AuraLink with ProtectionGrid
Our own 2U appliance works beside the firewall you already run. It blocks attacks that pass the firewall and locks every backup in the storage controller, where a stolen administrator account can't delete it.
Your backups stay on the island.
Identiqa in Cyprus · Edge defence, locked backups, and security leadership for regulated companies
A firewall doesn't stop attackers. They sign in with valid credentials and delete your backups first. Identiqa defends your network and keeps a copy that a stolen administrator account can't erase, inside your own rack in Cyprus.
Identiqa builds the 2U AuraLink appliance with ProtectionGrid and the AuraCore cluster manager for servers and containers, and serves companies in Cyprus as External CISO. 94 per cent of organisations hit by ransomware say the attackers tried to compromise their backups (Sophos 2024). AuraLink locks every snapshot in the storage controller, so your recovery copy stays in your rack and under your control.
Three things that keep you running.
AuraCore
Keeps servers, virtual machines, Kubernetes, and Docker clean from the inside. It finds the quiet footholds attackers leave behind and removes them with signed commands, never through an open shell.
External CISO
Security leadership for your board without a full-time hire: governance, audits, and evidence under NIS2, DORA, and GDPR. Or we help you recruit your own CISO and build the team.
2UOne appliance beside your firewall
In your rackPrimary backups never leave your premises
SecureBoot + TPM 2.0Hardware-rooted identity for every node
Signed commandsNo open shell, on any system
Small company. Full EU rulebook.
A ship manager in Limassol, a Cyprus Investment Firm (CIF), or a fiduciary in Nicosia may employ fifty people and faces the same rules as a group ten times its size. These are the companies we work for.
Shipping and ship management
Fleet, crewing, and chartering systems are run from offices on the island. When those offices are locked out, the ships still sail, and nobody ashore can serve them. Cyber risk has been part of the safety management system under the ISM Code since 2021, and charterers ask about it in vetting.
Investment firms, payments, and banks
Supervised by CySEC or the Central Bank of Cyprus, and under DORA since January 2025. ICT risk, incident reporting, and resilience testing are matters for the board.
Fiduciary and corporate services
The records of hundreds of client structures sit in one document system. That is exactly what an extortion group looks for, and what your clients trust you to keep.
Technology and gaming
Production runs in the cloud, administration on the island. Customers, partners, and gaming regulators ask for evidence of control before they sign or license.
Maritime cybersecurity for ship managers in Limassol · CySEC DORA compliance for CIFs and financial firms
NIS2 and DORA in Cyprus: what your board has to show.
Cyprus brought NIS2 into national law in April 2025 by amending its Security of Networks and Information Systems Law. The Digital Security Authority supervises it, and CSIRT-CY, the national incident team, operates within it. For financial entities, DORA has applied since 17 January 2025 under CySEC and the Central Bank of Cyprus. Personal data falls under the GDPR and the Commissioner for Personal Data Protection.
Under NIS2 and DORA, the management body approves the measures and answers for them. The approval and the oversight stay with the board, whoever does the work. And after an incident, two clocks can run at once: NIS2 or DORA, and the GDPR.
| Rule | First report | Follow-up | Final report | To whom |
|---|---|---|---|---|
| NIS2, Cypriot law | Early warning within 6 hours of becoming aware | Notification within 72 hours | One month after the notification | Digital Security Authority |
| DORA | Initial notification within 4 hours of classifying the incident as major, at most 24 hours after becoming aware | Intermediate report within 72 hours of the first | One month after the last intermediate report | CySEC or the Central Bank of Cyprus |
| GDPR | Notification within 72 hours of becoming aware of a personal data breach that is likely to put people's rights at risk | Further information in phases, without undue delay | No fixed date | Commissioner for Personal Data Protection |
Sources: Article 35B of Law 89(I)/2020 as amended by Law 60(I)/2025, Article 19 of Regulation (EU) 2022/2554 with Delegated Regulation (EU) 2025/301, Article 33 GDPR.
Before the audit
A record of what was blocked at your network, what was found on your servers, and that your backups were locked. In a form you can hand to an auditor or a supervisor.
After an incident
The six-hour warning is yours to send. AuraLink contains the attack while your team is still being called, and its record gives you the facts for the report. The locked copy in your rack is there to restore from.
NIS2 in Cyprus: scope, deadlines, and fines · DORA for CySEC-regulated firms
External CISO in Cyprus, or a CISO of your own.
Few companies in Cyprus need a full-time CISO, and fewer still can find one. We offer both routes.
External CISO
Identiqa serves as your CISO: security governance, audit preparation, and reporting that stands up to scrutiny from your board, your auditors, and your supervisor. You get the role without the search for a full-time hire.
Your own CISO and team
If you'd rather have the role in-house, we help you recruit the right CISO, vet the shortlist in technical interviews, and build the team around them. We stay at their side as advisers.
What an External CISO does, and when your own is the better choice
A cybersecurity company with engineers in Limassol and Nicosia.
Identiqa develops part of its platform in Cyprus, with teams in Limassol and Nicosia. The people who build AuraLink and AuraCore work on the island and in your time zone. We're establishing our Cypriot company now.
Limassol · NicosiaIdentiqa locations in Cyprus
EngineeringPart of the platform is developed here
EU lawDORA and the GDPR apply directly, NIS2 through Cypriot law
In formationOur Cypriot company is being established
Start with a first architecture briefing. It's free.
We walk you through how AuraLink and AuraCore fit your infrastructure and your sites in Cyprus, and what your board needs for NIS2 or DORA.
Write to our team in Cyprus.
Tell us what you run and what your board has been asked to show. We reply to arrange the briefing.
cyprus@identiqa.comCommon questions
Who falls under NIS2 in Cyprus?
Companies in the sectors listed in the two annexes of the Security of Networks and Information Systems Law that are medium-sized or larger: fifty or more employees, or annual turnover and balance sheet both above EUR 10 million. The sectors include shipping and ports, banking, energy, health, cloud and data centre providers, managed service providers, food, and manufacturing. Some providers, such as DNS and trust service providers, are in scope whatever their size.
How fast does a cyber incident have to be reported in Cyprus?
Under the Cypriot NIS2 law, an early warning goes to the Digital Security Authority within six hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month. Financial entities under DORA send the initial notification within four hours of classifying an incident as major. A personal data breach that is likely to put people's rights at risk goes to the Commissioner for Personal Data Protection within 72 hours.
What does CySEC expect under DORA?
Since 17 January 2025, firms supervised by CySEC need an ICT risk management framework approved by the management body, a process to classify and report major ICT-related incidents, testing at least once a year of the ICT systems that support critical or important functions, and a register of all contracts with ICT providers. Small firms under the simplified framework of Article 16 and microenterprises have lighter duties. Incident reports go through the channel CySEC sets out in its circulars.
What are the fines for a NIS2 breach in Cyprus?
The Law sets the maximum fine at no less than EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% for important entities, whichever is higher. Failing to take appropriate measures, or to notify an incident with a severe impact on the continuity of essential services, is also a criminal offence.
Does our company need a CISO?
The law doesn't use the title, but it describes the job. NIS2 and DORA make the management body approve the security measures and answer for them, and DORA asks most financial entities to give the management of ICT risk to a control function with an appropriate level of independence (Article 6). Identiqa takes that role as External CISO, or helps you recruit your own.
Does Identiqa have an office in Cyprus?
Identiqa has teams in Limassol and Nicosia, where part of the platform is developed. Our Cypriot company is being established.
Does our data leave Cyprus?
Your primary backups are locked inside the AuraLink appliance in your own rack, and AuraCore runs on your own servers. For the second copy, you decide. Mirror it to another site of yours on the island and nothing leaves the country. Or replicate it encrypted to the Identiqa Cloud, which runs in Europe and the United States.
Can we keep our firewall and our cloud provider?
Yes. AuraLink works beside the firewall you already run. Identiqa protects your systems whether they sit in your own rack or with Amazon Web Services, Google Cloud, or Microsoft Azure.
What does it cost to get started?
The first architecture briefing is free of charge. Anything that needs individual design is scoped afterwards as an Enterprise Architecture engagement with workshops and implementation support, priced by scope in euro plus VAT.
Is Identiqa an identity-verification provider?
No. Identiqa is a cybersecurity company. It is not a KYC or identity-verification vendor.