NIS2 Ireland

Use of multi-factor authentication for important data systems

Critical

High

Normal

Low

Defining and documenting accepted authentication methods

Critical

High

Normal

Low

Use and evaluation of password management system

Critical

High

Normal

Low

Using multi-factor authentication for admins

Critical

High

Normal

Low

Enabling multi-factor authentication for all users

Critical

High

Normal

Low

Personnel guidelines for safe data system and authentication info usage

Critical

High

Normal

Low

Data system management

Choosing and using network protection systems

Critical

High

Normal

Low

Virtualization

29.5: Defining and monitoring required supply chain security measures

When considering which measures referred to in section 4(d) are appropriate, entities shall take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. When considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out by the co-operation group in accordance with Article 22(1) of the Directive.

Related tasks

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Supply chain cyber security risk management

Critical

High

Normal

Low

Supplier security

Cyber security management

29.6: Non-conformities and corrective actions

A relevant designated competent authority that is made aware that an entity does not comply with the measures provided for in section (4) takes, without undue delay, all necessary, appropriate and proportionate corrective measures as per Part 8 of this Act.

Related tasks

Treatment process and documentation of identified non-conformities

Critical

High

Normal

Low

Risk management

Continuous improvement and documentation

Critical

High

Normal

Low

30: Use of cyber security certification schemes

(1) In order to demonstrate compliance with particular requirements of Cyber Security risk-management measures per Head 29-

(2) an essential or important entities may be required to use particular ICT products, ICT services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under a European cyber security certification scheme adopted pursuant to Article 49 of Regulation (EU) 2019/881; or

(3) an essential or important entities may be advised to use particular ICT products, ICT services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under a national cyber security certification scheme.

Related tasks

Use of certified ICT products, services and processes

Critical

High

Normal

Low

Data system management

33.1: Voluntary information-sharing arrangements

On a voluntary basis, entities falling within the scope of this [Act] and, where relevant, other entities not falling within the scope of this [Act] should exchange relevant cyber security information among themselves, including information relating to cyber threats, near misses, vulnerabilities, techniques and procedures, indicators of compromise, adversarial tactics, threat-actor-specific information, cybersecurity alerts and recommendations regarding configuration of cybersecurity tools to detect cyberattacks, where such information sharing:

a. aims to prevent, detect, respond to or recover from incidents or to mitigate their impact;

b. enhances the level of cybersecurity, in particular through raising awareness in relation to cyber threats, limiting or impeding the ability of such threats to spread, supporting a range of defensive capabilities, vulnerability remediation and disclosure, threat detection, containment and prevention techniques, mitigation strategies, or response and recovery stages or promoting collaborative cyber threat research between public and private entities.

Related tasks

Contact with industry-specific interest groups

Critical

High

Normal

Low

Technical vulnerability management

The goals of threat intelligence and the collection of information related to information security threats

Critical

High

Normal

Low

Sharing threat intelligence

Critical

High

Normal

Low

Technical vulnerability management

Internal communication about the organization's risk situation

Critical

High

Normal

Low

Cyber security management

33.2: Cybersecurity information sharing agreements

The NCSC will ensure the exchange of information shall take place within communities of essential and important entities, including within the Sectors set out in Schedule I and II, and where relevant, their suppliers or service providers. Such exchange shall be implemented through cybersecurity information-sharing arrangements in respect of the potentially sensitive nature of the information shared.

Related tasks

Definition of information sharing agreements and notification obligations

Critical

High

Normal

Low

33.4: Notification of participation in information exchange agreements

The Essential and Important entities shall notify their designated competent authority of their participation in the cybersecurity information-sharing arrangements referred to in section (2), upon entering into such arrangements, or, as applicable, of their withdrawal from such arrangements, once the withdrawal takes effect.

Related tasks

Definition of information sharing agreements and notification obligations

Critical

High

Normal

Low

Incident management and response

34: Voluntary notification of relevant information

(1) In addition to the notification obligation provided for in [Head 15], notifications can be submited to the NCSC, on a voluntary basis, by:

a. essential and important entities with regard to incidents, cyber threats and near misses;

b. entities other than those referred to in (a), regardless of whether they fall within the scope of this Directive, with regard to significant incidents, cyber threats and near misses.

(2) The NCSC, as CSIRT shall process the notifications referred to in section 1 of this Head in accordance with the procedure laid down in [Head 15]. Member States may prioritize the processing of mandatory notifications over voluntary notifications.

(3) Where necessary, the competent authorities shall be provided with information about notifications received pursuant to this Article shall be sent to the NCSC, as CSIRT and single point of contact, while ensuring the confidentiality and appropriate protection of the information provided by the notifying entity.

(4) Without prejudice to the prevention, investigation, detection and prosecution of criminal offences, voluntary reporting shall not result in the imposition of any additional obligations upon the notifying entity to which it would not have been subject had it not submitted the notification.

Related tasks

Voluntary notifications of security incidents

Critical

High

Normal

Low