After failing to complete formal transposition to the revised Network and Information Security Directive (NIS2) in October 2024, Ireland’s race towards NIS2 compliance is speeding up.

But what exactly is NIS2, and what does it mean for Irish businesses in the context of cybersecurity and compliance?

In this article, we discuss all there is to know about NIS2, so that affected organisations are prepared for a seamless transition when official implementation occurs.

 

What is the NIS2 Directive?

At its essence, the NIS2 Directive aims to safeguard critical sectors against the threat of significant cyberattacks.

Although it is based on its predecessor, the 2016 NIS Directive, the scope of NIS2 is broader, as it attempts to bolster the management of and response to cyber risk across participating EU member states. It does so by enforcing the implementation of stricter security measures

and incident reporting protocols among individual businesses and organisations.

Failure to comply with this newly implemented risk management framework will result in significant penalties.

Unlike GDPR, European directives like NIS2 require each member state to convert them into local laws. This can be both a time-consuming and complicated exercise, with applicable measures differing slightly between each member state.

According to a recent update on the NIS2 Directive website, after missing the initial deadline, “Ireland remains in a transitional phase in which the earlier NIS 1 framework continues to apply while the new legislative framework is progressing through the national legislative process”.

However, with the bill likely to be enacted in early 2026, the pressure is mounting on business owners to take measures into their own hands to ensure their organisations are fully prepared for the legally binding changes to come.

 

Who does the NIS2 Directive apply to?

The NIS2 Directive applies to a wider and deeper pool of entities, incorporating 18 sectors across two groups, categorised as “essential” or “important” services. They are as follows:

Annex 1 – Sectors of High Criticality

• Health
• Energy
• Transport
• Drinking Water
• Digital Infrastructures
• Waste water
• Space
• Banking
• Public admin
• ICT Service Management (B2B)

Annex 2 – Other Critical Sectors

• Digital providers
• Research
• Food Production and Distribution
• Postal and Courier Services
• Waste Management
• Manufacturing
• Manufacturing, Production & Distribution of Chemicals

If a security breach is experienced within one of the above areas, mitigation strategies must be implemented, and relevant authorities must be notified, such as the NCSC for large-scale incidents.

 

When do you need to ensure NIS2 compliance?

If your business is positioned within one of the listed groups, you may wonder if the Directive applies to you. You can answer this query by assessing both your sector classification and size thresholds.

Here are the criteria to consider:

• You must run a medium-sized or large operation.
• If your business sector falls under the “essential” category, you must have a minimum of 250 employees and an annual turnover of €50 million or higher.
• If your business sector falls under the “important” category, you must have a minimum of 50 employees and an annual turnover of €10 million.

If you’ve placed a tick alongside each of the above, it’s vital to begin actively preparing for the changes ahead.

 

 

The key steps to ensuring NIS2 compliance

When your business is required to adhere to NIS2 measures, it’s essential to become well-versed on the steps you must take to ensure compliance and to understand what this means for your business in the years to come.

Let’s examine the most important measures involved:

 

Create and oversee a stringent risk-management framework

Adherence to NIS2 regulations is based largely on creating a risk-management framework that supports seamless business operations. This should incorporate elements like:

• Business continuity and disaster recovery solutions
• Effective IT security and compliance

By working with a managed IT services provider (MSP), business owners can benefit from an holistic IT support experience that reinforces their security efforts and offers unbeatable peace of mind.

 

Enhance supply chain security

Given the risks associated with third-party breaches, supply chain security has become a major concern for businesses across the globe.

Reinforcing these networks will form a vital part of NIS2, with organisations expected to assess their supplier network and apply effective security measures, such as zero-trust access controls.

 

Engage in regular cybersecurity training

The NIS2 Directive has accountability at its core, with management bodies taking on the responsibility of security breaches, rather than passing the buck to IT teams.

Therefore, education and training in cybersecurity becomes a vital element of a strong defence, not just for senior leaders, but for all employees.

Engaging in ongoing training modules that enhance risk awareness and response is key, as is conducting regular simulations to assess the wider team’s ability to handle an incident in real time.

 

Adhere to incident report protocols to ensure NIS2 compliance

Thorough reporting is a crucial expectation of businesses operating under NIS2 rules.

Compliance in this context involves upholding regular communication with competent authorities following a cybersecurity incident. For example, an early warning notification is required within 24 hours of the incident occurring, while a full incident report is expected within 72 hours.

Organisations must also submit a final and comprehensive report within a month of the event in question.

Ensuring NIS2 compliance and running a business can be daunting tasks to take on simultaneously. This is why many business owners are counting on expert managed services providers to implement, advise and guide the way on the path towards effective IT risk management.

 

 

Secure NIS2 compliance with the help of Arbelos

If you’re looking for expert guidance on the NIS2 Directive protocol, it’s time to talk to our team at Arbelos.

With almost 20 years of experience working with Irish businesses, we are uniquely placed to provide regulatory and legal advice to businesses across all sectors seeking assistance with their compliance efforts.

We offer cost-effective IT solutions to SMEs of all sizes, including everything from IT security and compliance. and business continuity and disaster recovery, to Tech as a Service (TaaS).

We will help you to understand your risk and put measures in place to manage and mitigate threats, in adherence with NIS2 expectations.

Eager to get NIS2 ready? Contact us today to discover how we can help you meet increased resilience requirements.