NIS2 in Ireland: Is Your Business in Scope?
On this page
NIS2 is the biggest cybersecurity compliance change Irish businesses have faced since GDPR. Directive (EU) 2022/2555, adopted on 14 December 2022, replaced the original NIS Directive and expanded coverage from a few hundred large operators to a much wider set of essential and important entities, including many Irish SMEs that have never faced security regulation before. This guide explains what it is, whether you are in it, and what to do next.
What NIS2 requires
In-scope organisations must:
- Run proper cybersecurity risk management. Policies, access control, incident handling, supply chain security, encryption, and continuity planning, proportionate to risk.
- Make management accountable. Senior management must oversee and approve the cybersecurity measures, and can be held personally accountable for failures.
- Report significant incidents fast. An early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within one month.
- Manage supply chain risk. The security posture of your suppliers becomes part of your own compliance.
The directive’s recitals are blunt about why: an exponential increase in ransomware attacks, and SMEs increasingly targeted as the weak link in supply chains.
Ireland’s setup: the NCSC
The National Cyber Security Centre (NCSC), founded in 2011 as an operational arm of the Department of Justice, Home Affairs and Migration, is designated as the National Competent Authority single point of contact for the NIS Directive in Ireland. It runs the State’s CSIRT-IE incident response team and has published a NIS2 Quick Reference Guide specifically for Irish organisations. It also runs SME CORE, a programme advising SMEs on network and information security best practice.
Are you in scope?
NIS2 sorts in-scope entities into essential and important categories across a long sector list: energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste, food, chemicals, and manufacturing of critical products, among others.
Size thresholds push many mid-sized Irish companies into scope for the first time, and even out-of-scope SMEs feel the effect through the supply chain: larger in-scope customers now write cybersecurity requirements into their contracts.
The practical path
- Check the scope. Start with the NCSC NIS2 Quick Reference Guide and the directive’s Annexes; map your sector and size.
- Assess the gap. Compare your current security controls against the risk-management measures NIS2 lists.
- Build the basics. Access control, multi-factor authentication, patching, backups, and incident response are the foundation for compliance and for survival, per our website security checklist.
- Prepare for reporting. Write the internal runbook for the 24 hour early warning, 72 hour notification, and monthly final report, and know your point of contact.
- Manage suppliers. Ask every critical supplier for their security posture, and expect the same question from your customers.
How we help
We run the technical side for Irish companies: cloud IAM, infrastructure hardening, and managed operations that produce the controls NIS2 expects, including the SOC 2 style evidence trail documented in our IAM and SOC 2 hardening case study. Book a call if you want a scope and gap assessment.
Next: Website and app security in Ireland: the 2026 checklist
Frequently asked questions
What is NIS2?
Directive (EU) 2022/2555, adopted on 14 December 2022, which sets a high common level of cybersecurity across the EU. It replaced the original NIS Directive and widened the net to far more sectors and companies.
Does NIS2 apply to my Irish business?
It depends on sector and size. NIS2 covers essential and important entities across a long list of sectors, including energy, transport, health, digital infrastructure, ICT service management, food, and manufacturing. Many SMEs now fall in scope for the first time.
Who enforces NIS2 in Ireland?
The National Cyber Security Centre (NCSC) is designated as the National Competent Authority single point of contact for the NIS Directive in Ireland, and it publishes a NIS2 Quick Reference Guide for organisations.
What must in-scope organisations do?
Apply cybersecurity risk-management measures across their systems, train management on cyber risk, and report significant incidents to the competent authority within the deadlines set by the directive.
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within one month. The NCSC's guide sets out how this works in Ireland.
How do I check whether I am in scope?
Start with the NCSC's NIS2 Quick Reference Guide, check your sector and size against the directive's Annexes, and get a compliance assessment if you are borderline. Supply chains increasingly force compliance anyway: larger customers require it.