The verdict in three sentences
A manufacturer with 900 employees falls within NIS2 scope as an important entity, and its business web applications (supplier portal, MES, customer extranet) become regulatory targets as much as technical ones. The minimum baseline comes down to four workstreams: application audit, company-wide MFA, centralised logging and a 24-hour notification procedure. Plan for an overall budget of 45,000 to 90,000 EUR over 6 to 9 months, against fines of up to 7 million euros or 1.4 % of worldwide turnover.
What NIS2 concretely changes for your business applications
Ireland's transposition of NIS2 requires important entities to take proportionate risk management measures, under the supervision of the National Cyber Security Centre and sector regulators. For a manufacturer, web applications are the most exposed entry point: shared accounts, weak passwords, APIs without strong authentication, missing logs. Regulators expect a documented approach, not instant perfection.
| NIS2 requirement | Application-level translation | Indicative 2026 cost |
|---|---|---|
| Risk analysis | Map applications and data flows | 5,000 to 10,000 EUR |
| Access control | MFA on all exposed applications, SSO | 8,000 to 18,000 EUR |
| Incident detection | Centralised logging, alerts, monitoring | 5,000 to 12,000 EUR |
| Vulnerability management | Application audit and annual penetration test | 12,000 to 30,000 EUR |
| Notification | Early warning within 24 h, report within 72 h | 2,500 to 5,000 EUR (procedure) |
| Supply chain | Security clauses with vendors | 2,000 to 4,000 EUR (legal) |
| Training | Awareness for management and staff | 4,000 to 8,000 EUR |
Management is personally accountable: the board must approve the measures and undergo training. That is a strong argument to secure budget at executive committee level.
Prioritising: which workstream to launch first
Doing everything at once dilutes the budget and exhausts the IT team, often only 4 to 6 people in a company of this size. The order below maximises risk reduction per euro spent.
| Priority | Workstream | Duration | Estimated risk reduction |
|---|---|---|---|
| 1 | MFA and removal of shared accounts | 3 to 5 weeks | Very high (credential theft) |
| 2 | Audit of the 3 critical applications | 4 to 6 weeks | High |
| 3 | Fix critical and high findings | 6 to 10 weeks | High |
| 4 | Centralised logging and alerts | 6 to 8 weeks | Medium to high |
| 5 | Notification procedure and crisis exercise | 2 to 3 weeks | Medium (compliance) |
| 6 | Vendor contract review | 4 weeks | Medium |
An often underestimated point: custom applications built 8 or 10 years ago run on outdated frameworks. Audits frequently show that a version upgrade costs less than a series of patches, roughly 20,000 to 40,000 EUR for a mid-sized application.
Mini case study
Claire, CISO of a 900-employee precision machining company near Dublin, manages three web applications: a supplier portal, a customer extranet and a production tracking tool. Turnover: 160 million euros. The theoretical maximum fine for an important entity is 7 million euros or 1.4 % of turnover, whichever is higher: since 1.4 % of her turnover is 2.24 million euros, her ceiling remains 7 million euros.
Her plan: audit of the three applications (18,000 EUR), MFA and SSO (12,000 EUR), remediation (22,000 EUR), logging (10,000 EUR), procedure and exercise (4,000 EUR), board training (5,000 EUR). Total: 71,000 EUR over 8 months, about 1 % of the maximum fine. There is also a commercial upside: two automotive customers already require proof of compliance in their tenders.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is a 900-employee manufacturer necessarily in NIS2 scope?
If it operates in a listed sector (machinery, electrical equipment, chemicals, food, etc.) and exceeds 50 employees or 10 million euros in turnover, yes. Above 250 employees, it may even qualify as an essential entity depending on the sector.
How much does a serious application audit cost?
In Dublin, between 12,000 and 30,000 EUR for a mid-sized business application, penetration test included. The price depends on the number of user roles and APIs to test, typically 5 to 10 audit days.
Is MFA enough to become compliant?
No, but it sharply reduces the risk of compromise through stolen credentials. NIS2 requires a holistic approach, including detection, 24-hour notification and vulnerability management.
Should we rewrite our legacy applications?
Not systematically. The audit settles it: if more than 30 % of the code depends on unmaintained components, a progressive rebuild is often more cost-effective over 3 years.
How long does a first compliance level take?
Plan 6 to 9 months for the four priority workstreams, with an internal IT team of 4 to 6 people and an external partner.
Let's scope your project. Audit of your business applications, a costed remediation plan and NIS2 support over 6 to 9 months, with an indicative budget of 45,000 to 90,000 EUR. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
