NIS2 in Plain English: A 10-Minute Briefing for Donegal Business Owners.

Did you know that senior managers can now be held personally liable for their company’s cybersecurity failures?

What is NIS2?

The EU’s new Network and Information Systems Directive (NIS2) is a sweeping piece of cybersecurity legislation that replaces the original 2016 directive. Think of it as a digital seatbelt law for the entire European Union. Its goal is to create a safer and more resilient digital environment for everyone by forcing businesses in critical sectors to take cybersecurity seriously. The directive was introduced to harmonise cyber security across the EU, keeping up with increased digitisation and an evolving cybersecurity threat landscape. For a business in Sligo or Donegal, this means new rules and new responsibilities are on the horizon. The directive aims to protect the EU's economy from the escalating threat of cyberattacks, which cost businesses billions annually.

Who Does NIS2 Apply To?

NIS2 expands its reach far beyond the original directive, pulling in a much wider range of businesses. The legislation categorises in-scope entities as either ‘Essential’ or ‘Important’ based on their size and sector. The EU defines a medium-sized enterprise as one with at least 50 employees and an annual turnover exceeding €10 million. If your business operates in sectors like energy, transport, healthcare, digital infrastructure, or public administration, and you meet the size criteria, you are likely in scope. This could include a haulier moving goods through Donegal, a food producer in Sligo, or a local managed IT provider. The key takeaway is that thousands of Irish SMEs previously untouched by this kind of regulation will now have to comply. This broadened scope is a direct response to the increasing interconnectedness of our digital world, where a cyberattack on one seemingly small entity can have cascading effects across an entire supply chain or critical service. Even if your business doesn't directly provide critical services, if you are a key supplier to one that does, you could find yourself indirectly impacted by NIS2's requirements for supply chain security. The NCSC Ireland provides an indicative ‘Am I in Scope?’ tool to help businesses assess their potential inclusion.

What Does NIS2 Require?

At its core, NIS2 demands that businesses adopt a proactive, risk-based approach to cybersecurity. This isn’t just about installing antivirus software; it’s a fundamental shift in how you manage digital risk. The directive mandates a minimum set of security measures, including incident handling, supply chain security, vulnerability management, and cybersecurity training. Crucially, it places the ultimate responsibility for these measures squarely on the shoulders of the management board. You, as a business owner, will be required to approve, oversee, and be accountable for your organisation's cybersecurity posture. The National Cyber Security Centre (NCSC) in Ireland has even recommended its ‘Cyber Fundamentals Framework’ (CyFun) as the preferred way to demonstrate compliance. This framework outlines essential security practices, from basic cyber hygiene to more advanced threat detection and response. Businesses will need to implement robust policies for risk analysis and information system security, handle security incidents effectively, ensure business continuity and crisis management, and secure their supply chains. This means scrutinising the cybersecurity practices of your suppliers, a critical step given that many cyberattacks originate through third-party vulnerabilities. Regular training for employees is also a mandatory requirement, recognising that human error remains a significant factor in security breaches.

---

Not sure where your business stands on cyber risk? Download the Irish SME Cyber Survival Guide — a free, plain-English guide to the 10 controls every Irish business needs. No jargon, no sales pitch.

---

What Are the Penalties for Non-Compliance?

This is where the directive shows its teeth. The penalties for non-compliance are severe and designed to be a powerful deterrent. For ‘Essential’ entities, fines can reach up to €10 million or 2% of global annual turnover, whichever is higher. For ‘Important’ entities, it’s up to €7 million or 1.4% of global turnover. But the financial penalties are only part of the story. As mentioned, senior managers can be held personally liable for infringements, potentially facing temporary bans from holding management positions. The Irish government is currently transposing NIS2 into national law, and while the final details are still being ironed out, the message from the EU is clear: non-compliance will be costly. The European Commission has already issued a formal notice to Ireland for missing the initial transposition deadline of October 2024, highlighting the urgency of this legislation. Beyond fines, non-compliance can lead to significant reputational damage, loss of customer trust, and operational disruptions that can cripple a business. For a Donegal business, this could mean losing contracts, facing legal challenges, and struggling to recover from a cyber incident without adequate protections in place.

NIS2 Executive Summary

What Should Donegal Business Owners Do Next?

The first step is simple: find out if you are in scope. Don’t assume you are too small or that this doesn’t apply to you. The expanded scope of NIS2 means many businesses in Donegal and Sligo will be caught by these new rules. Start by reviewing the sectors listed in the directive and assessing your business against the size thresholds. The NCSC website is the best source of truth for Irish businesses and a great place to start your research. This isn't a problem you can afford to ignore; it's a freight train coming down the tracks. The time to prepare is now. Engaging with cybersecurity experts can help you navigate the complexities of NIS2 and develop a tailored compliance strategy. Proactive preparation will not only help you avoid penalties but also strengthen your business against the ever-growing threat of cyberattacks, protecting your assets, your reputation, and your customers. Consider seeking guidance from a vCISO to understand your specific obligations and implement the necessary controls.

Related Reading

• NIS2 Fines and Penalties: The Numbers That Should Keep Every Irish Director Awake.
• The 12-Month Cyber Governance Roadmap for a Donegal SME: From Zero to NIS2-Ready.
• Director Liability in the Age of NIS2 and GDPR: A Briefing for Irish Company Directors.

Ready to find out exactly where your business stands? Book a free 20-minute strategy call with our vCISO team at pragmaticsecurity.ie/book-a-call. No sales pitch. No jargon. Just clarity on your cyber risk — and a clear plan to address it.

Internal Links

• Glossary
• Is Your Business in Scope for NIS2?
• Our Blog
• Book a Call

External Sources

• NCSC Ireland - NIS2 Information
• IAPP - NIS2 and Ireland's National Cyber Security Bill