Runs an essential service, in Ireland

S.I. No. 360/2018, Regs. 17 and 21 · Read the law's page

• Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.
• As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services in the energy, transport, health, drinking water supply and distribution, or digital infrastructure sectors under Schedule 1 (Regulation 17 does not apply in the banking and financial market infrastructure sectors); the operator-of-essential-services class is reached by declaring that you operate an essential service.

S.I. No. 360/2018, Regs. 18 and 22 · Read the law's page

• Notify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on.
• Notify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)).
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services under Schedule 1; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.

Head 15, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Notify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15).
• Where the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15).
• If you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15).
• Where appropriate, notify the recipients of your service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached as on this jurisdiction's companion risk-management row.

Head 29, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached too, by declaring that you are an essential or important entity.