NIS2 Ireland: what you need to know about compliance and certification

What does this mean for my company?

1. Registration

In Ireland, organisations that fall under the NIS2 legislation as essential or important entities will have to register themselves. The NIS2 Directive has not yet been fully transposed into national law. Once this process has been completed, the National Cyber Security Centre (NCSC) will make an official registration portal available.

If your organisation is classified as an essential or important entity based on the criteria described in the chapter ‘NIS2 entities’, you must provide the following information to the NCSC:

• Name of the organisation
• Address and current contact details of the entity, including email addresses and telephone numbers
• IP address ranges
• Sector and subsector
• Overview of EU Member States where services falling within the scope of the NIS2 Act are provided

Any changes to this information must be communicated within two weeks.

Although the registration portal is not yet available, the NCSC does offer an online self-assessment tool. This allows organisations to make an initial assessment of whether they fall within the scope of the NIS2 Act. This tool is purely informative and does not replace the official registration procedure.

Organisations were asked to submit the above information by 17 January 2025 at the latest. As the NIS2 Directive has not yet been transposed into national law and the registration portal is not yet operational, entities do not need to register for the time being. Once the legislation has been adopted, new deadlines and instructions will be published. The registration portal will only be available once the Directive has been officially transposed into Irish law.

2. Management measures

If your organisation is categorised as an essential or important entity, this means that you are responsible for implementing appropriate technical and organisational measures to ensure the security of your network and information systems. These cybersecuritymanagement measures include at least:

• Policy for risk analysis and security of information systems
• Incident management
• Business continuity, such as backup management and disaster recovery, and crisis management
• Supply chain security
• Security in the acquisition, development and maintenance of network and information systems, including the response to and disclosure of vulnerabilities
• Policies and procedures to assess the effectiveness of measures for managing cybersecurity risks
• Cyber hygiene and training in the field of cybersecurity
• Policies and procedures on cryptography and, where applicable, encryption
• Security aspects regarding personnel, access policy and asset management
• Use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communication and secure emergency communication systems within the entity, where applicable.

In the implementing regulation 2024/2690, the European Commission has elaborated the above minimum cybersecurity measures for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, providers of content delivery networks, managed services providers, managed security services providers, online marketplaces, online search engines, social networking services platforms and trust service providers.

3. Reporting obligation of significant incidents

Essential and important entities are required to notify the national Computer Security Incident Response Team (CSIRT), i.e. CSIRT-IE, when a significant incident occurs. In addition, they must also notify the recipients of their services if the significant incident affects the provision of services relating to the (sub)sectors listed in Annexes I and II.

An incident is considered significant if

• it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;
• it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.’

The significant incident shall be reported by the essential and important entity by email to info@ncsc.gov.ie or to incident@ncsc.gov.ie in the event of a cyber security incident involving the government, in accordance with the following procedure:

1. immediately and within 24 hours of becoming aware of the significant incident, the entity shall submit an early warning, stating the probable cause and any cross-border implications;
2. immediately and within 72 hours of becoming aware of the significant incident, the entity shall communicate an incident report containing an information update and an initial assessment of the incident;
3. at the request of the competent CSIRT, the entity shall submit an interim report;
4. No later than one month after the incident report, the entity shall submit a final report stating:
   1. A detailed description of the incident, as well as its severity and consequences;
   2. The type of threat or root cause that is likely to have led to the incident;
   3. Applied and ongoing risk mitigation measures;
   4. The cross-border consequences of the incident, if applicable.
5. If the incident is still ongoing one month after the incident report, the entity must submit a progress report and a final report within one month of the incident being resolved.

In Implementing Regulation 2024/2690, the European Commission has defined the criteria for a significant incident for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engines and social networking service platforms, and trust service providers. These special rules take precedence over national rules in case of inconsistencies.

Finally, all entities, regardless of whether they fall within the scope of the NIS2 Act, can voluntarily report (significant) incidents, cyber threats and near misses to the CSIRT-IE.

More information on reporting significant cyber incidents can be found here.

4. Obligations and responsibilities of management

The management bodies of essential and important entities are responsible for compliance with the NIS2 Act and must fulfil various obligations, including:

• Approving cyber security management measures and monitoring compliance with them
• Undertaking training to acquire sufficient knowledge and skills to identify risks and assess management measures and their impact on their services
• Continuously training the employees of the cyber security entity in the field of cyber security

The management bodies are liable for non-compliance with the NIS2 Act.

5. Cooperate with authorities

Essential and important entities must cooperate with the national authorities. This concerns the exchange of information on the security of network and information systems, reporting incidents, cooperation with the inspection service, etc.