Practical analysis on DORA, NIS2, EU AI Act, and SAP security for Irish and EU mid-market organisations. Written by practitioners for decision-makers — no jargon, no padding.
DORA has been in full force since January 2025. If your company supplies software, data, IT, or managed services to a bank, insurer, investment firm, or payment institution operating in the EU — you are in scope. Here is the practical checklist that every Irish ICT supplier needs to work through.
DORA defines ICT third-party service providers broadly. If you provide any of the following to a regulated financial entity operating in the EU — cloud services, software, data analytics, IT support, cybersecurity services, data centre services, or any form of digital or technology service — you are within DORA's reach through the contractual obligations placed on your financial entity clients.
Your financial entity clients are now required by law to audit and manage you as a supplier. That means they will send you questionnaires, require contractual amendments, and — for critical or important suppliers — potentially request access to your facilities for independent audits. The question is whether you will be ready when that happens.
1. Determine your tier. Financial entities must classify their ICT suppliers into tiers based on the criticality of the services provided. Ask your clients whether they have classified you as a critical or important ICT service provider. Critical providers face more intensive oversight. If you don't know your classification, ask.
2. Review your contracts. DORA requires financial entities to ensure their ICT supplier contracts contain specific provisions — covering audit rights, data access, security standards, incident notification timelines, and termination rights. Your existing contracts may need amendment. Review against the mandatory contractual elements listed in DORA Article 30.
3. Document your ICT risk management framework. You need a documented, board-approved framework that covers how you identify, assess, and manage ICT risks. This doesn't need to be 100 pages — but it must be formal, maintained, and demonstrably in use.
4. Define your incident classification and reporting process. DORA requires financial entities to report major incidents within specific timelines. As a supplier, you will be expected to support your clients in meeting those timelines by notifying them rapidly when incidents affecting their data or services occur. You need a documented incident classification process and clear client notification SLAs.
5. Map your own supply chain. Your financial entity clients need to understand your sub-contractors. Identify all material sub-processors, cloud providers, and third parties involved in the delivery of your services. Document them.
6. Test your business continuity plan. DORA requires ICT business continuity plans to be tested at least annually. If your BCP has not been tested, or if you don't have one, this is a critical gap that will appear on any DORA questionnaire.
7. Conduct a penetration test and document the results. Regular testing of ICT systems is expected. If you cannot provide evidence of a recent penetration test or vulnerability assessment, procurement teams at financial entities will flag this immediately.
8. Establish audit rights for your clients. Your contracts with financial entity clients must grant them (and their designated auditors) the right to audit your premises, systems, and records. This is non-negotiable under DORA Article 30.
9. Train your staff on ICT security awareness. Documented annual security training for all staff handling systems relevant to your financial entity clients is expected. Keep attendance records.
10. Define your data recovery objectives. Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for the services you provide to financial entities must be defined, documented, and tested.
11. Complete your clients' questionnaires honestly. When a DORA third-party risk questionnaire arrives, answer it accurately. Do not overstate your compliance position. If a gap exists, acknowledge it and provide a remediation timeline. Financial entities prefer a supplier with a credible remediation plan to one who claims full compliance and cannot substantiate it.
12. Engage external advisory support if needed. If working through this list has revealed significant gaps, a structured advisory engagement will always deliver more than trying to address it internally without regulatory expertise. The cost of advisory is a fraction of the cost of contract loss.
The most common gap we find at assessment: The majority of Irish ICT suppliers who receive a DORA questionnaire have adequate technical security controls but no formal documentation — no written ICT risk framework, no tested BCP, no documented incident classification process. Documentation is 60% of what DORA questionnaires assess.
Need help working through this checklist? A Yamasuki 3-Day Assessment covers all 12 points and delivers a board-ready gap analysis and remediation roadmap.
Book a Free Scoping Call →NIS2 applies to medium and large organisations across 18 designated sectors. But scope determination is more complex than company size alone — and many Irish companies are in scope without knowing it. This guide walks you through the full determination process specific to Ireland.
The Network and Information Security Directive 2 (NIS2) significantly expanded the scope of cybersecurity regulation compared to the original NIS Directive. Under the Irish National Cyber Security Bill (which transposes NIS2 into Irish law), between 4,500 and 6,000 Irish organisations will come within scope. The question every mid-market operator needs to answer is: does that include us?
The answer has three parts: sector, size, and supply chain.
NIS2 distinguishes between essential entities (higher obligations, higher fines) and important entities (still significant obligations, lower fines). The sectors covered include:
Essential entities: Energy, transport, banking and financial infrastructure, healthcare, drinking water, digital infrastructure, public administration, space sector.
Important entities: Postal and courier services, waste management, chemicals, food production, manufacturing (of medical devices, computers, electronics, electrical equipment, machinery, motor vehicles, and other transport equipment), digital providers, and research organisations.
If your organisation operates in any of these sectors — directly or as a significant supplier to one — you are likely in scope.
NIS2 uses the EU's standard definition of medium and large enterprises. You are in scope if you have 50 or more employees AND/OR annual turnover or balance sheet total exceeding €10 million. Micro-enterprises (fewer than 10 employees, turnover under €2M) are generally excluded, as are small enterprises — unless they provide critical services, operate infrastructure without alternatives, or are identified as critical by member state authorities.
This is the point most Irish organisations miss. Even if you are formally below the NIS2 threshold, you may be pulled into compliance obligations through your supply chain. When an essential or important entity must comply with NIS2, they are required to assess the security of their supply chain — which typically translates into contractual requirements passed down to their suppliers. A 30-person software company supplying a hospital group, a 45-person logistics firm serving a pharma manufacturer, or a small IT consultancy with a public sector client can all face de facto NIS2 obligations through upstream contracts.
The supply chain point is the most important: The formal NIS2 threshold is 50 employees / €10M turnover. But if you supply a regulated entity, their NIS2 obligations will flow downstream to you contractually — regardless of your size. This is already happening in Irish financial services with DORA, and NIS2 will follow the same pattern across manufacturing, healthcare, and logistics.
If you are in scope, NIS2 requires your organisation to implement cybersecurity risk management measures proportionate to the risk. This includes at minimum:
Board-level obligation: NIS2 Article 20 requires the management bodies (board of directors or equivalent) of essential and important entities to approve cybersecurity risk management measures and oversee their implementation. Directors can be held personally liable for breaches attributed to negligence in exercising their oversight obligations. This is a significant development that many Irish boards are not yet aware of.
Start with a scope confirmation — confirm in writing (ideally with external advisory support) whether your organisation qualifies as essential or important under NIS2 as transposed by Irish law. This determination affects both your obligations and the fine exposure.
Then commission a gap analysis against the minimum NIS2 requirements. This will show you the distance between your current posture and where you need to be, and generate a prioritised remediation plan. The good news: most mid-market Irish organisations already have many of the building blocks in place — the gap is usually in documentation, testing, and governance, not in technical controls.
Unsure whether your organisation is in NIS2 scope? Yamasuki offers a free 30-minute scope assessment call — no charge, no obligation.
Book Free Scope Assessment →Most Irish manufacturers with SAP environments have never formally reviewed their access controls. NIS2 changes that — and the 2027 SAP ECC sunset is accelerating the timeline. Here is what auditors will look for and how to prepare without disrupting operations.
If your manufacturing company runs SAP S/4HANA or SAP ECC, and you have been live for more than two years, there is a very high probability that you have Segregation of Duties (SoD) conflicts in your access control framework. Not because of poor initial design — though that happens — but because SAP environments accumulate access problems over time. Every role change, every new joiner, every workaround, every project adds small access expansions that individually seem harmless and collectively create serious control weaknesses.
Under NIS2, Irish manufacturers classified as important entities (which includes manufacturers of medical devices, electronics, machinery, chemicals, food products, and motor vehicles) are required to implement cybersecurity risk management measures that include access control systems. An unreviewed SAP environment with widespread SoD conflicts is not an access control system — it is an access control problem.
Segregation of Duties is a fundamental internal control principle: no single person should be able to initiate, authorise, and record a financial or operational transaction without oversight. In SAP, SoD conflicts occur when a user's role combination allows them to, for example, create a vendor AND raise a purchase order AND approve the payment — giving them end-to-end control over an entire financial process without a second pair of eyes.
This is not a theoretical risk. The Association of Certified Fraud Examiners estimates that a median fraud event costs €145,000 and takes 14 months to detect. The overwhelming majority of SAP-related fraud cases involve exploited SoD conflicts — often by users who were never intended to have the combined access they accumulated over time.
NIS2 obligations: Irish manufacturers in scope must have cybersecurity risk management measures in place, including formal access control policies and review processes. A first regulatory audit or enterprise client audit could happen at any time. SAP access controls will be examined.
SAP ECC end-of-mainstream-maintenance (2027): Companies still running SAP ECC are facing a migration to SAP S/4HANA. Every S/4HANA migration is effectively a clean-sheet restart for roles and authorisations — the old role structure does not migrate cleanly. This is a critical window to design a clean, SoD-compliant role architecture from the outset rather than inheriting five years of accumulated access problems in the new environment.
The 2027 SAP migration window: Companies migrating from SAP ECC to S/4HANA have a one-time opportunity to build clean access controls into the new environment. It costs significantly more to remediate SoD conflicts post-migration than to design them out during the migration itself. If your S/4HANA project plan does not include GRC and access control design as a workstream, it is incomplete.
Whether the audit comes from a regulatory body, an enterprise client's procurement team, or an external audit firm, the SAP access control questions will follow a consistent pattern:
Step 1: Commission an SoD conflict analysis. Use SAP GRC Access Control or a third-party tool to run a full SoD conflict report against your current user base. The output will show every user with a conflict, the specific conflicting authorisation objects, and a risk rating. This is the baseline — you cannot address what you cannot see.
Step 2: Triage and prioritise. Not every SoD conflict carries the same risk. Prioritise conflicts in financially sensitive areas — procurement, accounts payable, treasury, and goods receipt — where the combination of access could enable fraud or misstatement. Lower-priority conflicts can be documented and addressed over time.
Step 3: Remediate or document compensating controls. For high-priority conflicts, either remove the access or restructure the role. Where access cannot be removed without operational disruption, implement and document a compensating control — for example, a manager review of all transactions performed using the conflicting access.
Step 4: Implement a formal leaver process. The most common SAP access control failure we encounter is former employees or contractors who still have active accounts. This must be addressed with a formal, documented process that connects HR departure notifications to SAP account deactivation within 24 hours.
Step 5: Document everything. The access control work you do has no audit value if it is not documented. The SoD analysis, the risk acceptance decisions, the compensating controls, and the policy framework all need to be in writing.
Yamasuki's SAP Identity & Access Governance Audit covers all five steps and delivers an audit-ready access control report — from €12,500 fixed fee.
View SAP Audit Pricing →Enforcement actions, regulatory changes, and practical compliance tips — monthly, direct to your inbox. No spam. Unsubscribe any time.