Topic

Cyber security, fraud, and the proof a customer asks for

The losses that reach a small Irish business mostly arrive by email, and the controls that stop them fit on one page.

Irish SMEs lost almost 19 million euro to email scams over 2024 and 2025, according to FraudSMART, the banks' fraud awareness programme. The majority of cases were invoice redirection: an email that did not come from the supplier says the supplier's bank details have changed.

The articles below cover the controls that stop that, the email settings that decide whether anybody can send mail in your name, and the questions a larger customer or an insurer asks to find out whether those controls exist.

8 articles on this

Backups
Your backup shows green. What the GDPR and an insurer expect you to show
Article 32 of the GDPR asks, as appropriate to the risk, for two things: the ability to restore personal data in a timely manner, and a process for regularly testing the security measures. The plainest evidence of both is a dated record of restoring real files, repeated at a set interval, from a copy that an attack on the original could not reach.16 minute read · 23 sources
Cyber security
Two-step sign-in on every mailbox: turning it on, and proving it
In four inquiries into break-ins to staff mailboxes, the Data Protection Commission treated the lack of two-step sign-in as a failing in the organisation's security. Allowing it is one setting. A regulator, an insurer or a customer asks whether it is enforced on every account that can sign in, info@ included, and for the report that shows it.15 minute read · 40 sources
Payment fraud
A supplier emails new bank details. What should happen next
Ring the supplier on a number you held before the email arrived and have a second person approve the change; if money has already gone to a new account, ring your bank's fraud team before anything else.18 minute read · 18 sources
Email security
Can someone send email as your business? What SPF, DKIM and DMARC decide
If your domain has no DMARC record, or one set to p=none, anybody can send email that shows your address as the sender. Receiving mail servers have nothing from you telling them to stop it.23 minute read · 23 sources
NIS2
Your customer is under NIS2. What they will ask you, the supplier
NIS2 does not cover a small supplier, unless it is a type of business the Directive covers at any size or an EU country has identified it. Ireland has not yet made the Directive part of Irish law (transposed it). The questions arrive anyway, because the Directive makes your customer take account of the security of each direct supplier.23 minute read · 18 sources
Cyber insurance
What a cyber insurer asks an Irish small business, and how to answer it truthfully
If your business turned over €3 million or less in its last financial year, and is not a company in a group that turned over more, Irish law puts you under no duty to volunteer information to the insurer. You must answer its questions honestly and with reasonable care. A dated screenshot, taken before you sign, is how you show you did.18 minute read · 19 sources
Cyber security
A customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?
None of the three is required by Irish law for an ordinary small business. Which one you need depends on who is asking, and whether they want a certificate or will accept your own assessment.17 minute read · 28 sources
NIS2
NIS2 is not Irish law yet. Here is when it still reaches you.
NIS2 is an EU cyber security law that Ireland has not yet made Irish law. Until it does, there is no Irish NIS2 regulator, no duty to register and no NIS2 fine. Some businesses are affected today anyway, through a customer's contract, the GDPR or the Cyber Resilience Act.22 minute read · 29 sources

What we do about this

What the law asks of youCompliance assessmentOne assessment of the rules that apply to you: GDPR, the EU AI Act and accessibility.
Compliance auditISO 27001 readinessWe prepare you for ISO 27001 certification.
We run itRunOne monthly fee to keep what we built running.
Cardinal, the platformClient portalProgress on your work, reports, invoices and support in one account, beside the automation, reporting and compliance work we run for you.

Talk to us

Cyber security, fraud, and the proof a customer asks for

8 articles on this

Your backup shows green. What the GDPR and an insurer expect you to show

Two-step sign-in on every mailbox: turning it on, and proving it

A supplier emails new bank details. What should happen next

Can someone send email as your business? What SPF, DKIM and DMARC decide

Your customer is under NIS2. What they will ask you, the supplier

What a cyber insurer asks an Irish small business, and how to answer it truthfully

A customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?

NIS2 is not Irish law yet. Here is when it still reaches you.

What we do about this

Other topics