A fixed-scope, four-week assessment for Irish organisations in scope of NIS2. You leave with a clear position, an executive report your board can act on, and a prioritised roadmap. No open-ended consultancy.
Ireland has not yet enacted the National Cyber Security Bill that transposes NIS2, but the pressure to do so is now coming from Brussels and the obligations are arriving by other routes.
The date by which every member state was to have NIS2 in national law. Ireland's National Cyber Security Bill remains unenacted.
The National Cyber Security Centre issues Guidance on Cyber Governance for Management Board Members in NIS2 Entities, written for CEOs, Accounting Officers and board members rather than IT teams.
The European Commission refers Ireland to the Court of Justice of the EU for failing to transpose NIS2.
The Bill can be enacted at any point, and the regulator has already published what it expects boards to have in place.
Organisations that assess now choose their own timetable. Those that wait will be working to someone else's.The National Cyber Security Centre's guidance for management board members is explicit about where responsibility sits and what it expects to see.
NIS2 places accountability for cyber risk management "at the highest level of executive management."
R.A. Browne, Director, National Cyber Security Centre — foreword to the NCSC's guidance for management board members in NIS2 entities
In the NCSC's framing, cyber risk is a business risk rather than an IT matter, and board members are personally accountable for four things:
The guidance also sets out the questions it expects every board member to be able to answer — among them: what are our critical assets and systems, how are we managing supply-chain risk, how do we benchmark our cyber posture, when did we last test, and how prepared are we to detect and respond to an incident.
It names the Cyber Fundamentals framework (CyFun) as the NCSC's preferred approach to demonstrating NIS2 compliance, and notes that early supervisory attention will focus on governance.
NIS2 reaches well beyond the utilities and infrastructure operators covered by the first directive. Most medium and large organisations in these sectors are in scope, and smaller organisations can be brought in where they provide a critical service.
The directive treats cybersecurity as a governance matter. Three articles carry most of the weight for senior management, and the penalties sit alongside them.
The management body must approve the organisation's cyber risk-management measures, oversee their implementation, and can be held liable for failures. Board members must undertake cybersecurity training.
Supervisors will expect to see this recorded: decisions, minutes, evidence of oversight.
Ten mandatory measures: risk analysis and policies, incident handling, continuity and crisis management, supply-chain security, secure development and vulnerability handling, effectiveness testing, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication.
Each must be proportionate to your exposure and demonstrable on request.
A significant incident must be reported with an early warning within 24 hours, a notification within 72 hours, and a final report within one month.
That clock only works if you already know what counts as significant, who decides, and how the report is made.
Up to €10 million or 2% of global turnover for essential entities; up to €7 million or 1.4% for important entities, whichever is higher.
Authorities can also suspend certifications and, for essential entities, temporarily bar individuals from management roles.
The reason is rarely a lack of technology. It is that nobody has measured the organisation against the directive, evidence is scattered across teams and suppliers, and the board has never been given a view it can understand and sign off. That is a governance gap, and it can be closed in four weeks.
Fixed scope. Four weeks. Delivered on the CyberPrism platform with a CRI practitioner guiding your team throughout — so the work is done with you, not to you.
A documented view of whether you are in scope, as an essential or important entity, and which obligations follow.
What the organisation relies on, where it is exposed, and what an incident would mean for it.
Your position against Articles 20, 21 and 23, evidenced and mapped to NIST CSF 2.0 and CyFun.
Your assessment, gaps and evidence on CyberPrism for the programme and 30 days after it.
Written for a board, not an IT department. Where you stand, what matters most, and what closing the gaps will take.
Actions ordered by exposure and effort, with owners and timeframes your team can commit to.
A session with your board or executive team, meeting the expectation that management understands and oversees cyber risk.
ThreatLens matches current threat activity and vulnerabilities to where you are weakest, so the roadmap reflects what is happening now.
CyberPrism holds your assessment, evidence, dashboards and reports in one place — and keeps them current after the assessment ends, rather than leaving you with a document that dates on the day it is delivered.
The assessment is anchored on NIST CSF 2.0 and includes the CyFun (Cyber Fundamentals) framework, which the National Cyber Security Centre describes as its preferred approach to demonstrating NIS2 compliance — so your position is expressed in terms the Irish regulator already uses. The same platform carries overlays for DORA, the EU AI Act and other regimes — which matters if NIS2 is not the only obligation you face.
The assessment ends with a decision, not a filing cabinet. Most organisations choose one of two paths.
Keep your CyberPrism environment live. Track remediation, re-assess quarterly, receive ongoing threat intelligence and advisory, and give your board a standing view rather than an annual snapshot. This is the position supervisors will expect once the Bill is enacted.
Take the report and roadmap and work through it with your own team or existing providers. Nothing in the assessment ties you to CRI, and the roadmap is written so it can be handed to whoever will deliver it.
Because the obligations are already arriving by other routes. The NCSC has published detailed governance guidance for board members, including a readiness checklist. Customers and insurers are writing NIS2 clauses into contracts. And the European Commission is pursuing Ireland through the Court of Justice, which makes enactment a matter of when. Organisations that assess now choose their own timetable.
Typically two to three hours a week from a coordinator, plus one short session each with the people who own the relevant areas — IT, operations, HR, procurement, legal. Our practitioner does the structuring, mapping and analysis so your team is answering questions, not writing reports. Four weeks works because the platform holds the framework; nobody is building spreadsheets.
Those are good foundations and the assessment credits them. NIS2 adds obligations they do not cover — board accountability, incident reporting timelines, supply-chain measures — and asks for those to be evidenced in the regulator's terms. The assessment shows exactly where your existing certification carries you and where it does not.
No. It is a readiness assessment. Its purpose is to give you an accurate position and a plan before any supervisor asks. The evidence base it produces is, however, what you would draw on if one did.
That is settled in the first week. If it turns out you are not in scope, we will tell you — and you will still hold a clear view of your exposure and a short list of sensible actions.
Yes, and usually should be. They hold much of the evidence and will deliver part of the roadmap. We work alongside them; the assessment sits above the technology, not in competition with it.
The programme is fixed-price for a defined scope, which is confirmed on the scoping call. We will not sell you a longer engagement than you need.
Four weeks suits most organisations with a single legal entity and a coordinator who can give it a few hours a week. Larger groups, multi-site operators or organisations with several subsidiaries in scope may need longer, and the programme can be extended by agreement at scoping or during week one. The scope, timetable and price are settled before work starts, so an extension is never a surprise.
A 30-minute scoping call is enough to confirm whether you are in scope, what the four weeks would cover for you, and when it could start.
