NIS2 Compliance in Ireland: What It Means for Your Business

NIS2 is the EU's cyber security law for medium and large organisations in 18 critical sectors, from energy and health to food, manufacturing and IT services. It requires risk management measures, incident reporting within 24 hours and board accountability. As of 28 October 2026, Ireland has not yet passed the law that brings it into force here. ERS IT Solutions, based in Blanchardstown, Dublin 15 since 1983, helps businesses put the technical controls in place now so they are ready when it lands.

What is the NIS2 Directive in Ireland?

NIS2 stands for the second Network and Information Security Directive, Directive (EU) 2022/2555 (EUR-Lex). It was adopted in December 2022 and replaces the first NIS Directive from 2016. EU countries had until 17 October 2024 to turn it into national law.

In Ireland the law that will do this is the National Cyber Security Bill. It will also put the National Cyber Security Centre (NCSC) on a statutory footing. Until it passes, the NCSC says the original NIS rules, S.I. No. 360 of 2018 (Irish Statute Book), remain in full effect for the operators of essential services already designated in the State.

Where is Ireland's NIS2 transposition now?

As of 28 October 2026, the National Cyber Security Bill has not been published or introduced in the Oireachtas. We checked the Oireachtas bills database on that date and it lists no bill of that name. Here is the timeline from primary sources:

The new National Cyber Security Strategy 2030 says the Department of Justice, Home Affairs and Migration is working with the Office of Parliamentary Counsel and the Attorney General's Office on a draft Bill to bring to Government. The NCSC's registration and incident reporting portals for NIS2 are not yet open and will go live once the legislation is in place.

In practice, the obligations are not yet enforceable in Ireland, but the Directive sets the minimum the Irish law must contain, so the content is known.

Does NIS2 apply to my business?

NIS2 applies if two things are true: your organisation works in a sector listed in Annex I or Annex II of the Directive, and it is medium-sized or larger. Some entities are in scope whatever their size, such as DNS service providers, top-level domain registries and qualified trust service providers.

Size follows the EU definition in Recommendation 2003/361/EC (European Commission). In plain terms, you are past "small" if you have 50 or more staff, or if both your annual turnover and your balance sheet are above €10 million. The NCSC NIS2 FAQ explains how to count partner and linked enterprises, which can push a small company in a larger group into scope.

Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business, which includes managed service providers and managed security service providers), public administration and space.

Annex II, other critical sectors: postal and courier services, waste management, chemicals, food production and distribution, manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles), digital providers (online marketplaces, search engines, social networks) and research.

The NCSC will not confirm for you whether you are in scope. Its FAQ says that decision rests with the organisation, possibly with legal advice, and it points to its "Am I in Scope?" tool.

What is the difference between essential and important entities?

Essential entities are, in the main, Annex I organisations that exceed the medium-sized ceilings (250 or more staff, or turnover above €50 million and balance sheet above €43 million), plus some named types regardless of size. Important entities are the other in-scope organisations from Annex I and Annex II. Both must meet the same security measures and report incidents.

The difference is in supervision and fines. Essential entities can be audited and inspected at any time. Important entities are supervised after the event, when there is evidence of a problem. According to the NCSC FAQ, sectoral regulators will supervise essential entities in their sectors, and the NCSC will cover all other in-scope entities as Lead Competent Authority.

What are the NIS2 penalties?

The Directive sets the minimum maximum fine each country must allow. Under Article 34 (EUR-Lex):

The exact Irish figures will be set by the Act. The General Scheme on gov.ie also provides a power to restrict CEOs, directors and senior managers from their positions where there has been non-compliance. Under Article 20 of the Directive, management bodies must approve the security measures, oversee them and can be held liable.

Does NIS2 apply to suppliers of essential or important entities?

Not directly, but most suppliers will feel it. Article 21 requires in-scope entities to manage supply chain security, including "the relationships between each entity and its direct suppliers or service providers". The NCSC FAQ says suppliers may fall under NIS2 indirectly "through contractual obligations imposed on them by the entities".

So an Irish SME that supplies a hospital, a utility, a food processor or a local authority should expect security questionnaires, contract clauses on MFA, patching and incident notification, and requests for evidence such as Cyber Essentials. This is the effect most small businesses will meet first.

What are the NIS2 security requirements?

Article 21(2) lists the minimum measures every essential and important entity must have, on an "all-hazards" basis:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management, disaster recovery and crisis management.
4. Supply chain security.
5. Security in acquiring, developing and maintaining systems, including vulnerability handling.
6. Policies to assess whether the measures work.
7. Basic cyber hygiene practices and cyber security training.
8. Policies on cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi-factor authentication or continuous authentication, and secured voice, video, text and emergency communications where appropriate.

The NCSC has published draft Risk Management Measures guidance setting out what it believes is the minimum baseline for Irish entities.

How fast must incidents be reported under NIS2?

Article 23 sets three stages for a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours with an initial assessment, and a final report no later than one month after that notification. In Ireland, reports will go through the NCSC's NIS2 portal once the Act is in force. This is tight, so you need monitoring that spots an incident quickly and a named person who decides whether it is significant.

Is there a NIS2 framework or certification in Ireland?

There is no NIS2 certificate you can buy today. The NCSC recommends the Cyber Fundamentals (CyFun) framework, originally developed in Belgium and based on NIST CSF 2.0, as a voluntary way to organise and evidence NIS2 measures. Ireland has joined as a scheme co-owner. The NCSC says certification under CyFun will be optional and that a national certification system will take 18 to 24 months to set up.

The NCSC has also announced a forthcoming "Irish Cyber Security Measures Certification" scheme with NIS2-aligned measures and a level aimed at SMEs. It will continue to recognise other standards such as ISO 27001. ERS is not a NIS2 certifier. We help clients put the controls in place and gather the evidence an assessor or regulator will ask for.

What NIS2 training is required?

Article 20(2) requires members of management bodies to follow cyber security training, and encourages entities to train employees regularly. The NCSC has published guidance on cyber governance for management board members in NIS2 entities. For staff, ERS runs user awareness training with monthly modules and simulated phishing, which covers the "cyber hygiene and training" measure in Article 21.

NIS2 vs NIS: what changed?

The first NIS Directive covered operators of essential services that each country picked out, plus some digital service providers. NIS2 replaces that with a size rule, so every medium or large organisation in a listed sector is in scope automatically. It adds sectors such as food, manufacturing, postal services, waste and ICT service management. It also adds board liability, a fixed 24-hour early warning, supply chain duties and much higher fines.

NIS2 vs ISO 27001, NIST and the Cyber Resilience Act

These are different things, and they overlap.

ISO 27001 is a strong way to show you meet many NIS2 measures, and the NCSC says it will recognise it, but certification does not on its own make you compliant. The NIST Cybersecurity Framework is the basis of CyFun, so work done against NIST maps across well. The Cyber Resilience Act (NCSC) is about products: its reporting duties for actively exploited vulnerabilities started on 11 September 2026, with full product rules from December 2027. A software company can be caught by both. For more on ISO 27001, read our ISO 27001 certification guide.

A practical NIS2 checklist for Irish businesses

1. Work out whether you are in scope: sector, staff numbers, turnover, balance sheet and group structure.
2. If you are not, list which customers are, and what they are likely to ask of you as a supplier.
3. Name the board member or director who owns cyber risk, and book their training.
4. Run a gap assessment against the ten Article 21 measures.
5. Turn on MFA for email, remote access and every admin account.
6. Patch critical and high-risk vulnerabilities quickly, and remove unsupported software.
7. Put 24/7 monitoring in place so you can detect a significant incident inside 24 hours.
8. Write and test an incident response plan with the 24 hour, 72 hour and one month steps.
9. Check that backups are offline or immutable and that restores have been tested.
10. Review your own suppliers and IT providers, including the security terms in their contracts.
11. Keep evidence: policies, logs, test results and reports, in one place.

How ERS helps with NIS2

ERS does not certify anyone. We do the day-to-day technical work most of the Article 21 list depends on, and the reporting that proves it.

• Gap assessment and plan, through our cyber security compliance service, so you know which measures you already meet.
• Detection inside 24 hours, with managed detection and response and Microsoft 365 monitoring watching around the clock.
• Access control and MFA, device encryption and remote wipe through mobile device management.
• Backup and continuity, through backup and disaster recovery.
• Training, for staff and for the people who sign off on risk.

ERS holds Cyber Essentials certification itself and is a member of Cyber Ireland, the national cyber security cluster. ERS quotes per business after a short call. Contact us or call 01 885 9500.