DORA for CySEC-regulated investment firms

If you run a Cyprus Investment Firm or another firm that CySEC supervises under DORA, the regulation (Regulation (EU) 2022/2554) has applied to you since 17 January 2025, and the Cyprus Securities and Exchange Commission is your competent authority. In practice: an ICT risk framework reviewed at least once a year, major incidents reported to CySEC through TRS within 4 hours of classification and 24 hours of detection, a register of information filed by 28 February, and a testing programme.

This guide is for Cyprus Investment Firms (CIFs) and the other entities CySEC supervises under DORA. It follows the regulation chapter by chapter and adds what CySEC has published in its circulars, from C700 (April 2025) to C799 (September 2026). If you want the wider picture of the regulation first, start from our DORA compliance page.

Who CySEC supervises under DORA

Article 46 of DORA hands supervision to the authority that already supervises each type of entity. For investment firms it is the authority designated under Directive (EU) 2019/2034, which in Cyprus is CySEC. The Ministry of Finance confirmed the split in a notice published in the Official Gazette on 14 August 2025 (K.D.P. 252/2025). CySEC is the DORA authority for:

• CIFs falling under the Cypriot law on the prudential supervision of investment firms;
• crypto-asset service providers authorised by CySEC under MiCA, and issuers of asset-referenced tokens authorised by CySEC;
• central securities depositories, central counterparties and trading venues under its supervision;
• alternative investment fund managers, UCITS management companies and crowdfunding service providers authorised by CySEC.

Credit institutions (other than significant ones, which answer to the ECB), payment institutions and e-money institutions sit with the Central Bank of Cyprus. If a group has entities supervised by both authorities, check the same notice: Article 19(1) of DORA asks Member States to name a single authority for incident reporting when an entity answers to more than one, and the notice assigns that role.

Proportionality: Class 3 firms and microenterprises

Not every CIF carries the same load. Under Article 16, small and non-interconnected investment firms (CySEC calls them Class 3) are exempt from Articles 5 to 15 and apply a simplified ICT risk management framework instead, detailed in Title III of Delegated Regulation (EU) 2024/1774. Microenterprises are exempt from several requirements, including the independent ICT risk control function and the testing programme. Check your classification before you size the work.

ICT risk management: what CySEC has asked for (Articles 5 to 16)

The management body defines, approves and oversees the ICT risk management framework and bears the ultimate responsibility for ICT risk (Article 5(2)). Below the board, Article 6 sets four mechanics that CySEC repeated almost word for word in Circular C751 of 19 January 2026:

• A control function for ICT risk, independent enough to avoid conflicts of interest, separated from ICT operations and internal audit according to the three lines of defence model or an equivalent one (Article 6(4)).
• A yearly review of the framework, plus a review after a major ICT-related incident, after supervisory instructions or after relevant test and audit findings (Article 6(5)). CySEC can request the review report, and C751 says it should follow Chapter V of Delegated Regulation (EU) 2024/1774.
• Internal audit of the framework by auditors with ICT risk expertise and appropriate independence, at a frequency matched to your ICT risk (Article 6(6)).
• A formal follow-up process to verify and remediate critical ICT audit findings in good time (Article 6(7)).

C751 adds two practical steps in the CySEC Portal: designate the ICT auditor under the Auditors section, selecting the "Is ICT" option (required of entities other than microenterprises), and designate under Personnel the person responsible for the ICT risk control function.

Circular C786: frontier AI models

On 17 June 2026 CySEC issued C786 on the cyber risk posed by frontier AI models that can find and exploit software vulnerabilities quickly and at scale. It is framed as a reminder of existing DORA obligations: CySEC asks entities, in proportion to their size and complexity, to check whether their ICT risk arrangements are still adequate, and lists areas to look at: vulnerability and patch management (with attention to legacy systems), identity and access management, the readiness of ICT providers, detection and response times, backups that are segregated and tested under realistic conditions, and AI-related risk reflected in ICT risk assessments.

Major ICT-related incidents: classify, then report (Articles 17 to 23)

Every ICT-related incident is recorded and classified with the criteria of Article 18 and Delegated Regulation (EU) 2024/1772. Under Article 8 of that regulation, an incident is major when it has affected critical services and either a successful, malicious and unauthorised access to your systems that may lead to data losses has occurred, or at least two of the other materiality thresholds are met. One of those thresholds is economic: costs and losses above, or likely to exceed, EUR 100,000. Incidents that recur at least twice in six months with the same apparent root cause, and together meet the criteria, count as one major incident; this check runs monthly and does not apply to microenterprises or Class 3 firms.

Classification is where CySEC has found problems. In C751 it reported that some incidents that should have been reported as major were not, while others were reported as major without meeting the criteria. Its instruction is to work carefully through Delegated Regulation 2024/1772, together with the classification diagram discussed in the ESAs' final report on those standards.

The three reports and their time limits

Delegated Regulation (EU) 2025/301 (Article 5) sets the clock, and CySEC restated it in Circular C700:

1. Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after you became aware of it.
2. Intermediate report: within 72 hours of the initial notification, even if nothing has changed, with an update when regular activities have been recovered.
3. Final report: within one month of the intermediate report, or of the latest updated one.

If a time limit falls on a weekend or bank holiday, Article 5(4) allows submission by noon of the next working day. That relief does not cover initial notifications and intermediate reports from operators of trading venues, central counterparties, credit institutions and entities that are essential or important under NIS2. If a major incident affects clients' financial interests, Article 19(3) also requires you to inform them without undue delay.

How to file with CySEC

• Reports go through CySEC's TRS system only, not by email, and the Excel files are not digitally signed (C700, C784).
• Since 10 June 2026 CySEC requires the V1.3 templates of the ESAs' incident reporting package (C784). The file naming convention has not changed.
• A submission counts only when the TRS returns a feedback file with a NO ERROR indication.
• Significant cyber threats can be notified on a voluntary basis, with a separate template through the same channel.

There is also a yearly report. With C735 CySEC adopted the ESAs' Joint Guidelines on aggregated annual costs and losses from major incidents, and C799 (8 September 2026) set the filing: by 30 June of the year after the reference year, through the CySEC Portal, only if you had major incidents. For incidents that occurred in 2025, the date was 30 September 2026.

Detection is the step that makes the four-hour window workable: you cannot classify an incident you have not seen. If your monitoring does not cover all systems behind critical functions, start there (our cybersecurity services cover monitoring and incident response).

Digital operational resilience testing (Articles 24 to 27)

Every entity other than microenterprises keeps a risk-based testing programme as part of the ICT risk framework (Article 24). Two points carry most of the work:

• appropriate tests on all ICT systems and applications supporting critical or important functions at least once a year (Article 24(6));
• tests run by independent parties, internal or external, with conflicts of interest avoided if the tester is internal (Article 24(4)).

Article 25 lists the kinds of tests: vulnerability assessments and scans, network security assessments, source code reviews where feasible, scenario-based tests, end-to-end testing and penetration testing, among others.

Threat-led penetration testing (TLPT) is a different matter. It is required at least every three years only from entities the authority identifies (Article 26). Delegated Regulation (EU) 2025/1190 lists who is in by default, unless the assessment says otherwise: central securities depositories, central counterparties and trading venues with an electronic trading system above market-share thresholds, among others. Investment firms are not on that default list; the authority can still identify one on the basis of size, interconnectedness, substitutability of its services and ICT risk profile (Article 2(1)). Class 3 firms and microenterprises are outside TLPT.

ICT third parties and the register of information (Articles 28 to 30)

Outsourcing ICT does not move responsibility: you remain fully responsible for DORA compliance (Article 28(1)). From there, the main obligations are:

• a register of information covering all contractual arrangements for ICT services, at entity level and at sub-consolidated and consolidated level, distinguishing those that support critical or important functions (Article 28(3)), in the templates of Implementing Regulation (EU) 2024/2956;
• timely information to CySEC on any planned arrangement for ICT services supporting critical or important functions, and when a function becomes critical or important (Article 28(3));
• contracts with the minimum clauses of Article 30(2), and for critical or important functions the additional ones of Article 30(3): precise service levels, notice and reporting duties, contingency plans, participation in TLPT, exit terms;
• exit strategies for services supporting critical or important functions, with documented plans that are tested and reviewed (Article 28(8)).

Filing the register with CySEC

The register is due every year by 28 February, with reference date 31 December of the previous year (C700, confirmed in C751). CySEC now accepts it only in XBRL-CSV (C751, recalling C719), the format accepted by the European Banking Authority, generated with software that validates against EBA rules, zipped and uploaded through the CySEC XBRL Portal. The old "Build in Excel" file is no longer accepted. C700 also sets the level: individual entity, or the highest level of consolidation in the Union for groups. CySEC forwards the registers to the ESAs.

The CySEC DORA calendar for a CIF

• By 28 February: register of information, reference date 31 December (C700, C751).
• By 30 June: report on aggregated annual costs and losses, only if you had major incidents in the reference year (C799).
• 1 to 15 September: self-categorisation for the annual DORA fee, with payment by 30 November (C731).
• At least once a year: review of the ICT risk framework and tests on systems supporting critical or important functions (Articles 6(5) and 24(6)).
• Whenever a major incident occurs: initial notification, intermediate and final report through TRS.

Questions to take to the board

1. Who holds the ICT risk control function, and is that person designated in the CySEC Portal together with the ICT auditor?
2. When did we last apply the 2024/1772 criteria to a real incident, and would we have reached the same conclusion CySEC would?
3. Can we classify and notify a major incident within four hours, including at weekends if the relief does not apply to us?
4. Does the register cover every ICT contract, and does it pass EBA validation in XBRL-CSV before 28 February?
5. Which systems behind critical or important functions were tested this year, by whom, and what is still open?

In short

For a CySEC-regulated firm, DORA is the EU regulation plus a short list of CySEC instructions on channels, formats and dates: TRS and V1.3 templates for incidents, XBRL-CSV for the register, the Portal for the ICT auditor and the ICT risk function. Most findings start from classification and from registers that do not match the real contracts.

If you want an outside view of where your firm stands against DORA and CySEC's circulars, talk to our team.