NIS2 in Cyprus: national law, DSA and 6-hour reporting

NIS2 applies in Cyprus through the Security of Networks and Information Systems Law 89(I)/2020, as amended by Law 60(I)/2025, in force since its publication in the Official Gazette on 25 April 2025. The Digital Security Authority (DSA) supervises it, and the national CSIRT sits inside the DSA. The detail that changes daily operations: a significant incident needs an early warning to the DSA within 6 hours, not the 24 hours set by the directive.

This article is for organisations based in Cyprus, or groups with a Cypriot subsidiary, that need to know where the Cypriot text goes further than Directive (EU) 2022/2555. For the wider picture, see our NIS2 page. We quote the DSA's consolidated English version, which is informative only: the Greek text in the Official Gazette is authoritative, and we checked every key point against it.

Which law transposes NIS2 in Cyprus

Cyprus did not write a new act. It amended the law that had transposed the first NIS Directive, Law 89(I)/2020, with the Security of Networks and Information Systems (Amending) Law of 2025, Law 60(I)/2025. According to the DSA's announcement, the House of Representatives passed it on 10 April 2025. It was published in the Official Gazette, issue 5036, on 25 April 2025 and, under its article 57, entered into force on publication, except for one provision whose start date is set by the Council of Ministers.

The article numbers differ from the directive, which matters when you map controls and evidence:

• Article 2A of the Cypriot law sets the scope (directive, article 2).
• Article 27 identifies essential and important entities and the list kept by the DSA (directive, article 3).
• Article 35 lists the cybersecurity risk-management measures (directive, article 21).
• Article 35A covers governance and management bodies (directive, article 20).
• Article 35B sets the reporting obligations (directive, article 23).
• Article 43A sets the administrative fines (directive, article 34).

Who supervises: the Digital Security Authority and CSIRT-CY

The Digital Security Authority is the competent national authority and the single point of contact. It was established under the 2018 law on the security of networks and information systems and is headed by the Commissioner for Communications. The national CSIRT, CSIRT-CY, is part of the DSA and works under its instructions and supervision (article 6 of the law).

In practice this means one counterpart. Under article 35B, essential and important entities notify significant incidents to the Authority, which forwards them to the national CSIRT on receipt. The directive lets each Member State choose between the CSIRT and the competent authority as recipient; Cyprus chose the Authority.

Who is in scope

The scope follows the directive. Article 2A applies the law to public or private entities of the types listed in Annex I (sectors of high criticality) and Annex II (other critical sectors) that qualify as medium-sized enterprises or exceed those thresholds under Commission Recommendation 2003/361/EC, and that provide services or carry out activities in the EU. Some are covered regardless of size, such as public electronic communications providers, trust service providers, DNS and TLD services, critical entities and central government.

Essential or important

Article 27 sorts the entities in scope into two classes:

• Essential entities: among others, Annex I entities above the medium-sized thresholds, qualified trust service providers, TLD registries and DNS providers of any size, central government and critical entities.
• Important entities: Annex I or II entities in scope that do not qualify as essential.

There is a Cypriot transitional rule worth checking. Organisations that the DSA identified before 16 January 2023 as operators of essential services or of critical information infrastructure, under the Commissioner's decisions of 17 August 2020 and 8 November 2021, count as essential entities. Those decisions stay in force until they are replaced after a criticality assessment.

The practical difference between the two classes is supervision. In its announcement on the transposition, the DSA explains that essential entities are subject to full ex ante and ex post supervision, while important entities are supervised ex post only. The obligations on measures and reporting are the same for both.

The list is confidential, so do not wait to find yourself on it

The DSA draws up the list of essential and important entities and reviews it at least every two years. The list is approved by the Council of Ministers, is confidential and is not published in the Official Gazette (article 27(7)). Each entity is then designated by a DSA decision served on it (article 27(8)).

Two consequences follow. First, there is no public register to check. Second, the law puts the initiative on you: under article 27B, entities that fall within scope but were not included in the list inform the Authority so that it can assess them. Newly created entities that may be essential or important are expected, under article 27A, to seek the DSA's guidance on security by design for their infrastructure. To draw up the list, the DSA asks these entities for their name, address and contact details including IP ranges, their sector and the Member States where they provide services, and any change is reported within two weeks (article 27(4)).

The DSA's online self-assessment tool, launched in April 2025, gives a first indication of whether you fall under NIS2. It is a starting point, not a legal opinion.

Groups with entities in more than one country

Under article 26 of the directive, an entity normally falls under the jurisdiction of the Member State where it is established. A Cypriot subsidiary of an Italian, Greek or British group therefore answers to the DSA for what it does in Cyprus. The main exception covers cloud computing, data centre, content delivery network, managed service and managed security service providers, DNS and domain name services, online marketplaces, search engines and social networking platforms: they fall under the Member State of their main establishment in the Union, which is where decisions on cybersecurity risk management are predominantly taken. Providers of public electronic communications networks or services fall under the Member State where they provide their services.

What the law requires

Risk-management measures (article 35)

Article 35 reproduces article 21 of the directive: proportionate measures, based on an all-hazards approach, covering at least:

• risk analysis and information system security policies;
• incident handling;
• business continuity, backup, disaster recovery and crisis management;
• supply chain security;
• secure acquisition, development and maintenance, including vulnerability handling;
• assessing the effectiveness of the measures;
• basic cyber hygiene practices and cybersecurity training;
• cryptography and, where appropriate, encryption;
• human resources security, access control and asset management;
• multi-factor or continuous authentication and secured communications, where appropriate.

The DSA may detail the measures in a decision. For cloud, data centre, managed service and managed security service providers and the other digital providers it lists, Commission Implementing Regulation (EU) 2024/2690 already sets the technical requirements, and article 35(5) tells the DSA to apply the Commission's implementing acts.

Management bodies (article 35A)

The management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements of article 35. On training, the Cypriot text goes a step beyond the directive. Article 20(2) of the directive requires members of management bodies to follow training and asks Member States to encourage entities to offer similar training to employees. Article 35A(3) of the Cypriot law, in the Greek text as well, places on the members of the management body both the duty to attend training and the duty to offer similar training to their staff on a regular basis.

Incident reporting: the 6-hour early warning

Article 35B follows the structure of article 23 of the directive, with a much shorter first step. For a significant incident, the entity submits to the DSA:

1. An early warning within 6 hours of becoming aware of the incident, stating where applicable whether it is suspected to be caused by unlawful or malicious acts or could have a cross-border impact. The directive allows 24 hours.
2. An incident notification within 72 hours, updating the early warning with an initial assessment of severity and impact and, where available, indicators of compromise.
3. An intermediate report when the DSA requests one.
4. A final report no later than one month after the incident notification, with a detailed description, the likely root cause, the mitigation measures and any cross-border impact.
5. If the incident is still ongoing at that point, a progress report every 15 days, and the final report within 15 days of restoring the affected system.

Trust service providers notify within 24 hours. An incident is significant if it causes, or can cause, severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others.

Decision 281/2026 on incident notification

The procedure is set out in the Security of Networks and Information Systems (Notification of Incidents) Decision of 2026, P.I. 281/2026, published in the Official Gazette on 3 July 2026 and in force from that date. It replaces the 2022 decision on the same subject and adds operational points:

• reports use the form in Annex II of the decision and are submitted electronically on a platform that the DSA is to put into operation; if the platform cannot be used, the form is submitted in a way agreed with the DSA;
• without undue delay means as soon as possible: an entity able to report does not wait for the 6-hour limit, and internal procedures or contractual obligations do not justify a delay;
• entities give the DSA the name, landline and mobile numbers reachable 24/7 and email address of the people responsible for notifications, within 20 working days of the decision's entry into force or of their designation, and report changes within 10 working days;
• information relating to a notification is kept for 24 months after the final report.

Six hours is short enough that the clock shapes the organisation. Someone has to detect the event, judge whether it is significant and send the warning, at night and at weekends too. That only works if continuous monitoring, a severity triage and the name of the person who signs the report are settled before the incident, not during it.

Supervision and penalties

Article 43A transposes the ceilings of the directive. For infringements of article 35 or 35B:

• essential entities: fines up to at least EUR 10 million or 2% of the total worldwide annual turnover of the undertaking in the previous financial year, whichever is higher;
• important entities: fines up to at least EUR 7 million or 1.4% of that turnover, whichever is higher.

The Cypriot law also keeps criminal offences (article 44). An essential or important entity that fails to notify, without undue delay, an incident with a severe impact on the continuity of its essential services is liable on conviction to up to two years' imprisonment, a fine of up to EUR 10,000, or both. Failing to take appropriate and proportionate risk-management measures carries up to three years' imprisonment, a fine of up to EUR 15,000, or both.

One cost item is still being defined. Under article 11 the DSA is financed by essential and important entities through fees set by regulations. A draft of new Fees Regulations, meant to replace the 2020 ones, went to public consultation in January 2026.

Financial entities: DORA comes first

Banks, investment firms, payment and e-money institutions and the other financial entities covered by Regulation (EU) 2022/2554 follow DORA for ICT risk management, incident reporting and resilience testing. Recital 28 of the NIS2 Directive names DORA as the sector-specific act for financial entities, and article 2A(9) of the Cypriot law steps aside where such an act is at least equivalent in effect.

Where to start

1. Check scope. Sector and sub-sector in Annex I or II, size under Recommendation 2003/361/EC, and any size-independent rule. If you are in scope and have not heard from the DSA, inform it under article 27B.
2. Set up the reporting chain. Decide who judges an incident significant, who sends the 6-hour warning, and file the 24/7 contacts required by Decision 281/2026.
3. Run a gap analysis on the ten measures of article 35, mapped to a framework you can audit. Many organisations use ISO/IEC 27001 as the backbone, because its controls address many of the same areas.
4. Brief and train the management body, and plan the regular staff training that article 35A(3) requires.
5. Review suppliers. Contracts, security clauses and the incident information you need from them to report within 6 hours.

If you want a second view on scope, on the 6-hour reporting chain or on the gap analysis, get in touch with our team.