NIS2, Ireland And Draft Guidance

NIS2 in Ireland: Latest Developments

The second Network and Information Security Directive (EU) 2022/2555 (NIS2) took effect on 17 October 2024 across the EU. It represents a significant step forward in the EU's efforts to strengthen the overall level of cybersecurity across Member States. It introduces several new obligations for in-scope entities and can be broken down into three pillars: (1) cybersecurity risk management; (2) incident reporting and handling; and (3) supervision and enforcement. For more general information about NIS2, see here.

The National Cyber Security Centre of Ireland (NCSC) will be Ireland's lead competent authority to supervise and enforce NIS2 (building on its role under the NIS Directive). Despite delays with the introduction of legislation transposing NIS2 into Irish law (see here), the NCSC has sought to be proactive in preparing for its imminent and expanded role under NIS2, as recently demonstrated by the following developments: