The NIS2 Directive explained: what SaaS and eCommerce businesses actually need to do

The point: NIS2 is about the services you run, and Ireland's own law is still on its way

The NIS2 Directive is Directive (EU) 2022/2555, the European Union's law on cyber security for organisations that run important services.¹ Member states had to turn it into national law by 17 October 2024 and apply that law from 18 October 2024, the same day the original NIS Directive was repealed.¹²

For a SaaS company or an online shop, the short version is this. If you provide a type of service listed in the directive's annexes, you are at least medium sized, and you provide that service in the EU, NIS2 applies to you. It asks for 10 kinds of security measure, a three step incident report that starts within 24 hours, and a board that signs off and is trained.¹ Many SaaS products count as cloud computing services. Most ordinary online shops do not count at all.

Ireland is bound by NIS2, but it missed the deadline, and as I check this on 8 November 2026 the National Cyber Security Bill that will bring it into Irish law has not yet been published.³⁴ So an Irish business needs two things at once: the directive, which tells you what is coming, and an eye on the Bill, which will decide the Irish details. I come to both below. The businesses in the examples are made up. The law and the dates are footnoted.

How NIS2 differs from the Cyber Resilience Act

In my post on the Cyber Resilience Act I said that pure SaaS products do not fall under the CRA, and that a different law covers them instead. That law is NIS2.

The Cyber Resilience Act is Regulation (EU) 2024/2847, and it covers products with digital elements: hardware, downloadable software, apps.⁵ It is about making the product secure before it reaches the market. Among other things it asks manufacturers to draw up a software bill of materials, a machine readable list of the components inside the product.⁵

NIS2 covers the organisations that run services. It is about how you manage cyber risk while the service is live: your measures, your reporting, your board. The CRA says so itself in recital 12: NIS2 applies to cloud computing services and cloud service models such as Software as a Service (SaaS), Platform as a Service and Infrastructure as a Service.⁵

Then there is the General Data Protection Regulation (GDPR), which covers personal data, whichever of the other two applies.⁶ You can easily need all three. Welcome to EU compliance.

An example: a Limerick company sells a desktop app for planning warehouse shifts and also runs the web dashboard the app syncs to. The downloadable app is a product with digital elements, so the CRA looks at it. The hosted dashboard is a service, so NIS2 may look at it, if the company passes the size test below. Both hold staff names, so the GDPR looks at both. Three laws, one product line, each asking a different question.

Who is in scope: the service type comes first

NIS2 does not start with the size of your business. It starts with what you do. Article 2(1) applies the directive to entities "of a type referred to in Annex I or II".¹ Annex I lists 11 sectors of high criticality and Annex II lists seven other critical sectors, 18 in all.¹

Annex I includes energy, transport, banking, health, water, public administration, space and two that matter for software businesses: digital infrastructure (cloud computing service providers, data centres, content delivery networks, DNS providers, trust service providers and others) and ICT service management, business to business (managed service providers and managed security service providers).¹

Annex II includes postal and courier services, waste, chemicals, food, manufacturing, research and digital providers: online marketplaces, online search engines and social networking platforms.¹

Three definitions decide most cases for my readers.

A cloud computing service, in Article 6(30), is a digital service that gives on demand administration and broad remote access to a scalable and elastic pool of shareable computing resources.¹ Recital 33 lists SaaS among the service models it covers.¹ So a SaaS product your customers sign up to and use over the web will very often be a cloud computing service.

A managed service provider installs, manages, operates or maintains ICT products, networks, infrastructure or applications for customers, on site or remotely (Article 6(39)).¹ If you run and maintain other businesses' systems for them, this is you.

An online marketplace takes its meaning from consumer law: a service "which allows consumers to conclude distance contracts with other traders or consumers".⁷ The key words are "other traders". A shop that sells its own goods is not a marketplace. A platform where independent sellers sell to consumers is.

Worked example: three businesses, three answers

The first is a Galway company that sells booking software to dental practices, signed up and used in the browser, with practices in Ireland and the Netherlands among its customers. Its product fits the cloud computing definition, which is Annex I. Type test passed.

The second is a Kilkenny shop that sells its own gift hampers online and ships to Germany. It is not a marketplace, because every contract is with the shop itself. Food appears in Annex II, but only for food businesses "engaged in wholesale distribution and industrial production and processing".¹ A retail hamper shop is neither. Type test failed, so NIS2 does not reach it on its own lists.

The third is a Waterford platform where 400 independent makers sell ceramics to consumers across Europe. Consumers conclude contracts with other traders through it, so it is an online marketplace, which is Annex II. Type test passed.

Who is in scope: then the size test

The second filter is size. Article 2(1) covers entities that qualify as medium sized enterprises, or exceed those ceilings, under Commission Recommendation 2003/361/EC.¹ In that recommendation, a small enterprise employs fewer than 50 persons and has an annual turnover and/or balance sheet total of no more than €10 million.⁸ Medium sized means fewer than 250 persons and a turnover up to €50 million and/or a balance sheet total up to €43 million.⁸

Two details catch people out, in both directions.

A common shorthand says a company is medium sized at 50 employees "or" €10 million turnover. That is too simple. Because of the "and/or", a business with fewer than 50 staff stays small as long as either its turnover or its balance sheet stays at or under €10 million.⁸ A 30 person SaaS company with €12 million revenue and a modest balance sheet is still small, and outside NIS2's size cap.

In the other direction, the figures are not yours alone. The recommendation adds the data of linked enterprises and, proportionally, of partner enterprises.⁸ A small subsidiary of a large group is not small. Headcount is measured in annual work units, so full time equivalents, and a business only changes category once it crosses a ceiling in two consecutive accounting periods.⁸

Some entities are in scope whatever their size: providers of public electronic communications networks, trust service providers, top level domain registries and DNS service providers, among others, and any entity a member state names as the sole provider of an essential service or as critical (Article 2(2)).¹

The whole scope test, type then size then category, fits in one chain of questions.

Read it from the top. Each diamond is a question about your business, and the label on the arrow into the next box is the answer that leads there. The grey notes are the exits: a business that leaves at either of the first two questions is outside NIS2 on the directive's own terms. The takeaway is the order. Type first, size second, category third. Most confusion comes from starting with size.

Worked example: the Galway booking software, year by year

The thresholds are in euro, and so are the company's accounts, so there is nothing to convert.

Year one: 38 staff in full time equivalents, turnover €10.35 million, balance sheet €5.75 million. Fewer than 50 staff, and the balance sheet is under €10 million, so the company is small, even though its turnover is over €10 million. Outside NIS2.

Year two: 54 staff. That is over the headcount ceiling for a small enterprise, but it is the first year, so the status does not change yet.

Year three: 58 staff. The ceiling is now exceeded for two consecutive accounting periods, so the company becomes medium sized. It provides a cloud computing service in the EU. NIS2 applies.

Essential or important: what the category changes

Once you are in, you are either an essential entity or an important entity. Article 3 sets it out. Annex I entities that exceed the medium sized ceilings, so large enterprises, are essential. Everyone else in scope is important, which means medium sized Annex I entities and all Annex II entities that pass the size test, unless a member state names them as essential.¹

The obligations are the same for both: the Article 21 measures and the Article 23 reporting. What differs is supervision and the size of the fines.

Essential entities are supervised up front. The authority can run on site inspections, random checks, regular audits and security scans whether or not anything has gone wrong (Article 32).¹ Important entities are supervised after the fact: the authority acts when it has evidence or an indication that the entity does not comply (Article 33).¹

One point is often overstated: that management can be suspended or banned for any non compliance. The power to ask for a temporary ban on a chief executive or legal representative exists only for essential entities, and only after earlier enforcement measures have failed and a deadline has passed (Article 32(5)).¹ For both categories, though, the people who manage the entity must be able to be held liable for breaching their duties (Articles 32(6) and 33(5)).¹

An example: the Waterford marketplace has 60 staff. It is medium sized and in Annex II, so it is an important entity. If it grew past 250 staff it would still be important, because Annex II entities are never essential by size alone. The Galway booking software, once it passes 250 staff or the large ceilings, would become essential, because cloud computing sits in Annex I.

The fines: a floor under the maximum

Article 34 sets the fines for breaching the measures in Article 21 or the reporting duties in Article 23. Essential entities face a maximum of at least €10 million or at least 2% of total worldwide annual turnover, whichever is higher. Important entities face a maximum of at least €7 million or at least 1.4%, whichever is higher.¹ "At least" matters: these are the lowest caps a member state may set, and a national law may set higher ones. The Irish figures will be in the Irish Act.

The cap for a given business is:

$$F_{\max} = \max\left(A,\; r \times T\right)$$

$F_{\max}$ is the lowest maximum fine the directive allows a member state to set. $A$ is the fixed amount, €10 million for an essential entity and €7 million for an important one. $r$ is the turnover rate, $0.02$ for essential and $0.014$ for important. $T$ is the total worldwide annual turnover, in the preceding financial year, of the undertaking the entity belongs to, so the whole group. $\max$ takes whichever of the two is larger. If percentages feel rusty, Foundations: percentages covers them from scratch.

Worked example: two caps

The Waterford marketplace is important, with a group turnover of €40.25 million. The turnover part is $0.014 \times 40{,}250{,}000 = 563{,}500$, so €563,500. That is smaller than €7 million, so the cap is at least €7 million.

Now a large cloud provider, essential, with group turnover of €900 million. The turnover part is $0.02 \times 900{,}000{,}000 = 18{,}000{,}000$, so €18 million. That is larger than €10 million, so the cap is at least €18 million.

The pattern: for most medium sized businesses the fixed amount is the one that bites. In both categories the percentage only takes over above €500 million turnover, since $10{,}000{,}000 / 0.02$ and $7{,}000{,}000 / 0.014$ are both $500{,}000{,}000$.

One more rule: if the same conduct is also a personal data breach and the GDPR authority fines you for it, the NIS2 authority may not fine you again for that conduct, although it can still use its other enforcement measures (Article 35).¹

What NIS2 asks you to do: the 10 measures

Article 21(1) asks for "appropriate and proportionate technical, operational and organisational measures" to manage the risks to the systems you use for your services. Proportionate is a real word here: the directive asks the authority to take account of your exposure to risk, your size, and the likelihood and severity of incidents.¹

Article 21(2) then lists what the measures must include at least:¹

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security, including the security of your relationships with your direct suppliers and service providers.
5. Security in buying, developing and maintaining systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess whether your measures work.
7. Basic cyber hygiene and cyber security training.
8. Policies on cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi factor authentication or continuous authentication, and secured voice, video, text and emergency communications, where appropriate.

It is a proper list. It is also, for the most part, what a well run software business should be doing anyway.

For cloud computing services, online marketplaces, managed service providers and the other digital types, the Commission has gone further. Implementing Regulation (EU) 2024/2690 sets out the technical and methodological requirements for these measures, and when an incident counts as significant.⁹ If you are one of those types, that regulation is your detailed checklist, not just Article 21. The National Cyber Security Centre (NCSC) has also published draft guidance on the risk management measures, dated 4 June 2025, which shows how it reads them for Irish entities.¹⁰

Article 20 adds the governance layer. Management must approve the measures, oversee them, and can be held liable for breaches of Article 21. Members of management must follow training.¹

Worked example: the Galway company's first gap analysis

The booking software company, now medium sized, takes the 10 items and marks each as done, partial or missing.

It has encrypted backups, but nobody has restored one in a year: business continuity is partial. Developers use multi factor authentication on the cloud console, but the support team's admin panel only has passwords: item 10 is partial. It has never assessed its payment provider or its email delivery service: supply chain is missing. There is no written incident procedure at all: incident handling is missing.

The order of work follows the risk and the reporting clock in the next section. Incident handling first, because without it the 24 hour deadline cannot be met. Then multi factor authentication on the admin panel, because that is a door straight into patient bookings. Then the supplier review and a restore test.

Reporting: 24 hours, 72 hours, one month

Article 23 is where NIS2 gets a stopwatch. A significant incident is one that has caused or can cause severe operational disruption or financial loss to you, or considerable material or non material damage to others.¹ For the digital provider types, the implementing regulation makes that concrete: for example, an incident with a direct financial loss above €500,000 or 5% of annual turnover, whichever is lower, or a suspected malicious compromise of the data behind a cloud service or an online marketplace.⁹ For cloud computing, a service completely unavailable for more than 30 minutes is significant.⁹

When a significant incident happens, you report to your national Computer Security Incident Response Team (CSIRT) or competent authority in steps:¹

1. An early warning without undue delay and within 24 hours of becoming aware, saying whether you suspect an unlawful or malicious act and whether there could be a cross border impact.
2. An incident notification within 72 hours of becoming aware, with an initial assessment of severity and impact, and indicators of compromise where available.
3. An intermediate report if the authority asks for one.
4. A final report no later than one month after the incident notification, with a detailed description, the likely root cause, the mitigation and any cross border impact.

Where appropriate, you must also tell the recipients of your service, without undue delay, about significant incidents likely to affect them.¹

Worked example: the Waterford marketplace's long weekend

At 9pm on a Friday, the on call engineer at the Waterford marketplace sees that seller payout details have been changed on 30 accounts by someone using a stolen admin session. That is a suspected malicious compromise of marketplace data, so it is significant.⁹

The early warning is due by 9pm on Saturday. The incident notification is due by 9pm on Monday. If the notification goes in at 4pm on Monday, the final report is due one month later. Payout details are personal data of the sellers who trade as individuals, so the data protection clock starts at the same moment. Under the GDPR the breach goes to the data protection authority, for an Irish business the Data Protection Commission (DPC), within 72 hours where feasible, unless it is unlikely to result in a risk to people.⁶¹¹

That is two reports, to two authorities, on overlapping clocks, starting at 9pm on a Friday. This is why the 24 hour deadline is brutal without a written procedure, and why incident handling came first in the Galway gap analysis.

Where you are established decides who supervises you

NIS2 reaches entities that "provide their services or carry out their activities within the Union" (Article 2(1)), and the jurisdiction rules decide which member state supervises them.¹

For most entities, jurisdiction follows establishment: you are supervised by the member state where you are established.¹ For a named group of digital types, cloud computing providers, data centres, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, social networks and DNS providers among them, jurisdiction follows your main establishment in the Union.¹

So an Irish SaaS company or marketplace with its main establishment in Ireland answers to Ireland, even when most of its customers are in the Netherlands or Germany. There is no representative to appoint.

The representative rule is for businesses from outside the EU. If one of those digital types is not established in the Union at all but offers services there, Article 26(3) says it must designate a representative in the Union, established in one of the member states where it offers its services. It then falls under the jurisdiction of that member state. Without a representative, any member state where it provides services may take legal action against it.¹ The text does not settle neatly a non EU entity of another type with no EU establishment: Article 2(1) covers it in principle, but the jurisdiction rules assume an establishment.

An example: an invented booking software company based in Toronto, with no office in the EU, sells to the same kind of dental practices in Ireland and the Netherlands. It is a cloud computing provider, medium sized, offering its service in the Union. Under Article 26(3) it designates a representative, say in Ireland, and Ireland's rules then apply to it. The Galway company never faces that question, because it is already established here.

The Irish law is still a bill, and not yet published

Ireland did not meet the October 2024 deadline, and the NCSC says so plainly on its NIS2 page. That page, last updated on 24 June 2025, says the Heads of the General Scheme of the transposing law were published in September 2024, and that the NIS2 registration and incident reporting portals are not available yet and will open once the legislation is in place.³

The pressure has grown since. In July 2026 the Commission referred Ireland to the Court of Justice of the EU for failing to transpose NIS2, and the Court can impose financial sanctions until the Commission is told transposition is complete.¹² In October 2026 the Government's new national cyber security strategy said the National Cyber Security Bill was being drafted with the Office of Parliamentary Counsel and the Attorney General's office, and the Bill was included for priority publication in the autumn legislative programme.⁴ Under the proposed Bill, the national competent authorities get new and expanded supervision and enforcement powers.⁴

As I check this on 8 November 2026, the Bill has not been published. The Irish registration rules, the Irish authorities for each sector and the Irish fines will come from the Act, so the details may still differ from the directive's floor. The incident reporting side already has a home: the NCSC includes the State's national CSIRT.¹³

An example: the Galway company, with 58 staff, provides a cloud computing service from Ireland. On the directive's terms it is an important entity. Today there is no Irish portal to register on and no Irish Act that sets its fines. What it can do now is the work that will be asked of it anyway: the 10 measures, the 24 hour procedure and a trained board. When the Act passes, registration is a form, not a project.

Transposition: check the country, not just the directive

NIS2 is a directive, not a regulation. Each member state writes its own law, and may set stricter rules than the directive (Article 5).¹ Registration, the authority you report to and the exact fines all come from national law.

The transposition has been uneven. On 7 May 2025 the Commission sent reasoned opinions to 19 member states for failing to notify full transposition, among them Germany, Austria, Ireland, France, Spain and the Netherlands.¹⁴ Ireland has since moved to the next stage, the Court referral described above.¹² That list is a snapshot, so check the Commission's transposition page for the country you serve before you rely on it.

An example of why: Germany has since acted. Its NIS2 implementation law was published in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I Nr. 301).¹⁵ Germany's Federal Office for Information Security (BSI) now says the statutory registration period has already expired.¹⁶ If you serve German customers from a German establishment and have not registered, that is the first job.

The directive itself is moving too. On 20 January 2026 the Commission proposed targeted amendments to NIS2, which it says will ease compliance for 28,700 companies, including 6,200 micro and small enterprises.² That is a proposal, not law. Plan for the directive as it stands.

Supply chain: why NIS2 reaches businesses outside it

Article 21(2)(d) makes supply chain security a measure in its own right, and Article 21(3) says entities must take into account each direct supplier's vulnerabilities and the quality of its products and security practices, including its secure development procedures.¹

That is why NIS2 reaches further than its own scope. A Cork software agency with 20 staff is far below the size cap. But if its client is an important entity, that client has to assess it, and will write the assessment into the contract: multi factor authentication, patching times, a named contact for incidents, the right to ask for evidence.

The same applies to your own stack: hosting, payments, email delivery, open source libraries and any outsourced development. On a large cloud platform, write down which controls are theirs and which are yours. I wrote more about vetting suppliers before they undermine your compliance in the GDPR context, and the method carries over.

An example: the Galway booking software sends appointment reminders through an external email service. Its supplier review records where that provider hosts data, whether it offers multi factor authentication, how it reports incidents and how quickly. It finds the provider promises breach notification "promptly", with no hours stated. Given its own 24 hour clock, the Galway company asks for a number in the contract.

What it looks like in a Rails or Solidus build

NIS2 compliance is not a tool you buy. It is practice you can show, and in a Ruby on Rails SaaS or a Solidus shop it is fairly ordinary engineering.

Risk assessment starts with the assets (the production database, authentication, the admin area, the API, customer data), what could go wrong with each, and the control for it. Access control means multi factor authentication on the admin panel, production servers, the deployment pipeline and the cloud console, and in a Solidus store an admin backend with properly segmented roles.

Encryption means TLS on every connection and encrypted backups. Rails has Active Record Encryption for encrypting sensitive attributes at the application level.¹⁷ Rails also has a built in rate_limit for controllers, which helps against password guessing on login and password reset.¹⁸

Monitoring is what makes the 24 hour clock possible at all: centralised logs, alerts on unusual admin activity, and someone who receives them out of hours. Business continuity means testing the restore, not just taking the backup, and writing down how long it takes and how much data you could lose.

Training covers developers (secure coding, the OWASP Top 10, the incident procedure) and management, who under Article 20 must understand enough to approve and oversee the measures.¹

Worked example: a staging drill

The Waterford marketplace runs a drill on staging. At 10am a developer revokes every admin session, then restores the payout table from the night's encrypted backup. The restore takes 47 minutes. The backup is from 2am, so in a real incident up to eight hours of payout changes would have to be rebuilt from the payment provider's records. Both numbers go into the continuity plan, with the date of the drill. Next quarter the team runs it again and tries to beat them.

How I build for this

This is where my work comes together. I build SaaS platforms on Ruby on Rails and shops on Solidus, and I build them to be secure and resilient from the start: encrypted data handling, multi factor authentication, role based access, logging that someone actually reads, and documented incident procedures.

Every system I deliver gets a penetration testing pass with the Kali Linux toolkit before it faces the internet, using tools such as Nmap, Burp Suite, Metasploit and OWASP ZAP, and the findings are documented with severity and a fix. That record feeds straight into the evidence an NIS2 authority asks for.

I also help work out whether NIS2 applies in the first place, from the annex definitions and the size test to where you would register, with a lawyer in the member state for the national questions. And on the growth side, I build marketing that does not open new holes: first party analytics, secure forms and privacy respecting personalisation rather than a pile of third party scripts.

What to do now

Work through these in order.

1. Check the type. Is the service you provide in the EU one of the types in Annex I or II? For SaaS, read the cloud computing definition. For a shop, ask whether other traders sell through you.
2. Check the size. Headcount in full time equivalents, turnover and balance sheet, with linked and partner companies added, over two accounting periods.
3. Find your country. Where is your main establishment? For most readers of this edition that is Ireland, and the Irish Act will set the rules. If you are outside the EU, where will your representative be?
4. Watch the Irish side. Follow the National Cyber Security Bill and the NCSC's NIS2 page, and register as soon as the portal opens.
5. Run the gap analysis against the 10 measures, and against Implementing Regulation 2024/2690 if you are a digital provider type.
6. Build the incident procedure first. If you cannot send an early warning within 24 hours today, that is the priority.
7. Brief and train management. Under Article 20 they approve and oversee the measures, and they can be held liable.
8. Document everything. Risk assessments, measures, training records, drills and supplier reviews. An authority asks for evidence, not intentions.

NIS2 is not going away, and Ireland's own law is on its way. The businesses that treat it as a reason to build properly, rather than as paperwork, end up with fewer incidents, quicker recoveries and customers who trust them with more.

Footnotes

1. European Parliament and Council, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Articles 2, 3, 5, 6, 20, 21, 23, 26, 32 to 35, 41, 44, recitals 28 and 33 and Annexes I and II, Official Journal L 333, 27 December 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555

2. European Commission, NIS2 Directive: securing network and information systems, Shaping Europe's digital future, last updated 2 July 2026, https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

3. National Cyber Security Centre, NIS2, ncsc.gov.ie, last updated 24 June 2025, accessed 8 November 2026, https://www.ncsc.gov.ie/nis2/

4. Law Society Gazette, Government pledge on delayed cyber bill, Law Society of Ireland, 7 October 2026, https://www.lawsociety.ie/gazette/top-stories/2026/october/government-pledge-on-delayed-cyber-bill/

5. European Parliament and Council, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), recital 12 and Annex I Part II, Official Journal, 2024, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847

6. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 33, EUR-Lex, https://eur-lex.europa.eu/eli/reg/2016/679/oj

7. European Parliament and Council, Directive 2005/29/EC on unfair commercial practices, consolidated version of 28 May 2022, Article 2(n), EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02005L0029-20220528

8. European Commission, Recommendation 2003/361/EC concerning the definition of micro, small and medium sized enterprises, Annex Articles 2, 4, 5 and 6, Official Journal L 124, 2003, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32003H0361

9. European Commission, Implementing Regulation (EU) 2024/2690 of 17 October 2024 on the technical and methodological requirements of cybersecurity measures and significant incidents for digital providers under Directive (EU) 2022/2555, Articles 3, 7 and 11, Official Journal, 18 October 2024, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2690

10. National Cyber Security Centre, NIS 2 Risk Management Measures Guidance, draft, 4 June 2025, https://www.ncsc.gov.ie/pdfs/NIS2_Draft_Risk_Management_Measures_Guidance.pdf

11. Data Protection Commission, Breach notification, dataprotection.ie, accessed 8 November 2026, https://www.dataprotection.ie/en/organisations/know-your-obligations/breach-notification

12. Law Society Gazette, Ireland referred to CJEU over cyber bill, Law Society of Ireland, 8 July 2026, https://www.lawsociety.ie/gazette/top-stories/2026/july/ireland-referred-to-cjeu-over-cyber-bill/

13. National Cyber Security Centre, About the NCSC, ncsc.gov.ie, accessed 8 November 2026, https://www.ncsc.gov.ie/about/

14. European Commission, NIS2 transposition in EU countries, Shaping Europe's digital future, last updated 1 July 2025, https://digital-strategy.ec.europa.eu/en/policies/nis-transposition

15. Federal Republic of Germany, Gesetz zur Umsetzung der NIS 2 Richtlinie, Bundesgesetzblatt 2025 I Nr. 301, 5 December 2025, https://www.recht.bund.de/bgbl/1/2025/301/VO.html

16. Bundesamt für Sicherheit in der Informationstechnik, NIS 2 regulierte Unternehmen, bsi.bund.de, accessed 8 November 2026, https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html

17. Ruby on Rails Guides, Active Record Encryption, guides.rubyonrails.org, https://guides.rubyonrails.org/active_record_encryption.html

18. Ruby on Rails API, ActionController::RateLimiting::ClassMethods, rate_limit, api.rubyonrails.org, https://api.rubyonrails.org/classes/ActionController/RateLimiting/ClassMethods.html