With cyber threats becoming increasingly sophisticated and posing a significant risk to businesses and governments alike, the European Union aims to bolster cybersecurity resilience across member states with the introduction of the revised Network and Information Security (NIS2) Directive. It marks a decisive shift in how EU member states, including Ireland, are expected to manage digital risks that could undermine essential services, disrupt the broader economy, and erode public trust.

Having come into force in 2023, NIS2 Directive is yet to be transposed into Irish law, with implementation likely by late 2025 or early 2026. Recently, Ireland’s National Cyber Security Centre (NCSC) published its draft set of Risk Management Measures in accordance with the NIS2 Directive and joined the Cyber Fundamentals Framework, which provides a structured, risk-based approach to cybersecurity.

For businesses and public sector organisations in Ireland, which is a hub for a wide range of sectors spanning technology, finance and medtech, understanding and acting on the NIS2 cybersecurity directive is now imperative. 

Why the NIS2 Directive matters

An EU-wide legislation on cybersecurity, the NIS2 Directive modifies the 2016 NIS Directive by expanding the scope of cybersecurity rules to include a broader range of critical sectors and entities, strengthening cyber-risk management, incident-reporting and enforcement across member states.

For Irish businesses, the NIS2 cybersecurity directive marks a fundamental shift in how organisations must approach cyber risk management. It introduces stringent supervision, substantial administrative fines, and personal liability for senior management, making cybersecurity a boardroom priority rather than merely an IT concern. 

Under the directive, which aims to protect critical sectors such as energy, transport, banking, and health from major cyberattacks, operators must implement appropriate security measures and report any cyber breaches to the relevant authorities.

Legislation such as the NIS2 Directive assumes significance given that four in 10 Irish businesses have suffered at least one cyber-attack in the last five years, leading to financial loss and reputational harm, according to research from risk management firm Gallagher.

Who must comply with NIS2 in Ireland?

The scope of the NIS2 Directive extends significantly beyond its predecessor, encompassing 18 sectors compared to the original seven.

Irish organisations classified as medium-sized or large enterprises operating within designated critical sectors must comply. The directive categorises entities as ‘essential’ and ‘important’ based on the size and the service they provide. Essential organisations will generally have a minimum of 250 employees and an annual turnover of at least €50 million, while important entities will have a minimum of 50 employees and annual turnover of €10 million.

Under NIS2 directive requirements, essential entities include public administration bodies, energy providers, transport operators, banking institutions, water suppliers, digital infrastructure providers and healthcare services. Important entities encompass postal services, research institutes, food producers, manufacturing businesses, and digital service providers.

Who are the designated competent authorities? 

Under NIS2 Directive, the NCSC has been designated as the lead competent authority in Ireland responsible for the management of “large-scale cybersecurity incidents and crises”.  

Other competent authorities for specific sectors include the Commission for the Regulation of Utilities, the Central Bank of Ireland, the Commission for Communications Regulation, the Irish Aviation Authority and the National Transport Authority. 

These authorities shall possess extensive powers to enforce compliance through regular audits, information requests, and the imposition of substantial penalties.

Key NIS2 Directive requirements  

The NIS2 cybersecurity directive set out detailed obligations for organisations and enhanced enforcement powers for competent authorities.  

• They are required to develop and maintain a robust risk-management framework that covers cyber risk analysis, business continuity measures, incident handling, supply chain security, vulnerability handling and disclosure, as well as policies on the use of cryptography and encryption. 
• They must provide an early warning notification to the competent authority within 24 hours, followed by a full incident report within 72 hours and a final report within one month of the cyber incident.
• Competent authorities will have enhanced regulatory supervision powers, allowing them to conduct on-site inspections, off-site supervision, random checks, ad hoc audits, security scans, requests for information, access to data and evidence of cybersecurity policy implementation.
• Governance accountability is another aspect of the NIS2 Directive. Management bodies must approve the adequacy of cybersecurity risk management measures, supervise their implementation, and will be held accountable for any non-compliance.
• Failure to comply may result in significant administrative fines. Essential entities may face penalties of up to €10 million or 2% of total global annual revenue, while important entities may incur fines of up to €7 million or 1.4% of annual revenue.

How Irish organisations should prepare

Navigating NIS2 Directive demands a structured approach. Irish businesses must first determine whether they fall within its scope by assessing both their sector classification and size thresholds. 

Conducting a current state assessment is essential, mapping existing cybersecurity controls against NIS2 clauses to identify compliance gaps. Organisations should then implement comprehensive cybersecurity frameworks that cover governance, technical controls, incident response capabilities, and resilience testing programmes.

Proactive incident response testing through crisis simulations ensures preparedness for real-world scenarios. Evaluating an organisation’s incident response procedures will help validate its ability to maintain operations during adverse circumstances.

Supply chain security also requires particular attention under the NIS2 cybersecurity directive. Irish businesses must assess the cybersecurity risks associated with their supply chains and third-party services, ensuring that they adhere to security standards.

FAQs: NIS2 Directive

What is the NIS2 Directive?
The NIS2 Directive is EU-wide cybersecurity legislation that establishes legal measures to increase the overall level of cybersecurity across the EU, modifying the original NIS Directive from 2016.

Who needs to comply with NIS2?
Medium and large-sized organisations operating in 18 designated critical sectors must comply, along with certain smaller entities depending on their criticality.

What are the main points of NIS2?
The main points include expanded sectoral scope, mandatory cybersecurity risk management measures, incident reporting obligations, personal liability for management, and substantial financial penalties for non-compliance.

Is NIS2 Directive mandatory?
NIS2 compliance is mandatory for all medium-sized and large organizations within vital sectors in the EU.