Ireland and the EU: NIS2, DORA and GDPR

Who it covers

NIS2. Medium and large organizations in the sectors the directive lists, such as energy, transport, banking, health, digital infrastructure, some manufacturing and ICT service management. Managed service providers and managed security service providers are named in that last sector, so many partners are in scope themselves.
Ireland is transposing NIS2 through the National Cyber Security Bill, with the National Cyber Security Centre at its center. The Bill had not been enacted when this page was written. The NCSC has published guidance for management boards on what the directive expects of them.
DORA. Banks, insurers, investment firms, payment and e-money institutions and other financial entities, since January 17, 2025, supervised in Ireland by the Central Bank.
GDPR. Any organization that handles personal data, supervised in Ireland by the Data Protection Commission.

Article 20. The management body approves the cybersecurity risk-management measures, oversees them and can be held liable. Its members must take training.
Article 21(2)(d). Supply chain security, including the security of relationships with direct suppliers and service providers.
Article 21(2)(e) and (f). Vulnerability handling, and policies to assess whether the security measures work.
Article 21(2)(j). Multi-factor or continuous authentication where appropriate.
Article 23. An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within a month.

Article 28(3). A register of information on every contractual arrangement for ICT services from third-party providers, reported to the Central Bank.
Articles 24 and 25. A testing program that includes vulnerability assessments and scans, network security assessments and penetration tests.
Article 19. Reporting of major ICT-related incidents to the Central Bank.

Article 32. Security appropriate to the risk, including a process for regularly testing and evaluating whether it works.
Article 28. Using only processors that give sufficient guarantees, under a written contract.
Article 33. Notice to the Data Protection Commission within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people.

Supplier discovery, ranking and breach alerts, toward NIS2 supply chain security and DORA’s third-party risk duties.
A supplier register drafted in Predictive GRC for your client to confirm, as a starting point for the DORA register of information.
Automated external scans, ranked fixes and tickets toward NIS2 vulnerability handling, DORA’s testing program and GDPR Article 32.
Penetration tests ordered through the Validate module, by your own testers or a trusted network of third-party, AI-assisted, human-led testers, toward DORA Article 25 and GDPR Article 32.
MFA registration and enforcement, read from Entra ID once the inside view is connected, toward NIS2 Article 21(2)(j).
Supplier breach alerts, so your client hears of a provider’s incident early, ahead of the NIS2 and DORA reporting clocks.
A board report drafted from your client’s risk register and evidence, for the management body’s oversight under NIS2 Article 20.
An evidence pack mapped to each rule that applies, in Predictive GRC.