NIS2by country

NIS2 in Cyprus

Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2020 (Ν. 89(Ι)/2020), όπως τροποποιήθηκε από τον Ν. 60(Ι)/2025

Law in force since

Law
NIS Law 89(I)/2020
Authority
Digital Security Authority
Classes
βασική οντότητα (essential), σημαντική οντότητα (important)
Register
Digital Security Authority list
ISO 27001
Not named in the law
Self-check
DSA NIS2 criticality self-assessment (non-binding)

Check your company for Cyprus

Know when Cyprus changes its NIS2 rules

  • One email when the law, the deadlines or the portal change.

This site stores your email and emails you when the NIS2 rules in Cyprus change. Unsubscribe at any time.

The law

The House of Representatives voted the amending Law 60(I)/2025 on 2025-04-10. The Official Gazette published it on 2025-04-25. It took effect on the day of publication. Article 7 takes effect on a date that the Council of Ministers will set by notice. The amendment rewrites the 2020 Law to follow the Directive.

Name
Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2020 (Ν. 89(Ι)/2020), όπως τροποποιήθηκε από τον Ν. 60(Ι)/2025Network and Information Systems Security Law of 2020, as amended in 2025
Published
2025-04-25
In force
2025-04-25
Text
Read the NIS Law 89(I)/2020

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Cyprus differs

  • Art. 27(1)(a)(ii)-(iii) NIS Law Trust service providers, TLD registries and DNS providers are essential at any size. Medium public electronic communications providers are essential.
  • Art. 2A(2) NIS Law Entities of any size are in scope when they are sole providers, or when a disruption affects public safety, public health or systemic risk.
  • Art. 2A(1)(b) NIS Law The size test ignores the partner and linked-enterprise rule of Recommendation 2003/361/EC (Art. 3(4)).
  • Art. 2A(2)(f) and 2A(5) NIS Law Central government bodies are in scope. Local public bodies are also in scope. Wider public sector bodies are in scope after a risk assessment.
  • Art. 2A(4) NIS Law Domain name registration service providers are in scope at any size.

Also note

  • The Law lists essential entities in Art. 27(1) and defines important entities as all other entities in Annex I or II.
  • The Law plans to merge the Authority with the electricity regulator (ΓΕΡΗΕΤ) under a later law.

Registration

Cyprus has no registration portal. The Authority builds the list of essential and important entities itself. It reviews the list at least every 2 years. The Law sets no registration period. Each listed entity sends its data to the Authority on request. The Authority may set national mechanisms for self-registration. An entity reports a change at once, and within 2 weeks at the latest. An entity in scope but missing from the list must tell the Authority so that it can assess the entity. The Authority can also name more entities as essential after a criticality assessment. A self-assessment tool at nis2.dsa.cy gives a non-binding result.

Portal
Digital Security Authority list
Rule
The law sets no fixed period
You need
Name, address and contact data, IP ranges, sector and sub-sector, and the Member States where you serve. This is sent when the Authority asks.
Changes
Report changes to your data within 14 days

Incident reporting

  1. 6 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to the Digital Security Authority, which passes the report to the national CSIRT.

Cyprus sets an early warning at 6 hours. The Directive sets 24 hours. Trust service providers report within 24 hours. An interim report follows on request. In an ongoing incident, a progress report is due every 15 days. The final report is due 15 days after recovery. The Authority sets the form by a Decision.

Measures and proof

Essential
The Authority can run regular and targeted security audits itself, or through an independent body it authorises. It can ask for evidence such as audit results. The entity pays for a targeted audit by an independent body. The Law sets no audit cycle.
Important
The Authority acts after the event. It can order targeted security audits by an independent body or authority. The entity pays for such an audit. The Law sets no audit cycle.

The dates, in order

  1. The House of Representatives votes the amending law
  2. Publication and entry into force

Duties of management

Top management approves the risk measures and oversees them. Members can be held liable for a breach. Members must take training and offer training to staff on a regular basis. For an essential entity, the Authority can ask for a temporary ban on a chief executive or legal representative.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 43A NIS Law 89(I)/2020. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The Law uses the wording of the Directive: a maximum of at least EUR 10,000,000 or 2% (essential) and EUR 7,000,000 or 1.4% (important). The higher amount applies. The % applies to the undertaking the entity belongs to. Fines come on top of enforcement measures. The Authority can set other sanctions by Decision.