Shipping and ports
Sea and coastal passenger and freight transport companies, the managing bodies of ports, and operators of vessel traffic services are listed in Annex I. The individual vessels are not.
Home / NIS2 in Cyprus
NIS2 in Cyprus: six hours to warn, not twenty-four.
Security of Networks and Information Systems Law 89(I)/2020, as amended in April 2025 · Scope, deadlines, fines, and board duties
The clock starts the moment you become aware of the incident. Six hours later, the Digital Security Authority expects your first warning. By then you need to know what was hit and whether it is contained.
Cyprus transposed the NIS2 Directive in April 2025 through Law 60(I)/2025, which amends the Security of Networks and Information Systems Law 89(I)/2020. The Digital Security Authority supervises essential and important entities. Article 35B requires an early warning within six hours of becoming aware of a significant incident, where the Directive allows twenty-four, followed by a notification within 72 hours and a final report within one month.
NIS2 reporting deadlines in Cyprus.
An incident is significant when it has caused, or can cause, severe operational disruption or financial loss for you, or considerable damage to others. From the moment you become aware of one, these deadlines apply.
| Deadline | What is due | To whom |
|---|---|---|
| Within 6 hours of becoming aware | Early warning. Say whether you suspect an unlawful or malicious act and whether the incident could have cross-border impact. | Digital Security Authority |
| Within 72 hours of becoming aware | Incident notification with a first assessment of severity and impact, and indicators of compromise where you have them. | Digital Security Authority |
| When the Authority asks | Intermediate report with status updates. | Digital Security Authority |
| One month after the notification | Final report: what happened, the likely root cause, the measures taken and under way, and any cross-border impact. | Digital Security Authority |
| While the incident is still running | Progress report every 15 days, then the final report within 15 days of restoring the affected systems. | Digital Security Authority |
| Without undue delay | Tell the recipients of your services when the incident is likely to affect them. | Your customers |
Source: Article 35B of Law 89(I)/2020, consolidated with Law 60(I)/2025. Trust service providers notify within 24 hours instead of 72.
Where possible, the Authority answers your early warning within 24 hours with initial feedback. If you ask for it, CSIRT-CY, the national incident response team, gives technical support.
Who falls under NIS2 in Cyprus?
The Law applies to companies in the sectors of its two annexes that are medium-sized or larger: fifty or more employees, or annual turnover and balance sheet both above EUR 10 million. Large companies in the Annex I sectors are essential entities, as are some providers whatever their size and any entity the Authority designates. The rest are important entities: the same duties, supervision after the fact rather than in advance, and a lower fine ceiling.
Banks and market infrastructure
Credit institutions, trading venues, and central counterparties are listed in Annex I. Where DORA sets equivalent duties, DORA governs their risk management and incident reporting.
Cloud, data centres, and managed services
Cloud and data centre providers, managed service providers, and managed security service providers are in Annex I. Public telecoms, trust service providers, DNS providers, and top-level domain registries are in scope whatever their size.
Energy, health, manufacturing, and more
Annex I also covers energy, healthcare and pharmaceuticals, water, and central government. Annex II adds postal and courier services, waste, chemicals, food, makers of medical devices, electronics, machinery, and vehicles, online marketplaces, and research organisations.
You won't find your company on a public list.
The list of essential and important entities is confidential and is not published in the Official Gazette. The Authority serves its decision on each company it designates. A company that falls within scope and has not been listed has to inform the Authority itself (Article 27B). A newly created entity must also consult the Authority on security by design before it starts operating (Article 27A).
Your board approves the measures. And answers for them.
Under Article 35A, the management body must approve the cybersecurity risk-management measures, oversee how they are carried out, and can be held liable when the company falls short. Its members must take part in training and offer similar training to employees on a regular basis. The approval and the oversight stay with the board, whoever does the work.
The ten measures Article 35 requires as a minimum
The measures follow an all-hazards approach and have to be proportionate to your exposure, your size, and the likely impact of an incident. The Authority may set them out in more detail by decision.
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, such as backup management and disaster recovery, and crisis management
- Supply chain security, including your direct suppliers and service providers
- Security in acquiring, developing, and maintaining systems, including vulnerability handling and disclosure
- Policies and procedures to assess whether the measures work
- Basic cyber hygiene and cybersecurity training
- Policies on cryptography and, where appropriate, encryption
- Human resources security, access control, and asset management
- Multi-factor or continuous authentication and secured communications, including for emergencies
What a NIS2 breach costs in Cyprus.
For breaches of the risk-management and reporting duties, Article 43A sets the maximum administrative fine at no less than the amounts below, whichever is higher. Article 44 makes two failures criminal offences.
EUR 10 millionor 2% of worldwide annual turnover: fine ceiling for essential entities
EUR 7 millionor 1.4% of worldwide annual turnover: fine ceiling for important entities
Up to 3 yearsin prison, a fine of up to EUR 15,000, or both, for failing to take appropriate measures
Up to 2 yearsin prison, a fine of up to EUR 10,000, or both, for failing to notify an incident with a severe impact on the continuity of essential services
What Identiqa takes off your hands.
The law asks for measures, evidence, and speed. This is the part we build and run with you.
Contain the attack within the six hours
AuraLink works beside your firewall and blocks an attack while your team is still being called. Its record shows what was hit and when, which is what the early warning asks for.
A backup the attacker can't delete
Article 35 lists backup management and disaster recovery among the minimum measures. AuraLink locks every snapshot in the storage controller, inside your own rack, where a stolen administrator account can't erase it.
Servers checked from the inside
AuraCore finds the quiet footholds attackers leave on servers, virtual machines, and containers, and removes them with signed commands. Every finding goes into a record your auditor can read.
A security lead for your board
As External CISO, Identiqa measures you against the ten minimum measures, prepares the decisions your board has to approve, and delivers the board training Article 35A requires.
Find out whether you are in scope.
Tell us your sector, your size, and what your board has been asked to show. We reply to arrange a first briefing with our team in Cyprus, free of charge.
cyprus@identiqa.comCommon questions
Does NIS2 apply to a company in Cyprus with fewer than fifty employees?
Usually not, with three exceptions. A company with fewer than fifty employees is in scope if both its annual turnover and its balance sheet exceed EUR 10 million, if it is one of the entity types the Law covers whatever their size, such as DNS providers and trust service providers, or if the Digital Security Authority designates it because its service is critical. Staff and turnover of linked and partner companies count towards the thresholds, so a small Cypriot subsidiary of a larger group can be in scope.
Who is the NIS2 authority in Cyprus?
The Digital Security Authority, led by the Commissioner for Communications. It supervises essential and important entities, receives incident notifications, and imposes fines. CSIRT-CY, the national computer security incident response team, operates within the Authority and gives technical support during an incident.
Is a NIS2 incident also a personal data breach?
It can be. If personal data is affected, the GDPR adds a separate notification to the Commissioner for Personal Data Protection within 72 hours (Article 33 GDPR). The Digital Security Authority informs the Commissioner when it sees such a breach, and a company fined under the GDPR is not fined again under Article 43A for the same conduct (Article 44A), though the Authority can still order corrective measures.
Does notifying an incident increase our liability?
No. Article 35B states that the mere act of notification does not subject the notifying entity to increased liability. The criminal offence in Article 44 is failing to notify an incident with a severe impact on the continuity of essential services.
This page summarises the Law as consolidated in English by the Digital Security Authority. It is not legal advice. The Greek text published in the Official Gazette is authoritative.