Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The National Cyber Security Bill 2024 transposes the EU's NIS2 Directive into Irish law, enhancing cybersecurity requirements and establishing the NCSC's role.
The National Cyber Security Bill 2024 is an Irish bill that aims to transpose the EU's NIS2 Directive into Irish law. It establishes cybersecurity requirements for essential and important entities, designates competent authorities for supervision and enforcement, and puts the National Cyber Security Centre (NCSC) on a statutory footing.
The bill mandates robust risk management, incident reporting, and defines penalties for non-compliance, including potential suspension of business licenses and restrictions on management positions.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Where applicable, essential and important entities shall communicate, without undue delay, to the recipients of their services that are potentially affected by a significant cyber threat any measures or remedies that those recipients are able to take in response to that threat. Where appropriate, the entities shall also inform those recipients of the significant cyber threat itself.
(1) Essential and Important entities shall notify, without undue delay, the CSIRT in accordance with section (3) of any incident that has a significant impact on the provision of their service.
(2) Where appropriate, entities concerned shall notify, without undue delay, the recipients of their services of significant incidents that are likely to adversely affect the provision of those services.
(5) An incident shall be considered to be significant if:
a. it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;
b. it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
(6) For the purpose of notification under section (1), the entities concerned shall submit to the CSIRT:
a. without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
b. without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;
c. upon the request of a CSIRT an intermediate report on relevant status updates;
d. a final report not later than one month after the submission of the incident notification under point (b), including the following:
e. a detailed description of the incident, including its severity and impact;
f. the type of threat or root cause that is likely to have triggered the incident;
g. applied and ongoing mitigation measures;
h. where applicable, the cross-border impact of the incident;
i. in the event of an ongoing incident at the time of the submission of the final report referred to in section (6)(d), entities concerned provide a progress report at that time and a final report within one month of their handling of the incident.
(7) By way of derogation from the section (6)(b), a trust service provider shall, with regard to significant incidents that have an impact on the provision of its trust services, notify the CSIRT without undue delay and in any event within 24 hours of becoming aware of the significant incident.
The management board of essential and important entities shall:
The management board of essential and important entities are required to follow cyber security risk-management training and shall encourage their employees to take relevant cyber security training on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include policies on risk analysis and information system security.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include incident handling.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include incident handling.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include business continuity, such as backup management and disaster recovery, and crisis management.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include basic cyber hygiene practices and cybersecurity training.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include policies and procedures regarding the use of cryptography and, where appropriate, encryption.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include measures for human resources security.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include measures for access control policies.
The measures referred to in section (1) shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents and shall include measures for asset management.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.