Written by the Nostra team · Reviewed October 2026
The quick test has two parts. Sector: NIS2 covers energy, transport, banking and financial infrastructure, health, water, digital infrastructure and ICT services, public administration, space — plus 'important' sectors like manufacturing of key goods, food production and distribution, chemicals, waste, postal services and digital providers. Size: generally 50+ staff or €10m+ turnover, though critical providers can be in scope regardless of size. And even out-of-scope businesses feel NIS2 through customers' supply-chain requirements — expect security questionnaires from in-scope clients.
Ten measures appear in the directive, and they're refreshingly practical: risk analysis and security policies, incident handling, business continuity and crisis management, supply-chain security, secure development and vulnerability handling, measuring effectiveness, cyber hygiene and training, cryptography policies, access control and asset management, and multi-factor authentication. If you've aligned with ISO 27001 or implemented a serious security baseline, you're most of the way there.
NIS2 requires management bodies to approve security measures, oversee implementation and undergo training — and allows regulators to hold managers personally liable for gross negligence. Fines scale to €10m or 2% of global turnover for essential entities. This is why NIS2 lands on board agendas in a way earlier directives never did.
Scope yourself honestly (sector and size). Baseline your current controls against the ten measures — a gap assessment makes this a two-week exercise, not a six-month one. Fix the universally weak spots first: MFA everywhere, tested backups, incident response plan, supplier list with criticality. Then put dates and owners on the rest. Ireland's transposition gives you time to do this properly — but supply-chain pressure means your customers may ask before the regulator does.
Written by the Nostra team | Reviewed October 2026
NIS2 is an EU directive being transposed into Irish law, with the NCSC as a central player in oversight. In-scope businesses should prepare now — the requirements are known, and supply-chain obligations are already flowing through contracts.
Both face the same security obligations; essential entities face proactive supervision and higher fines, while important entities are supervised reactively after incidents.
Largely, yes: ISO 27001 maps well onto NIS2's measures. You'll still need to confirm incident-reporting readiness and management training, but certification puts you far ahead.
Thirty minutes with a Nostra specialist answers more than an afternoon of reading.
Book a 30-minute conversation