Free and private, for Irish small businesses
Do it once.
Count it everywhere.
Free, plain-English help with cyber security rules for Irish small businesses: what applies to you, what your habits already count towards, and what to do when something goes wrong. Nothing you enter leaves your browser.
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.
§1 Start here
What brings you here?
- Something has gone wrongThe incident clockA cyber incident or a data breach. Who you may have to tell, and by when, with live countdowns and a first-hour checklist.
- A customer sent me a security questionnaireThe questionnaire translatorPick their question. See what they really mean, the evidence that answers it, and a plain answer to adapt.
- Does NIS2 apply to my business?The NIS2 checkFour questions about what you do and how big you are. A likely answer, with the reasons.
- Where do we start?The mapTick the security habits you already have. See what they count towards and the three best next steps.
§2 How the map works
Three steps, about two minutes
- Switch on what you already doTick the habits you have now, such as two-step sign-in, daily backups or a supplier list. You don’t need any jargon.
- Watch the lines drawEach habit links to the exact articles and controls it supports. The four rings fill as you go. Tap any line to read the official wording behind it.
- See what to do next, and share itYou get three suggestions that add the most new coverage. Download your picture or send a link. The link only records which dots are on.
§3 The four frameworks
Two laws, two standards
-
EU NIS2 Directive
EU directive · 12 articles in this map · circle, solid line
The EU law setting cyber security duties for essential and important organisations. Its reach extends to the suppliers they rely on.
-
General Data Protection Regulation
EU regulation · 8 articles in this map · square, dashed line
The EU law on personal data. Article 32 asks for security that fits the risk, and Articles 33 and 34 cover breaches.
-
ISO/IEC 27001:2022
International standard · 26 controls and clauses in this map · diamond, dotted line
The international standard for running an information security management system. Firms can be certified against it.
-
NIST Cybersecurity Framework 2.0
Voluntary framework · 22 categories in this map · triangle, dash-dot line
A free, voluntary framework from the US National Institute of Standards and Technology. It is widely used as a common language.
Each framework has its own shape and line style as well as its colour, so the map still reads in black and white.
§4 What this is not
Honest about its limits
Overlap is not legal advice, an audit or a compliance test. A line on the map doesn’t mean you meet a law. It means a habit you have is related to what that law asks.
The links were written by hand from the public texts, and each one quotes the text it rests on so you can check it. ISO links show only the control number, because the standard is copyrighted. The rules change too: Ireland has not yet passed its NIS2 law.
Overlap is an independent project. It is not a product of, or endorsed by, the NCSC, the Data Protection Commission, the European Union, NIST, ISO or any government.