NIS2 – BeSecureOnline.co.uk

NIST Planning & Services

Michael Conway, CEO, Renaissance, talks NIST

These cybersecurity regulations aim to minimise cyber risks and enhance protection, and dangers arising from frequent changes or new regulations impact organisational response strategies

Cybersecurity

Cyber Risk Strategy Development
Framework (NIST & other) Management
Incident Response Management
Cloud & 3rd Party Risk Management
ISO (& other) Certification Processes

Disaster Recovery

Backup
Disaster Recovery
Disaster Simulation Testing
ISO 23001 Certification

EU Compliance

DORA, NIS2 & GDPR Compliance
Records & Policy Management
Data Protection Impact Assessments
Data Breach Management

Useful Links

An EU cybersecurity regulation directive safeguarding information technology and computer systems forces companies and organisations to protect their systems and information from cyberattacks like viruses, worms, Trojan horses, phishing, denial of service (DOS) attacks, unauthorised access (stealing intellectual property or confidential information) and control system attacks.

NIS and NIS2 are EU-wide cybersecurity laws that require organisations to protect their networks, data, and digital services. They now establish the baseline for “good security” across Ireland, the UK, and the wider EU.

What NIS and NIS2 are?

The original NIS Directive (Network and Information Systems Directive, 2016) was the EU’s first horizontal cybersecurity law, aimed at achieving a high common level of security for essential services such as energy, transport, banking, health, water and digital infrastructure.

NIS2 (Directive (EU) 2022/2555) is the updated version that will be enforced from 18 October 2024. It expands the scope to more sectors and organisations and tightens security, governance, and reporting obligations.

NIS2 introduces clearer minimum-security measures, stricter incident-reporting timelines, and a more harmonised approach across member states, including Ireland. This aims to eliminate the inconsistent rules that existed under NIS.

Why NIS2 matters now?

NIS2 significantly broadens its coverage. In addition to traditional critical infrastructure, it now includes many more “essential” and “important” entities, such as key manufacturing, waste, food, digital, and other services. This brings thousands of Irish and EU organisations into scope for the first time. To determine if your organisation is affected, check if your sector is listed in the annexes and whether you meet the size or importance thresholds, such as turnover or staff levels. Review the latest official guidance and consult legal or compliance experts as needed to assess your status and take appropriate action.

Even businesses not formally in scope are experiencing indirect pressure, as larger customers, public bodies, and critical infrastructure operators increasingly require NIS2-level controls throughout their supply chains.

The directive makes cybersecurity a board-level responsibility, requiring management to approve the security strategy and oversee risk management. It also introduces specific liabilities for board members. In cases of serious non-compliance, individuals on the management body may face administrative fines, temporary disqualification from management roles, or other personal legal consequences, depending on the severity and national implementation. This highlights the need for active board engagement, ongoing oversight, and prompt action to address risks and incidents.

Benefits and value of compliance

Stronger risk management: NIS2 requires structured risk assessments, incident handling, business continuity and disaster recovery, supply-chain security, and technical controls such as MFA and encryption. These measures directly reduce the likelihood and impact of cyber incidents.

Immediate next steps for leaders to move from awareness to action:

– Conducting a gap analysis to assess your current cybersecurity posture against NIS2 requirements

– Organising a board or senior management briefing to ensure executive understanding and commitment

– Identifying your organisation’s status and mapping which business units or services are in scope using the latest sector lists and guidance

Taking these practical steps will help your organisation set clear priorities and accelerate compliance.

Better resilience and uptime:

Implementing robust backup, disaster recovery, and response planning enables organisations to continue operations or recover quickly after ransomware, data loss, or other disruptions.

Trust and competitive advantage:

Demonstrable compliance helps win and retain contracts, especially with government, regulated sectors, and large enterprises, who increasingly require NIS2-aligned evidence as part of due diligence.