NIS2 is the EU directive on the security of network and information systems. It expands the sectors and organisations required to meet baseline cybersecurity controls and report incidents.

Free tool

Am I in scope for NIS2?

Q: What are the fines for non-compliance?

Up to €10M or 2% of global turnover for essential entities, and up to €7M or 1.4% of global turnover for important entities.

5 questions. Instant answer. No email required to start.

Step 1 of 5

1. Which sector best describes your business?

This tool gives directional guidance only. For a definitive assessment, book a free consultation.

Frequently asked questions

What is NIS2?

NIS2 is the EU directive that expands cybersecurity obligations across 18 sectors. It requires in-scope organisations to implement 10 risk management measures and report significant incidents. See NCSC Ireland for national guidance.

What are the fines for non-compliance?

Up to €10M or 2% of global turnover for essential entities. Up to €7M or 1.4% of global turnover for important entities. Senior management can also be held personally liable.

Ireland hasn't transposed NIS2 yet — do I still need to act?

Yes. The National Cyber Security Bill is progressing through the Oireachtas and enforcement is imminent. A gap assessment takes weeks; remediation takes months. Waiting until the Bill is enacted is the highest-risk strategy.

My company has fewer than 50 employees — am I affected?

Possibly, via the supply chain. If you supply products or services into NIS2-regulated sectors, your customers will push NIS2 requirements down to you as a contractual condition.