NIS2 Compliance Checklist

A NIS2 compliance checklist measures your business against the requirements of the EU NIS2 Directive. This checklist covers 30 checks across 7 areas: board and governance, risk and policies, incident reporting, continuity and recovery, supply chain, systems and maintenance, and people and access. Each check maps to the Directive's own articles, and your results show the gaps to close first.

NIS2 applies to an Irish business when two things are true: it works in a sector the Directive lists, and it meets the size test. The size test is 50 or more staff, or annual turnover and balance sheet both above €10 million. Listed sectors include pharmaceutical and medical device manufacturing, food production and distribution, machinery and transport equipment manufacturing, and air transport.

Smaller businesses feel it too. In-scope companies must manage cybersecurity risk across their direct suppliers, so security questionnaires and contract clauses reach businesses of every size.

NIS2 comes into force in Ireland when the National Cyber Security Bill passes. The Bill sits on the Government's autumn 2026 legislative programme for priority publication, and the Government expects to complete transposition by the end of 2026. The earlier NIS1 rules apply in the meantime.

The NIS2 Directive sets maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher. For important entities, the maximum is at least €7 million or 1.4% of worldwide annual turnover. Ireland's National Cyber Security Bill will set the final Irish figures within these rules.

Under Article 20 of NIS2, directors approve the business's cybersecurity risk measures, oversee how they are carried out, and complete training so they can recognise and assess cyber risk. Management bodies can be held liable for infringements. In July 2026 the National Cyber Security Centre published guidance for board members of NIS2 entities setting out what Irish boards should do now.

NIS2 sets three deadlines once a business becomes aware of a significant incident: an early warning to the national CSIRT within 24 hours, a full incident notification within 72 hours, and a final report within one month. If personal data is involved, GDPR also requires a report to the Data Protection Commission within 72 hours.

Your branded PDF report shows your NIS2 position, your readiness score, every answer and the Hybrid services that close each gap, ranked by priority. One of our account managers can then walk you through the results and agree the first practical steps. Hybrid Technology Partners is ISO 27001 certified, and Managing Director Paul Browne is a qualified ISO 27001 Lead Auditor.