Cyber security and NIS2

How we can help

Our approach 

Technology has become integral not only to the operation of most companies, but also to the delivery of services to citizens and the management of critical infrastructure and services that allow our society to function.

Additionally, Ireland has become a global technology hub, and as the European headquarters to more technology companies than other EU member states, an increasingly higher profile target from a cybercrime perspective.

Crimes committed through digital channels, or cyber crime has become an growing problem for Irish businesses and public bodies.

A cyber-attack can be one of the most complicated and challenging issues that an organisation faces and preventing or mitigating the risk of these cyber crimes such as denial of service attacks, ransom ware, distribution of malware, targeted phishing and the theft of personal information requires an increasingly effective control environment and set of solutions – technical and non-technical. As threats become more sophisticated, traditional security measures are proving inadequate.

The NIS directive is the EU’s response to this developing cyber security environment. The NIS Directive was the first piece of EU-wide legislation on cybersecurity. It aimed to bring cybersecurity capabilities at the same level of development in all the EU Member States and ensure that exchanges of information and cooperation are efficient, including at cross-border level.

The NIS2 will further enhance the work started in the NIS Directive in building a high common level of cybersecurity across the European Union. It places obligations on Member States and individual organisations/ companies in critical sectors.

The NIS2 aims to strengthen cyber resilience by focusing on the following key objectives:

• National strategies: Member States must create national cybersecurity strategies and set up authorities for cybersecurity, crisis management, contact points, and incident response teams (CSIRTs).
• Risk management and reporting: Entities listed in Annex I or II, and critical entities under Directive (EU) 2022/2557, must follow cybersecurity risk management and reporting rules.
• Information sharing: There are rules for sharing cybersecurity information.
• Supervision and enforcement: Member States have obligations to supervise and enforce these rules. In Ireland. 

The NIS2 distinguishes between "essential" and "important" entities. In principle, this distinction is based on the size of the entity and the service provided.

The National Cyber Security Centre (NCSC) has been designated as the main competent authority, with a further 7 public sector bodies designated at sectoral competent authorities in The National Cyber Security Bill 2024 Heads of Bill.

Our services

We have been providing cyber security services for over 20 years in Ireland and have conducted cyber security audits and compliance reviews on behalf of some of the largest organisations in Ireland across a range of sectors including financial services and publicly funded organisations including central government.

In addition we have been conducting NIS audits of operators of essential services (OES’s) under the NIS on behalf of the NCSC since 2020.

We have also been conducting compliance reviews, risk assessment and cyber security audits for those organisations required to compliance with the Cyber Security Baseline Standards since 2021.

We do not implement, support or design cyber security strategies, solutions or products and as such our services are truly independent. These services include:

• Cyber security/NIS and NIS2 risk assessments.
• Cyber security/NIS and NIS2 audits.
• NIS/NIS2/Cyber Security Baseline Standard compliance assessments.
• Cyber incident response review.
• Red teaming assessments, including physical social engineering, scenario based testing, phishing services and purple teaming.
•  IT/OT/ET security assessment and audit.
• Incident response, including incident response retainers, incident readiness and post incident review.
• Cyber security awareness training for boards, management boards and audit committees.
• Security audits using recognised frameworks such as NIST/NIS2/ISO 27001:2.
• Third-party assessments and audit and reporting (including ISAE3000, ISAE3402, SOC2).
• PCI DSS Secure Customer Authentication (SCA).
• Security architecture review/ audit.