-party-management frameworks.
Contracts ICT third-party and supplier contracts are aligned with the requirements.
Ongoing advisory Legal support for incident handling and change management is provided on a retainer.

Fees

Fixed-fee modules + retainer

Per-regime assessments as fixed-fee modules

Questions

Financial-sector customers are asking for DORA compliance: can GAWEL Legal help?: Yes. DORA, the EU Digital Operational Resilience Act, binds financial entities such as banks, insurers and investment firms, and it reaches their ICT third-party providers through requirements those customers must push down by contract: security and resilience terms, audit and access rights, incident reporting, subcontracting controls and exit arrangements. For an ICT or SaaS provider serving financial entities, GAWEL Legal assesses what DORA requires of the provider in that role, negotiates the contractual terms its customers present, and builds the supporting governance, so the provider can meet what its financial customers are obliged to demand.
Do NIS2 and the Cyber Resilience Act apply to a Swiss company?: They can. The CRA applies to products with digital elements made available on the EU market, wherever the manufacturer is established (Art. 2(1) CRA). NIS2 reaches a Swiss company directly mainly through an EU establishment or, for certain digital services offered in the EU such as cloud or managed services, through the duty to designate an EU representative (Art. 26 NIS2); more often it reaches a Swiss supplier indirectly, through the supply-chain security terms its EU customers must put into their contracts (Art. 21(2)(d) NIS2). Scoping determines which route applies.
How do these regimes relate, and where does Swiss law fit?: They target different things: NIS2 sets baseline cybersecurity and incident-reporting duties for essential and important entities; DORA is the financial-sector operational-resilience regime that reaches ICT providers by contract; the CRA governs the cybersecurity of products with digital elements. Swiss information-security obligations (including under the ISG) sit alongside all three. GAWEL Legal maps them together so a cross-border business has one coherent framework.
Does GAWEL Legal implement the technical security measures?: No. GAWEL Legal provides legal advice on which regimes apply and in which capacity, the governance and incident-reporting frameworks they require (for example the risk-management measures under Art. 21 NIS2 and the reporting duties under Art. 23 NIS2), the contractual terms under Art. 30 DORA, and the legal side of incident response. The technical implementation, from network controls to vulnerability handling, sits with the client's security function or its providers, and GAWEL Legal works alongside them so the documentation reflects the controls in place.

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss a cyber-resilience engagement