IrelandNational Cyber Security Bill, Incident Response Powers and Reporting Obligations
Head 15, General Scheme, National Cyber Security Bill 2024
In committee, dated , as of .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
Where it has got to
The text described here is General Scheme (Heads of Bill) of the National Cyber Security Bill 2024, published .
Locally, this stage is pre-legislative scrutiny of the General Scheme, before formal introduction as a Bill.
The stage above is recorded at www.oireachtas.ie.
An earlier round of pre-legislative scrutiny by the Joint Committee on Transport and Communications on produced no published report before the 33rd Dail was dissolved; the Joint Committee on Justice, Home Affairs and Migration received a fresh briefing on to resume that scrutiny of the same General Scheme.
The Government's Autumn 2026 Legislation Programme, with its status as of , lists the Bill for priority publication with work ongoing, and no National Cyber Security Bill appears in the Oireachtas legislation listing as of . On the European Commission referred Ireland to the Court of Justice of the European Union for failing to notify complete transposition of the Directive.
What it requires
- As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached as on this jurisdiction's companion risk-management row.
- Notify the computer security incident response team (CSIRT) without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15).NIST CSF 2.0RS.CO-02
- Where the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15).NIST CSF 2.0RS.CO-03
- If you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15).NIST CSF 2.0RS.CO-02
- Where appropriate, notify the recipients of your service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: National Cyber Security Centre (NCSC), Department of Justice, Home Affairs and Migration (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under Head 36A(14) an essential entity, and under Head 37A(14) an important entity, that without reasonable excuse fails to comply with a compliance notice served to enforce Head 15 commits an offence, and Head 43 extends an offence by a body corporate to a director, manager or other officer who consented, connived or was wilfully negligent. The General Scheme's own financial penalty for the infringement of Head 15 is administrative, imposed by an adjudicator under Heads 44 to 44AW, and Head 41 exempts a public body designated under Head 23 from Head 37B.
Penalty structure
The same penalty provision that governs a Head 29 infringement governs a Head 15 infringement: the greater of EUR 10,000,000 or at least 2 percent of worldwide turnover for an essential entity, and the greater of EUR 7,000,000 or at least 1.4 percent for an important entity, mirroring NIS2 Article 34(4) and (5).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The National Competent Authority the General Scheme would designate per sector under Head 17, with the National Cyber Security Centre's CSIRT receiving and handling the notification.
Settledness
- As of
- Guidance link
- https://www.ncsc.gov.ie/nis2/
- Guidance body
- National Cyber Security Centre (NCSC), Department of Justice, Home Affairs and Migration
- Open questions
- Will the enacted Act's coordinated vulnerability disclosure function under Head 16 impose any duty directly on the manufacturer of the affected product, or does it remain a duty on the NCSC alone to coordinate a disclosure it receives?
What this law does
Head 15 of the General Scheme would require an essential or important entity to notify the computer security incident response team (CSIRT), without undue delay, of any incident with a significant impact on the provision of its service, submitting an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours, and a final report within one month, on the same clock NIS2 Article 23 sets.
Where appropriate, the entity must also notify the recipients of its service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
Head 16 would separately give the NCSC a coordinated vulnerability disclosure function for a vulnerability reported about an ICT product or ICT service, a duty the General Scheme places on the NCSC rather than on the product's manufacturer. The General Scheme has undergone pre-legislative scrutiny. As of October 2026 the Government's Autumn 2026 Legislation Programme lists the Bill with work ongoing.
Head 25 would disapply the relevant provisions of the Act, including supervision and enforcement under Part 8, to an entity that a sector-specific Union legal act requires to notify significant incidents with at least equivalent effect, judged against Head 15(1) to (6).
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app operates a social platform, handles health records or runs an essential service.
Back to the example · Lint your app
Page updated .