NIS2 is an EU directive, so it only bites on organisations once each Member State writes it into national law. In Ireland that law will be the National Cyber Security Bill. As at 23 September 2026, it has not been enacted. The Government has published a General Scheme (the draft outline of the Bill), and the Bill sits on the Autumn 2026 Legislation Programme for priority publication.

So, strictly, there's no Irish NIS2 statute to comply with yet. In practice the direction is clear. The Directive's obligations are fixed at EU level, the NCSC has published the risk-management and governance expectations it intends to supervise against, and the Commission has taken Ireland to the Court of Justice over the delay, asking for financial penalties until transposition is notified. The gap between enactment and supervision is unlikely to be generous.

That's why organisations that expect to be in scope are doing the work now: confirming scope, fixing the obvious gaps, and getting management sign-off in place before the registration portal opens.

Example: Cork medical device manufacturer

180 staff, €40m turnover. Manufacturing medical devices is an Annex II service and the company is medium-sized, so it is likely an important entity.

Example: Dublin managed service provider

60 staff, B2B managed IT and security services. ICT service management is Annex I; at medium size it is likely important, and the main-establishment rule decides which country supervises it.

Example: Galway software supplier

35 staff selling software to hospitals. Probably outside direct scope, yet its hospital customers must manage supply-chain risk under Article 21, so NIS2-style requirements will arrive by contract.

Scope and governance

• Entity classification and the services that drive it
• Management-body approval and oversight of security measures
• Board training records
• Roles, responsibilities and reporting lines

Risk and policy

• Risk analysis method and current risk register
• Information-security policy set
• Asset inventory and ownership
• Cryptography and encryption policy

Resilience

• Incident handling and escalation
• Business continuity, backup and disaster recovery
• Crisis management and communications
• Reporting readiness for 24h / 72h / one-month deadlines

Technical controls

• Access control and privileged access
• MFA coverage and exceptions
• Vulnerability handling and disclosure
• Secure acquisition, development and maintenance

Third parties

• Supplier inventory and criticality
• Security clauses in contracts
• Assurance you receive from suppliers
• Concentration and exit risks

Effectiveness

• How you measure whether controls work
• Security testing results and remediation
• Cyber hygiene and staff training
• Internal audit coverage

What you get

A written assessment report with a scope and classification note, a requirement-by-requirement maturity rating, the evidence we saw (and didn't), and a prioritised list of actions.

What it isn't

A certificate, or a regulator's view. It's an independent, evidence-based picture you can use to plan work and brief your board.

01

Scope determination

We map your services to Annex I and II, apply the size rules to your group structure, and write down the reasoning, so you have a defensible position if anyone asks.

02

Requirement mapping

Article 21(2)(a) to (j) mapped against your existing controls, ISO 27001 Annex A or CyFun, so each requirement has an owner and a status.

03

Policies that people use

We draft or rework the policies NIS2 expects (risk, incident, continuity, supplier, cryptography, access) around how your teams actually operate.

04

Incident processes

Triage criteria for "significant incident", decision rights, and templates for the 24-hour early warning and 72-hour notification, then a tabletop exercise to test them.

05

Supply-chain security

Supplier tiering, a proportionate due-diligence questionnaire, contract clauses, and a review cycle for critical providers.

06

Board briefing and training

Short, sector-specific sessions so your management body can approve measures with some understanding of what it's signing, as Article 20 expects.

07

Evidence preparation

An evidence register that ties each requirement to where proof lives and who keeps it current.

08

Remediation support

Hands-on consulting while your team closes gaps, including technical work such as MFA roll-out planning or vulnerability-management process design.

A NIS2 compliance audit is where we stop advising and start testing. We take a sample period, check that each measure was designed properly and actually operated, and record the evidence behind every conclusion. Most clients use it once remediation is well under way, or before a board sign-off.

It's also practice for the real thing. Under Articles 32 and 33, competent authorities can require security audits by an independent body and ask for audit results and the underlying evidence. Organisations that have been through an independent NIS2 audit usually find those requests much easier to answer.

What a NIS2 audit from us covers

• Governance and management oversight
• Policy set and approvals
• Risk management process
• Control design
• Control implementation and operation
• Evidence quality and completeness
• Technical security controls, with testing where agreed
• Incident readiness and reporting
• Business continuity and recovery
• Supply-chain risk
• Status of earlier remediation

NIS2 makes you responsible for the security aspects of your relationships with direct suppliers and service providers. Article 21(3) goes further: when you decide what's appropriate, you have to take into account each supplier's specific vulnerabilities, the overall quality of their products and security practices, and their secure development procedures.

For a lot of Irish organisations, this is the largest piece of new work. It's also where NIS2 reaches beyond its own scope: suppliers that aren't in scope themselves get NIS2 requirements through contracts with customers that are.

We run supplier security reviews and third-party assessments as part of NIS2 work, and as a standalone third-party risk management service.

Within 24 hours

Early warning

Of becoming aware of a significant incident. Say whether it may be caused by unlawful or malicious acts and whether it could have a cross-border impact.

Within 72 hours

Incident notification

Of becoming aware. Update the early warning with an initial assessment of severity and impact, and indicators of compromise where available.

On request

Intermediate report

Status updates if the CSIRT or competent authority asks for them.

Within one month

Final report

Of the incident notification: a detailed description, the likely root cause, mitigation applied and any cross-border impact. If the incident is still ongoing, a progress report instead, then a final report within a month of handling it.

How this works in Ireland today

The NCSC (CSIRT-IE) will run a dedicated NIS2 incident reporting portal once the Bill is enacted; it isn't live yet. Designated operators under NIS1 report under the existing rules, and any organisation can report an incident to the NCSC voluntarily now.

Where teams usually struggle

Not the deadlines, but the decision before them: who decides an incident is significant, on what criteria, at 2am on a Sunday. We build that decision into your runbook and test it with a tabletop. More detail in our guide to the NIS2 incident reporting timeline.

Article 20 moves cybersecurity from the IT agenda to the board agenda. In July 2026 the NCSC published guidance for management board members of NIS2 entities (in the public sector, that includes Accounting Officers) setting out how it expects boards to approve, oversee and understand cyber risk.

In our experience, boards don't need to become technical. They need three things: a clear view of the organisation's top cyber risks, a short set of measures they can track, and enough training to challenge what they're told. We run board briefings built around your sector and your actual gap-assessment findings.

Some organisations bring in a virtual CISO to own that reporting line; see our CISO advisory service.

1. 01Determine scope
2. 02Identify entity classification
3. 03Map requirements

1. 04Assess current controls
2. 05Identify gaps
3. 06Prioritise risks

1. 07Implement controls
2. 08Strengthen supply-chain security
3. 09Establish incident processes
4. 10Build evidence

1. 11Review management oversight
2. 12Test effectiveness
3. 13Maintain ongoing compliance

Governance

• Management approvals of measures
• Board training records
• Security roles and reporting

Risk and assets

• Risk assessments and treatment plans
• Security policies with review dates
• Asset inventories

Incidents and continuity

• Incident procedures and incident records
• Business continuity plans
• Backup evidence and disaster recovery tests

Access and technical

• Access-control and privileged access reviews
• MFA coverage evidence
• Vulnerability management and patch records
• Security testing reports and remediation records

Suppliers and people

• Supplier assessments
• Contracts with security clauses
• Staff training evidence

Our NIS2 services are open to organisations anywhere in Ireland: tech, data-centre and financial-services operators in Dublin, medical device and life-sciences manufacturers around Cork, Galway and Limerick, or manufacturing and logistics businesses in the south-east around Waterford.

To be straightforward about it: VISTA Infosec doesn't have an office in Ireland. EU engagements are contracted through Zulon Audits OÜ, our EU entity in Tallinn, and delivered by our in-house team. Most NIS2 work runs remotely during Irish business hours, with on-site workshops, interviews or evidence reviews when they're genuinely useful and agreed in advance.

Auditors, not only advisers

Our core work for more than 21 years has been independent security and compliance audit: PCI DSS as a QSA company, plus ISO 27001 and SOC 2 engagements. We know what a tester asks for, and we build your NIS2 evidence with that in mind.

Technical depth in-house

CREST-accredited and CERT-In empanelled, so the technical side of Article 21, from penetration testing to configuration reviews and red-team exercises, is done by our own people, not subcontracted.

Qualified practitioners

Team credentials include CISSP, CISA, CRISC and ISO 27001 Lead Auditor. We're ISO 27001 certified ourselves, so we run the same kind of management system we assess.

Honest about limits

No Irish office, no NIS2 certificate, no guarantees about a regulator's view. What you get is a clear method, documented evidence and advice you can check against the law.

Start with a scoping call

A short call to talk through your services, size and current controls. We'll tell you honestly whether you need us.

We don't publish a price list, because a 60-person MSP and a multi-site manufacturer need very different amounts of work. After a short scoping call and questionnaire, we give you a fixed fee for a defined scope, with timelines, before any work starts.

Most organisations start with a gap assessment, which is the smallest commitment and tells you how much implementation work there actually is.

Checklists are a good start. We publish one. But two organisations can tick the same box and be in very different positions: one has an incident plan that has been exercised, the other has a document written for an ISO audit three years ago.

NIS2 is proportionate by design, so what counts as appropriate depends on your entity type, sector, size, services, jurisdiction, technology, existing controls, suppliers and risk exposure. A checklist can't weigh those. An evidence-based assessment can, and it gives you something a checklist never will: proof.