Risk analysis and security policies
Documented information-security policies and a risk assessment that drives control selection and investment.
NIS2 Directive · Ireland & EU
NIS2 compliance and readiness for Irish organisations.
NIS2 raises the cybersecurity bar for essential and important entities across 18 sectors. Ireland has not yet enacted its transposing legislation, which makes now the right time to confirm scope, close gaps and prepare your board before the new obligations take effect.
At a glance
What NIS2 means for you today.
NIS2 (Directive (EU) 2022/2555) replaces the original NIS Directive. Member states had to transpose it by 17 October 2024. Ireland missed that deadline, and the National Cyber Security Centre confirms that NIS2 registration and incident-reporting portals will only go live once the legislation is enacted.
In July 2026 the European Commission referred Ireland to the Court of Justice of the EU for failing to notify full transposition. The National Cyber Security Bill remains the proposed vehicle. Organisations designated under the original NIS regime remain subject to it in the meantime.
| Instrument | Directive (EU) 2022/2555 (NIS2) |
|---|---|
| EU transposition deadline | 17 October 2024 |
| Irish status (Oct 2026) | National Cyber Security Bill not yet enacted; no NIS2 registration duty yet |
| Expected Irish authority | National Cyber Security Centre (NCSC) |
| Incident reporting | 24-hour early warning, 72-hour notification, final report within one month |
| Maximum fines | Essential: €10m or 2% of worldwide turnover. Important: €7m or 1.4% |
Scope
Who NIS2 applies to.
NIS2 generally applies to medium and large organisations (50 or more staff, or annual turnover above €10 million) operating in the sectors listed in Annexes I and II of the Directive. Some entities are in scope regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and providers of public electronic communications.
- Sectors of high criticality (Annex I): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space
- Other critical sectors (Annex II): postal and courier, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research
- Suppliers: managed service providers, software vendors and other suppliers to in-scope entities will see NIS2-driven security clauses in contracts and due-diligence questionnaires, even before Irish law is in place
Requirements
The core NIS2 obligations.
Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. Article 23 sets reporting duties, and Article 20 makes management bodies accountable.
Incident handling
Detection, triage, escalation and response procedures, plus the ability to meet the 24-hour, 72-hour and one-month reporting stages.
Business continuity and crisis management
Backup management, disaster recovery and crisis management that are tested, not just documented.
Supply-chain security
Security requirements, assessment and monitoring for direct suppliers and service providers, including their development practices.
Secure acquisition, development and maintenance
Security across the system lifecycle, including vulnerability handling and coordinated disclosure.
Effectiveness assessment
Policies and procedures to assess whether cybersecurity measures work, such as testing, audit and metrics.
Cyber hygiene and training
Basic hygiene practices and cybersecurity training for staff and for members of the management body.
Cryptography, access and assets
Encryption policies, HR security, access-control policies, asset management, multi-factor authentication and secured communications.
Common gaps
Where organisations usually fall short.
- No defensible scoping decision: entity type, sector and size have not been formally assessed and recorded
- Incident response plans that cannot produce an early warning within 24 hours of becoming aware of a significant incident
- Supplier inventories that do not identify which ICT providers support critical services
- Business continuity and backup recovery that has never been tested end to end
- Management bodies that have not received cybersecurity training or formally approved risk-management measures
- Policies that exist on paper but lack evidence of operation, testing or review
Free checklist
NIS2 Readiness Checklist for Irish Organisations
A practical checklist covering scoping, the Article 21 measures, incident reporting timelines, supply-chain security and management-body accountability.
FAQs
NIS2 questions we hear most often
Is NIS2 law in Ireland yet?
No. As of October 2026, the National Cyber Security Bill that will transpose NIS2 has not been enacted, and the NCSC states there is currently no requirement to register under NIS2. The original NIS regime continues to apply to organisations already designated under it.
Should we wait for the Irish legislation before acting?
We advise against waiting. The Directive sets the minimum standard that Irish law must implement, so the core obligations are already known. Customers and partners in other EU states are also already applying NIS2 requirements to their suppliers.
What are the NIS2 incident reporting deadlines?
For significant incidents, the Directive requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification.
Does NIS2 apply to financial services firms already covered by DORA?
DORA is sector-specific legislation for financial entities and takes precedence for its ICT risk, incident reporting and testing requirements. Many groups still need to consider NIS2 for non-financial entities or activities. See our DORA page.
Can ISO 27001 certification satisfy NIS2?
ISO 27001 provides a strong foundation and overlaps with many Article 21 measures, but it does not automatically demonstrate NIS2 compliance. Incident reporting timelines, supply-chain requirements and management-body accountability usually need specific attention.
Related services and guidance
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- NCSC Ireland: NIS2
- NCSC Ireland: NIS2 FAQ
- National Transport Authority: NIS2 FAQs (September 2026)
This page is general guidance, not legal advice. Last reviewed 27 October 2026.