The regulation is in force. The question is whether you can prove it.

NIS2 is the EU Network and Information Security Directive. It sets cybersecurity risk management and incident reporting obligations for essential and important entities across a wide range of sectors, from energy and health to digital infrastructure and manufacturing. In Ireland, NIS2 is being transposed through the National Cyber Security Bill, with the National Cyber Security Centre acting as the lead competent authority. NIS2 raises the baseline for security governance and makes management bodies accountable for oversight of cyber risk.

NIS2 applies to organisations that operate in one of its in-scope sectors and meet the size criteria for an essential or important entity. In-scope sectors include energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, and digital providers. Many organisations are in scope without realising it, often because a customer or parent entity is regulated. Edge7 Networks begins every engagement with a scoping assessment to confirm whether you are in scope and as which type of entity.

NIS2 divides in-scope organisations into essential entities and important entities based on sector and size. Both must meet the same core risk management and incident reporting obligations. The difference lies mainly in supervision and penalties. Essential entities are subject to proactive supervision and face maximum administrative fines of 10 million euro or 2 percent of global annual turnover, whichever is higher. Important entities are supervised on a reactive basis and face maximum fines of 7 million euro or 1.4 percent of global annual turnover.

DORA is the EU Digital Operational Resilience Act. It has applied across the EU since 17 January 2025 and sets uniform requirements for the digital operational resilience of the financial sector. DORA applies to around 20 types of financial entity, including banks, insurers, investment firms, payment institutions, and crypto-asset service providers, as well as the critical ICT third-party providers that serve them. It is built on five areas: ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing.

They can. Financial entities may fall under both frameworks, but DORA is treated as the more specific rulebook for the financial sector, so its ICT resilience requirements take precedence where the two meet. In practice the underlying controls, such as risk management, incident response, supplier oversight, and testing, are largely common. Edge7 Networks maps both regulations to a single control set so you build one governed programme rather than two parallel compliance exercises.

Under NIS2, essential entities face maximum administrative fines of 10 million euro or 2 percent of global annual turnover, and important entities face up to 7 million euro or 1.4 percent, whichever is higher. NIS2 also makes management bodies accountable for approving and overseeing cybersecurity risk measures. DORA is enforced by financial regulators and carries its own supervisory and enforcement powers. For most organisations the more practical exposure is the operational and reputational cost of an incident they were not prepared for.