NIS2 · CER · DORA · CRA · CyFun · Cyber Essentials
From NIS1 in 2016 to the Cyber Resilience Act and the AI Act, European law now expects organisations to understand, manage and evidence the risks to the networks they depend on, and it holds management accountable. We are the network engineers who can show you where you stand and fix what needs fixing.
Why us
We operate Ireland’s internet exchange and core networks for ISPs, data centres and carriers. The resilience measures we recommend are the ones we live with every day.
The networks and systems we build and run are designed to meet, and usually exceed, the controls in ISO 27001, CyFun and Cyber Essentials. Certification becomes a matter of evidence, not rework.
One of our directors is a chartered accountant with a diploma in corporate governance. Our findings are written for the audit committee as well as the engineers.
We don’t resell hardware, take vendor commissions, or sell a compliance platform. You get a straight answer, and the work stays proportionate.
How we help
Are you in scope, and as what? We map your networks, services and suppliers against NIS2, DORA or your chosen framework (ISO 27001, CyFun, Cyber Essentials) and tell you where the gaps are, ranked by risk.
Physical and logical paths, single points of failure, hidden dependencies (DNS, transit, data centres, “diverse” circuits that share a duct), routing security and monitoring.
We fix what we find: redundant design, DDoS defences, RPKI and filtering, out-of-band access, backups you have tested, and configuration management that leaves an audit trail.
We write playbooks and run realistic scenario exercises with your technical and management teams. We already do this as part of an internet exchange’s ISO 27001 programme.
Technical due diligence on your network, transit, data centre and managed-service providers, plus concentration risk, exit plans and contract requirements.
Support through ISO 27001, CyFun or Cyber Essentials certification; evidence packs your auditor or regulator can follow; and plain-language briefings for management bodies.
Frameworks & certification
Regulation says what to achieve. Frameworks say how, and certification proves it. Our work is built to meet and exceed these standards, and clients come to us when they want to certify against one or more of them.
The international standard for information security management systems.
How we help: We work inside clients’ ISO 27001 programmes, including INEX’s: scoping, risk treatment, technical controls, business impact assessments and incident-response tabletop exercises.
A framework based on the NIST Cybersecurity Framework, developed by Belgium’s Centre for Cybersecurity and adopted by Ireland’s NCSC in 2025. It has three assurance levels: Basic, Important and Essential.
How we help: It is a practical route to demonstrating NIS2 readiness, especially for organisations without an ISMS. We map your network and systems to the right level and close the gaps.
The UK government-backed scheme covering five core controls: firewalls, secure configuration, user access control, malware protection and security update management. Plus adds independent, hands-on technical verification.
How we help: We support UK clients, including Stellium in Newcastle, through Cyber Essentials and Cyber Essentials Plus certification.
The rules in brief
Most organisations fall under more than one of these. The network engineering that satisfies one usually goes a long way towards the others.
2016
NIS1 adopted
2018
GDPR applies; NIS1 in Irish law
2019
Cybersecurity Act: ENISA made permanent
2023
NIS2, CER and DORA in force
2024
CRA and AI Act in force; CER in Irish law
Jan 2025
DORA applies
Feb 2025
Cyber Solidarity Act in force
Jun 2025
NCSC launches CyFun in Ireland
Sep 2026
CRA reporting obligations apply
Dec 2027
CRA fully applies; AI Act high-risk rules
NIS2
Network and Information Security Directive (EU) 2022/2555
Who
Essential and important entities in energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure (including IXPs, DNS, data centres and electronic communications), ICT service management, public administration and more.
What
Risk-management measures covering incident handling, business continuity, supply-chain security, network security, vulnerability handling and testing; incident notification within tight deadlines; management bodies accountable and trained.
In Ireland
NIS2 replaces NIS1, which Ireland implemented in 2018 (S.I. No. 360 of 2018) and which still applies to operators of essential services. The National Cyber Security Bill that will bring in NIS2 has not yet been enacted. The NCSC will be the lead authority and has already published draft risk-management measures and the CyFun framework.
CER
Critical Entities Resilience Directive (EU) 2022/2557
Who
Entities designated as critical in 11 sectors, including energy, transport, banking, health, water, digital infrastructure, public administration and food.
What
Risk assessments and resilience measures covering physical, natural and human threats as well as cyber, and incident notification to the competent authority.
In Ireland
In force in Ireland through S.I. No. 559 of 2024, with sector regulators such as the CRU, ComReg, the EPA and the Central Bank acting as competent authorities.
DORA
Digital Operational Resilience Act (EU) 2022/2554
Who
Banks, insurers, investment firms, payment and e-money institutions, fund managers and other EU financial entities, and their critical ICT third-party providers.
What
ICT risk management, incident reporting, digital operational resilience testing, and management of ICT third-party risk, including the connectivity your critical functions rely on.
In Ireland
Applies directly across the EU since 17 January 2025 and is supervised in Ireland by the Central Bank.
NIS1
Directive (EU) 2016/1148
The EU’s first cybersecurity law. It required operators of essential services and digital service providers to manage risk and report incidents.
NIS2 builds on it and widens it. In Ireland it still applies until NIS2 legislation commences.
GDPR
Regulation (EU) 2016/679
Requires appropriate technical and organisational security for personal data, and breach notification within 72 hours.
Subscriber records, RADIUS logs, IP assignments and call records are personal data. Network security is data protection.
Cybersecurity Act
Regulation (EU) 2019/881
Made ENISA, the EU Agency for Cybersecurity, permanent, and created the EU cybersecurity certification framework (the first scheme, EUCC, followed in 2024).
A proposed “Cybersecurity Act 2” (January 2026) would add ICT supply-chain security, including restrictions on high-risk suppliers.
Cyber Resilience Act
Regulation (EU) 2024/2847
Security requirements for products with digital elements, including software, for their whole lifecycle.
Vulnerability and incident reporting applies from 11 September 2026, with full application from 11 December 2027. It affects the network equipment and software you buy, and the software you build.
Cyber Solidarity Act
Regulation (EU) 2025/38
In force since February 2025. Sets up a European Cybersecurity Alert System of cyber hubs, an emergency mechanism with an EU Cybersecurity Reserve of trusted incident-response providers, and incident reviews by ENISA.
Preparedness testing under the emergency mechanism prioritises sectors such as energy, finance and health, the same entities NIS2 covers.
EU AI Act
Regulation (EU) 2024/1689
Risk-based rules for AI. Prohibitions and AI-literacy duties have applied since February 2025, and general-purpose AI rules since August 2025.
AI used as a safety component in managing critical digital infrastructure, or energy and water supply, is high-risk. Those obligations apply from December 2027.
UK
NIS Regulations 2018 · Cyber Security and Resilience Bill
The UK kept NIS1 after Brexit and is extending it to managed service providers and data centres through the Cyber Security and Resilience Bill.
Cyber Essentials and Cyber Essentials Plus are the UK baseline, and are required for many public-sector contracts.
This is a summary, not legal advice, and it was last reviewed in October 2026. We are network engineers and work alongside your legal, risk and compliance advisers.
Talk to an engineer
An hour’s conversation is usually enough to tell whether you’re in scope, which framework suits you, where your biggest network risks are likely to be, and what a proportionate response looks like. No obligation.
In Dublin? Let's meet for a coffee.
Otherwise, we’ll do it on a call.