IrelandEuropean Union (NIS) Regulations 2018, Incident Notification
S.I. No. 360/2018, Regs. 18 and 22
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2) and a designated operator of essential services under Schedule 1; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.
- Notify the State's computer security incident response team (CSIRT) without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on.NIST CSF 2.0RS.CO-02
- Notify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)).NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text. Also read by: National Cyber Security Centre (NCSC), the National Competent Authority under the NIS Regulations, NIS Compliance Guidelines for Operators of Essential Services, August 2022 (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A failure to notify the CSIRT under Regulation 18 or 22 is itself an offence under Regulation 34, unlike a failure to take the Regulation 17 or 21 security measures, which is enforced only through a compliance notice.
Penalty structure
Regulation 34 makes a person guilty of an offence under Regulation 18 or 22 (among others) liable, on summary conviction, to a class A fine, or, on conviction on indictment, to a fine not exceeding EUR 50,000 for an individual or EUR 500,000 for a person other than an individual.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Minister (or, for the banking and financial-market-infrastructure sectors, the Central Bank of Ireland) as competent authority, with the National Cyber Security Centre's CSIRT unit receiving and handling the notification.
Settledness
- As of
- Guidance link
- https://assets.gov.ie/231215/07d2f403-37e9-4916-8519-2f0b609e14d1.pdf
- Guidance body
- National Cyber Security Centre (NCSC), the National Competent Authority under the NIS Regulations, NIS Compliance Guidelines for Operators of Essential Services, August 2022
- Open questions
- At what number of users affected, duration and geographical spread does an incident have a significant impact on the continuity of an essential service under Regulation 18(4), given that the NCSC reporting levels are indicative only?
What this law does
Regulation 18 requires a designated operator of essential services to notify the State's computer security incident response team (CSIRT), without delay and in any event not later than 72 hours after becoming aware, of an incident with a significant impact on the continuity of an essential service it provides, including an incident affecting a third-party digital service provider it relies on, and to notify the CSIRT again once the incident is resolved.
Regulation 22 imposes the equivalent duty on a relevant digital service provider for an incident with a substantial impact on a service listed in Schedule 2. The CSIRT is the unit of the Department of Communications, Climate Action and Environment known as the computer security incident response team, which Regulation 10 designates.
Regulation 6 requires the competent authority and the single point of contact to cooperate with the Data Protection Commission where a notified incident also compromises personal data, a duty distinct from the breach-notification duty General Data Protection Regulation (GDPR) itself imposes on a controller.
When LexLint raises it
When your app profile says your app operates a social platform, runs an essential service or handles health records.
Back to the example · Lint your app
Page updated .