NIS2 in Cyprus

Key facts at a glance

Is your company in scope? Common Cyprus scenarios

Two worked examples of how NIS2 scoping plays out in Cyprus. Not sure where you land? Run the free NIS2 scope checker.

What Cyprus businesses need to know

• Cyprus transposed NIS2 by amending its 2020 law: Law 60(I)/2025 amended the Security of Networks and Information Systems Law of 2020, Law 89(I)/2020, and has been in force since its publication on 25 April 2025 (art. 57(1)). The Greek text is the binding one; the Authority's English version is for information only. The European Commission closed its infringement case INFR(2024)0259 on 8 October 2025.

• The Digital Security Authority (Αρχή Ψηφιακής Ασφάλειας), an independent authority headed by the Commissioner of Communications, is the competent authority for cybersecurity, with the supervision and enforcement duties, the cyber-crisis management authority and the single point of contact (arts. 6, 30(1) and (4)). The national CSIRT, CSIRT-CY, is part of the Authority (art. 6(9)).

• Scope follows the directive: entities of the types in Annexes I and II that are medium-sized or larger under Recommendation 2003/361/EC (art. 2Α(1)) and, at any size, public electronic communications providers, trust service providers, TLD registries, DNS providers, critical entities and domain name registration services (art. 2Α(2) to (4)). The public sector reaches further: central government is in, the wider public sector after a risk assessment, and local public administration subject to the approved list (art. 2Α(2)(στ), 2Α(5)), where the directive leaves the local level optional.

• Classes are conferred by designation: the Authority lists the essential (βασικές) and important (σημαντικές) entities, the Council of Ministers approves the list by a decision classified as secret, and each entity is designated by a Decision of the Authority served on it (art. 27(3), (7) and (8)). An entity in scope that is not on the list must inform the Authority so that it can be assessed (art. 27Β); the law sets no self-registration deadline.

• Operators of essential services and of critical information infrastructure that the Authority designated before 16 January 2023 are essential entities whatever their size (art. 27(1)(α)(vii)): Cyprus adds the critical information infrastructure operators to the directive's former operators of essential services.

• Every significant incident goes to the Digital Security Authority, which forwards it to CSIRT-CY on receipt (art. 35Β(1)(ε)). From becoming aware of it: a first notice (ενημέρωση, the early warning) within six hours, not 24 (art. 35Β(4)(α)); the incident notification within 72 hours, or 24 for trust service providers; the final report one month after the notification; and, for an incident still ongoing then, a progress report every 15 days and the final report within 15 days of the restoration of the affected system (art. 35Β(4)(β) to (ε)).

• Κ.Δ.Π. 281/2026 sets national significance thresholds, among them more than 5,000 user-hours of disruption (20,000 for electronic communications providers), a whole municipality or community affected, five persons seriously injured, or any death; the digital entity types apply the criteria of Implementing Regulation (EU) 2024/2690 instead (Annexes I and III). Entities keep the incident information for 24 months after the final report (art. 9 of the decision).

• Notifications are submitted electronically on a platform the Authority is to put into operation (Κ.Δ.Π. 281/2026, art. 8(3)); none was found announced on the Authority's or CSIRT-CY's sites on 30 October 2026. Where electronic submission is not possible, the entity informs the Authority by telephone to find another way and submits the form as arranged with it (art. 8(3) and (4)).

• The management body (ανώτατη διοίκηση) approves the risk-management measures, oversees their implementation and can be held accountable for the entity's breaches (art. 35Α(1)); its members attend training and offer similar training to their employees on a regular basis, with no frequency set (art. 35Α(3)), where the directive only has Member States encourage the entities to train their staff.

NIS2 in Cyprus: frequently asked questions

Is NIS2 in force in Cyprus?

Yes. Law 60(I)/2025 amended the Security of Networks and Information Systems Law of 2020, Law 89(I)/2020, and entered into force on its publication on 25 April 2025 (art. 57(1)). The one deferred provision deletes the Authority's staffing board and binds no entity (art. 57(2), as corrected on 25 June 2025). The incident decision Κ.Δ.Π. 281/2026 has applied since 3 July 2026, and the European Commission closed its infringement case on 8 October 2025.

How does a Cypriot company learn whether it is an essential or an important entity?

From the Digital Security Authority. It compiles the list of essential and important entities and of domain name registration services, reviewed at least every two years (art. 27(3)); the Council of Ministers approves it by a decision classified as secret (art. 27(7)); and each entity is designated by a Decision of the Authority served on it (art. 27(8)). An entity within the scope of the law that is not on the list must inform the Authority so that it can be assessed (art. 27Β). The Authority's online self-assessment tool is indicative only and does not replace its own criticality assessment.

How fast must a significant incident be notified in Cyprus?

The first notice (ενημέρωση, the early warning) goes to the Digital Security Authority without undue delay and at the latest six hours after becoming aware of the significant incident (art. 35Β(4)(α)), where the directive allows 24. The incident notification follows within 72 hours, or 24 for trust service providers; the final report at the latest one month after the notification; and, for an incident still ongoing then, a progress report every 15 days and the final report within 15 days of the restoration (art. 35Β(4)(β) to (ε)). Κ.Δ.Π. 281/2026 also requires an interim report whenever the information already notified changes materially (art. 4(6)(στ)).

Where does a Cypriot entity file its incident notification?

With the Digital Security Authority, never with CSIRT-CY directly: the Authority forwards each notification to CSIRT-CY on receipt (art. 35Β(1)(ε)). Κ.Δ.Π. 281/2026 has notifications submitted electronically on a platform the Authority is to put into operation (art. 8(3)); none was found announced on 30 October 2026, and where electronic submission is not possible the entity informs the Authority by telephone and submits the form as arranged with it (art. 8(3) and (4)). CSIRT-CY's own published addresses predate the decision and disagree with each other, so Reglyze names none.

Which decisions of the 2020 Cypriot law still apply?

Two stay in force until replaced (art. 55(3)): Κ.Δ.Π. 389/2020, the minimum measures framework of the operators of essential services and of critical information infrastructure (an annual risk assessment, business continuity plans, a dedicated security officer reporting to top management), and Κ.Δ.Π. 245/2024, maturity audits by registered auditors, paid by the audited entity, with the report in Greek. The Authority has not said whether the audit decision reaches the entities designated since 2025. The 2022 incident decision was replaced by Κ.Δ.Π. 281/2026.