Blog

GDPR requires you to notify the DPC of a personal data breach within 72 hours of becoming aware. This guide explains what counts as a notifiable breach, what your notification must contain, when you must also notify affected individuals, and how to manage the first 72 hours.

Cyber Essentials and ISO 27001 are both cybersecurity frameworks, but they serve different purposes and require very different levels of effort. This guide explains what each covers, who typically needs each one, and which to pursue first based on your situation.

Zero trust is increasingly referenced in NIS2 guidance and security frameworks, but most SME resources treat it as an enterprise-only concept. This guide explains what zero trust actually means in practice for a small business and where to start without a dedicated security team.

An incident response plan is required by NIS2, referenced in GDPR, and expected under ISO 27001 — but most SMEs don't have a documented one. This guide provides a clear structure for building yours, covering preparation, detection, containment, recovery, and review.

DORA Pillar 4 requires financial entities to formally manage ICT third-party risk — including through contractual provisions specified in the regulation. This guide explains what must be in your supplier contracts, how to assess ICT third-party risk, and what the Central Bank of Ireland expects.

Multi-factor authentication (MFA) is one of the highest-impact security controls an SME can implement — and is required by NIS2, ISO 27001, and Cyber Essentials. This guide explains what MFA is, which accounts to prioritise, what types to use, and how to roll it out across your organisation.

Business continuity planning is a requirement under NIS2, DORA, and ISO 27001 — and is actively tested under DORA. This guide explains what an SME-scale BCP must contain, how to structure it without a dedicated team, and how to test it before you need it.

NIS2 requires significant cyber incidents to be reported within 24 hours of becoming aware. This guide explains what triggers the clock, who you notify in Ireland, what each report must contain, and how to build a notification process before an incident occurs.

An information security policy is the foundation document of any ISMS and a baseline requirement under ISO 27001, NIS2, and GDPR. This guide explains what it must cover, how to write one that people actually use, and the common mistakes that undermine it.

NIS2 Article 21 requires covered organisations to address cybersecurity risks across their supply chains — not just within their own systems. This guide explains what the obligation means in practice, how to assess your suppliers, and what contractual protections you need.