NIS2 Is Now Enforceable: What Irish and UK Businesses Need to Have in Place Today
NIS2 — the EU’s Network and Information Security Directive 2 — is no longer a future obligation. It is enforceable now. Ireland transposed the directive into national law in 2024 and enforcement has been active since early 2025. For UK businesses with EU operations, supply chain relationships with EU entities, or EU-based clients, the compliance obligations are equally real despite Brexit.
Most businesses in scope do not know they are in scope. Most that do know are not compliant. And the enforcement trajectory from European regulators and the National Cyber Security Centre Ireland suggests that position will become increasingly costly to maintain.
This post covers what NIS2 actually requires, which sectors and businesses are in scope, which Microsoft 365 controls directly satisfy the technical measures NIS2 mandates, what Microsoft 365 alone cannot cover, and what documentation needs to be in place before an audit.
What NIS2 Actually Requires
NIS2 is structured around four core obligation areas. Understanding them matters because the controls Microsoft 365 provides map directly to some — and only partially to others.
1. Risk Management Measures
Article 21 of NIS2 requires organisations to implement appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks. This is not a checklist — it is a risk-based obligation. The measures must be proportionate to the risk, take into account the state of the art, and cover specific areas including: policies on risk analysis and information system security; incident handling; business continuity and disaster recovery; supply chain security; security in network and information systems acquisition; human resources security; and the use of cryptography.
2. Incident Reporting
Any significant incident — defined as one that causes or is capable of causing serious operational disruption, financial loss, or reputational damage — must be reported to the relevant national authority. In Ireland this is the NCSC. The timeline is strict: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report within one month of the incident being resolved.
3. Supply Chain Security
NIS2 requires organisations to assess and manage cybersecurity risks in their supply chains — including the security practices of their direct suppliers and service providers. This is one of the most practically challenging requirements, as it extends obligation beyond the internal environment to every third party with access to systems or data.
4. Senior Management Accountability
NIS2 places personal accountability on senior management for cybersecurity governance. Management bodies must approve cybersecurity risk management measures, oversee implementation, and can be held personally liable for infringements. This is a material change from GDPR, where organisational liability was the primary enforcement mechanism.
Which Sectors and Businesses Are in Scope
| Sector | Entity Type | Threshold (Ireland) |
|---|---|---|
| Energy (electricity, gas, oil, hydrogen) | Essential | Medium enterprise and above |
| Transport (air, rail, water, road) | Essential | Medium enterprise and above |
| Banking and financial market infrastructure | Essential | Medium enterprise and above |
| Health (hospitals, labs, pharma, medical devices) | Essential | Medium enterprise and above |
| Drinking water and wastewater | Essential | Medium enterprise and above |
| Digital infrastructure (DNS, TLD, cloud, data centres) | Essential | Any size |
| ICT service management (MSPs, MSSPs) | Essential | Any size |
| Postal and courier services | Important | Medium enterprise and above |
| Waste management | Important | Medium enterprise and above |
| Manufacturing (medical, pharma, chemicals, food) | Important | Medium enterprise and above |
| Digital providers (online marketplaces, search engines, social networks) | Important | Medium enterprise and above |
| Research organisations | Important | Medium enterprise and above |
What Microsoft 365 Controls Satisfy NIS2 Technical Measures
Microsoft 365, when properly configured, directly satisfies a significant portion of the Article 21 technical measures NIS2 requires. The key word is configured — these controls exist in the platform but none of them are active by default.
Multi-Factor Authentication
NIS2 Article 21(2)(j) — Access control and authenticationEntra ID MFA, enforced through Conditional Access policies, satisfies the access control and authentication requirements under Article 21. Conditional Access can also enforce device compliance, location-based restrictions, and session controls — all of which support proportionate risk-based access management.
Microsoft Defender for Business
NIS2 Article 21(2)(b) — Incident handlingDefender’s EDR capability, automated investigation, and incident timeline provide the technical foundation for incident detection and response. Defender alerts map to incident records with a full evidence chain — supporting both the internal incident response requirement and the documentation needed for regulatory notification.
Microsoft Purview Audit Logging
NIS2 Article 21(2)(b)(g) — Incident handling and monitoringPurview’s Unified Audit Log records all user and administrator activity across Exchange, SharePoint, Teams, OneDrive, and Entra ID. This provides the audit trail required to reconstruct what happened during an incident, demonstrate access controls are working, and produce evidence for a regulatory investigation.
Microsoft Purview Data Loss Prevention
NIS2 Article 21(2)(h) — Cryptography and data securityDLP policies in Purview prevent sensitive data from being shared externally without authorisation, classify content by sensitivity, and apply protective controls automatically. Sensitivity labels with encryption satisfy the cryptography and data security measures Article 21 requires for data protection.
Microsoft Defender for Microsoft 365
NIS2 Article 21(2)(b) — Incident handling and preventionSafe Links, Safe Attachments, and anti-phishing policies in Defender for Microsoft 365 address the most common initial attack vector for incidents covered by NIS2 — email-based threats. Documented policy configurations provide evidence that technical prevention measures are in place and maintained.
Microsoft Entra ID Privileged Identity Management
NIS2 Article 21(2)(i) — Human resources securityPIM enforces just-in-time privileged access — administrators only have elevated permissions when they need them, for a defined period, with full audit logging. This satisfies the human resources security and access control requirements and significantly reduces the attack surface for privileged account compromise.
Is your Microsoft 365 environment NIS2-ready?
Mata365 provides a NIS2 readiness assessment — reviewing your current Microsoft 365 configuration against Article 21 requirements and identifying exactly what needs to be activated, configured, and documented.
Explore Compliance ServicesWhat Microsoft 365 Alone Cannot Cover
Microsoft 365 is a powerful foundation for NIS2 technical compliance, but it does not cover everything NIS2 requires. Being clear about the gaps is as important as understanding what it covers.
- Supply chain security assessments — NIS2 requires you to assess and manage the cybersecurity posture of your suppliers and service providers. Microsoft 365 cannot audit your supply chain. This requires a formal third-party risk management process, supplier questionnaires, and contractual security obligations in supplier agreements.
- Business continuity and disaster recovery plans — NIS2 Article 21(2)(c) requires documented and tested BCPs and disaster recovery procedures. Microsoft 365 provides the technical backup and recovery capabilities (Entra ID backup, Exchange retention, SharePoint versioning), but the plans, procedures, testing schedules, and recovery time objectives must be documented separately.
- Incident response procedures — Defender detects and responds to incidents at the technical level, but NIS2 requires a documented incident response plan that covers roles, responsibilities, escalation paths, the 24-hour early warning trigger, and the 72-hour notification process. This is an organisational document, not a technical configuration.
- Network security beyond Microsoft 365 — NIS2 covers all network and information systems, not just cloud productivity tools. On-premise infrastructure, operational technology, network perimeters, and physical security all require separate assessment and controls.
- Security awareness training programme — Article 21(2)(i) requires human resources security measures including regular security awareness training. Microsoft 365 does not include a training platform. Mata365’s security awareness training service addresses this requirement.
What Documentation NIS2 Requires
NIS2 is not satisfied by technical controls alone. The directive requires evidence that those controls are in place, maintained, and governed. An auditor or regulator will ask for documentation — not a demonstration of the technology.
- Cybersecurity risk assessment — a documented assessment of the risks to your network and information systems, updated at least annually and after any significant change or incident.
- Information security policy — a formal policy approved by senior management covering risk management, acceptable use, access control, incident management, and supplier security.
- Incident response plan — documented procedures for detecting, containing, reporting, and recovering from cybersecurity incidents, including the NIS2 notification timelines.
- Business continuity and disaster recovery plan — documented procedures for maintaining operations and recovering systems following a significant incident, with tested recovery time and recovery point objectives.
- Supply chain security register — a register of suppliers and service providers with access to your systems or data, their security posture assessment, and the contractual controls in place.
- Security awareness training records — evidence that staff have completed security awareness training, including dates, completion rates, and the topics covered.
- Audit log retention evidence — documentation that audit logging is active, that logs are retained for the required period, and that the logs have been reviewed as part of ongoing security monitoring.
- Management governance records — minutes or records demonstrating that senior management has reviewed and approved cybersecurity risk management measures — directly addressing the personal accountability provision in NIS2.
Where to Start
The right starting point for any NIS2 compliance programme is a gap assessment — mapping your current technical controls and documentation against the Article 21 requirements and identifying the specific gaps that need to be closed, in priority order.
For most Irish and UK businesses on Microsoft 365, the technology foundation is largely in place. The gaps are in configuration, documentation, and governance — not in the platform itself. A structured NIS2 readiness programme typically takes eight to twelve weeks from initial assessment to a defensible compliance position.
Mata365’s compliance and data protection service covers NIS2 readiness assessments, Microsoft 365 compliance configuration (Purview, Defender, Conditional Access, audit logging), incident response planning, and the documentation framework required to demonstrate compliance to the NCSC or a regulatory body.
Free NIS2 Readiness Assessment
Mata365 maps your current Microsoft 365 configuration against NIS2 Article 21 requirements and gives you a clear, prioritised gap report — no commitment required.
Book Free Assessment Explore Compliance Services
Speak with a support specialist
