LexLint.ioBeta

Know the law your code answers to.

Law / Ireland

European Union (NIS) Regulations 2018, Security Requirements

S.I. No. 360/2018, Regs. 17 and 21

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security

What it requires

  • This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2) and a designated operator of essential services in the energy, transport, health, drinking water supply and distribution, or digital infrastructure sectors under Schedule 1 (Regulation 17 does not apply in the banking and financial market infrastructure sectors); the operator-of-essential-services class is reached by declaring that you operate an essential service.
  • Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.NIST CSF 2.0ID.RA-06
  • As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.NIST CSF 2.0GV.PO-01

These lines are LexLint's reading of the law's text. Also read by: National Cyber Security Centre (NCSC), the National Competent Authority under the NIS Regulations, NIS Compliance Guidelines for Operators of Essential Services, August 2022 (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Regulations 17 and 21 create no offence of their own; a person who fails to comply with a compliance notice or an information notice issued to enforce them, under Regulation 30 or 31, or who obstructs an authorised officer under Regulation 29, commits an offence under Regulation 34.

Penalty structure

Regulation 34 makes a person guilty of an offence under Regulation 18, 22, 29, 30, 31 or 33 (not Regulation 17 or 21 directly) liable, on summary conviction, to a class A fine, or, on conviction on indictment, to a fine not exceeding EUR 50,000 for an individual or EUR 500,000 for a person other than an individual.

Rule
Fixed only
As of
Currency
EUR
Fixed cap
500,000

Who enforces it

Enforcement body

The Minister as competent authority under Regulations 7(1) and 8, acting through an authorised officer appointed under Regulation 28.

Settledness

As of
Guidance link
https://assets.gov.ie/231215/07d2f403-37e9-4916-8519-2f0b609e14d1.pdf
Guidance body
National Cyber Security Centre (NCSC), the National Competent Authority under the NIS Regulations, NIS Compliance Guidelines for Operators of Essential Services, August 2022
Open questions
What level of security of network and information systems is appropriate to the risks posed under Regulation 17(2), having regard to the state of the art, for a designated operator of essential services, given that the NCSC guidelines are stated to be technology neutral and not sector specific?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Regulation 17 requires a designated operator of essential services (an undertaking the Minister or the Central Bank of Ireland designates in a sector listed in Schedule 1 other than banking and financial market infrastructure, which Regulation 3(2) excludes) to take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems it uses and to prevent or minimise the impact of an incident on the continuity of its service.

Regulation 21 imposes the equivalent duty on a relevant digital service provider, an online marketplace, online search engine or cloud computing service under Schedule 2, and additionally requires it to take into account the security of its systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.

These Regulations transpose the original NIS Directive (Directive (EU) 2016/1148) and, according to the National Cyber Security Centre, remain in full effect pending the National Cyber Security Bill's transposition of its successor, NIS2, and cover the most critical operators in the State in the meantime.

When LexLint raises it

When your app profile says your app operates a social platform, handles health records or runs an essential service.

Back to the example  ·  Lint your app

Page updated .