Cyber Security for Irish Businesses: The Basics That Matter
How attacks on Irish businesses happen, the six basics in the order that removes the most risk, what GDPR and NIS2 expect of you, what to do in the first hour after an incident, and who to call. Written for owners and managers, not IT departments.
Written for businesses based in Ireland. The basics apply anywhere; the law and the contacts are Irish.
How Attacks Happen
Most incidents that hit Irish businesses are not clever. They start with one of four things, and each has a basic that stops it.
A fake invoice or changed bank details. An email that looks like it is from a supplier, or from the boss, asks for a payment. Nobody phones to check.
A stolen password. Reused on a site that was breached, or typed into a convincing fake login page. Email goes first, then everything it can reset.
Ransomware. Files are encrypted and a ransom demanded. Whether you have a tested backup decides whether this is a bad day or a bad year.
A lost or stolen laptop. Without encryption, everything on it is readable, and it is a personal data breach you must report.
Why Your Size Does Not Protect You
Attacks are automated. Software scans for weak passwords, old systems and unprotected email domains across millions of addresses, and it does not know how big you are. Smaller businesses get hit because the basics are missing, not because anyone chose them.
The good news is the same in reverse. Six settings and habits, none of them expensive, remove most of the easy ways in. The rest of this page is those six, in the order we would do them.
Not sure where you stand? The free health check scores the six areas in three minutes and tells you which to fix first.
The Six Basics, in Order
Do them top to bottom. The first two remove the most risk for the least effort, and most of the list is an afternoon of settings rather than a project.
Two-step sign-in on email first, then everything else
A stolen or guessed password is behind most break-ins. With a second step at login, the password alone is not enough. Switch it on for email before anything else, because whoever controls your email can reset every other password you have. Then banking, accounts, the website admin and any system that holds customer data. Put shared logins into a password manager so each person has their own.
A backup you have tested
Ransomware locks your files and asks for money; hardware fails; someone deletes the wrong folder. All three end the same way without a backup. Use a cloud backup that runs on its own, keep a copy that something on your network could not reach, and restore one file every few months to prove it works. A backup you have never restored from is a hope, not a plan.
Updates on, disks encrypted, screens locked
Updates close the holes attackers use, so turn automatic updates on for every laptop and phone. Encryption means a lost device is a lost device, not a data breach you must report: FileVault on a Mac, BitLocker on Windows, on by default on modern phones. Set a screen lock of five minutes or less, and set up remote wipe through your Google or Microsoft admin console.
The phone-first rule for payments
Invoice fraud is the most common way Irish businesses lose money to crime. An email arrives from a supplier, or from your own director, with new bank details or an urgent payment. The fix is one rule: any change to bank details, and any unusual payment request, is confirmed by phone on a number you already hold, never one in the email. Two people sign off changes to supplier details.
Protect your email domain and look after the website
Three settings on your domain, called SPF, DKIM and DMARC, tell other mail servers which senders may use your address. Without them, anyone can send email that looks like it came from you, to your customers and your bank. Your domain host or IT provider can set them up. Keep the website platform updated, use HTTPS, and give the admin login two-step sign-in too.
A one-page plan for when it goes wrong
The first hours after an incident decide how bad it gets. Write one page: who to call and how to reach them without email, where the backups are, what to shut down first, and who talks to customers. Print it. Note the 72-hour deadline for reporting a personal data breach to the Data Protection Commission, and check whether your insurance covers cyber incidents.
What the Law Expects
Two sets of rules matter to most Irish businesses, and one of them already applies to you.
GDPR applies to every business that holds personal data, which is every business with customers or staff. It asks for security measures appropriate to the risk, and it sets the clock after a breach: the Data Protection Commission must be told within 72 hours of you becoming aware, unless the risk to people is low, and the people affected must be told when the risk to them is high. Keep a record of every breach, reported or not.
NIS2 is the EU’s network and information security directive. It targets medium and large organisations in listed sectors, so most Irish businesses are outside it directly. It reaches them indirectly: organisations in scope must manage the security of their suppliers, so a larger customer may ask you to show your basics are in place. Ireland is putting it into national law; the National Cyber Security Centre publishes the current position.
Cyber insurance is not law, but it behaves like it. Policies increasingly require two-step sign-in, tested backups and a written plan before they will pay out. Read the conditions before you buy.
Who to Call in Ireland
Keep these on the one-page plan, on paper, where you can find them without a working computer.
National Cyber Security Centre. Ireland’s national body. Guidance for businesses, alerts, and a route to report incidents.
An Garda Síochána. Report through your local station. Serious cases go to the Garda National Cyber Crime Bureau.
Data Protection Commission. Breach notification within 72 hours when personal data is involved.
FraudSMART. The Irish banks’ fraud awareness service, with current scams and what to do if you have paid one.
Your bank, your IT provider, and us. The bank first if money has moved. Our founder holds a certificate in cyber security and can walk you through the fixes.
The First Hour After an Incident
Something is wrong: a ransom note on a screen, a payment that went to the wrong account, email sending itself. Do these in order.
Disconnect, do not wipe
Unplug the affected machine from the network or turn off its Wi-Fi. Do not reinstall or delete anything yet: evidence helps your IT provider work out what happened and what was taken.
Change passwords from a clean device
Start with email, then banking, then anything connected to the affected account. Use a phone or a laptop you know is clean, and turn on two-step sign-in as you go.
Call your IT provider, and your bank if money moved
If a payment went to the wrong account, phone the bank at once. Banks can sometimes recall a transfer within hours, rarely after days.
Write down what happened and when
Who noticed, what they saw, which systems and which data. You will need this for your IT provider, the Gardaí, your insurer and, if personal data is involved, the Data Protection Commission.
Report it
Report to the Gardaí through your local station or the Garda National Cyber Crime Bureau, and to the National Cyber Security Centre. If personal data was lost or exposed, the Data Protection Commission must be notified within 72 hours of you becoming aware, unless the risk to people is low.
Tell the people affected
If customer or staff data is at risk, tell them plainly what happened and what to watch for. People forgive an honest early warning far more readily than a late one.
Common Questions
Would anyone bother attacking a business my size?
Yes, because most attacks are automated. Software scans for weak passwords, old systems and open doors across millions of addresses at once, and it does not know or care how big you are. The businesses that get hit are the ones with the easiest gaps, not the biggest names.
What is two-step sign-in, and which kind should I use?
A second check at login, such as a code from an app on your phone, on top of the password. It is also called two-factor or multi-factor authentication. An authenticator app or a passkey is better than a code by text message, because text messages can be redirected. Any of them is far better than none.
Do I need cyber insurance?
It is worth a look once the basics are in place, and many policies now require two-step sign-in and tested backups before they will pay out. Read the conditions before you buy. Insurance covers the cost of an incident; it does not stop one.
Does NIS2 apply to me?
For most Irish businesses, no. NIS2 is aimed at medium and large organisations in listed sectors such as energy, transport, health, water, digital services and manufacturing of certain products. It can still reach you indirectly, because those organisations must manage the security of their suppliers, so a larger customer may ask you to show your basics are in place.
Can I do this myself, or do I need an IT company?
Most of the six basics are settings you can switch on yourself in an afternoon, with the help of your email and domain provider. Backups, device management and the email domain settings are easier with an IT provider. If you do not have one, we can do them with you.
How often should I check?
Run the health check again every six months, and whenever you change email, website or accounting tools. Review who has access to what when someone joins or leaves. Test a backup restore every few months.
Explore More
Three free checks that each take about three minutes and end with what to do next.
Cyber Security Health Check
Score the six basics on this page for your own business, and get the three fixes that matter most, in order.
AI Act Checker
Which EU AI Act and GDPR duties apply to how your business uses AI, with the dates that matter.
AI Readiness Assessment
A score across six dimensions, your stage, and the three things to do next, including how your data is handled in AI tools.
Want a Hand With the Basics?
Most of the fixes on this page are a few hours of setup. We can do them with you or alongside your IT provider. This page is general information, not legal advice. A free call is the best way to talk through your own situation.