NIS2 obligations in Cyprus

Competent authority & CSIRT Legal ref: Art. 30, 31

• Digital Security Authority (DSA). ecs-org.eu · 28 Oct 2026 · secondary source
• National CSIRT-CY (part of DSA). ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 2A, Annexes I and II

• Entities in scope that fall within the sectors and sub-sectors of Annexes I and II and will be defined as either essential or important entities in alignment with NIS2. The banking sector remains within the scope for national strategy purposes, cooperation on large-scale incidents and for assistance from CSIRT in the event of an incident but is not subject to supervision by the Digital Security Authority. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 27

• Essential and important entities will be identified by the Digital Security Authority following a national criticality assessment. The final list of entities will be approved by the Council of Ministers. Following the identification of the essential and important entities, the said entities will have to provide to the Digital Security Authority the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Address and up-to-date contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 35B

• Early warnings must be submitted by entities to the Competent authority within 6 hours of detecting the incident.. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident reports must be submitted within 72 hours and trust services providers must submit an incident report within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim reports (if the incident is still ongoing) no later than 15 days after sending the incident report and a final report which is submitted within 15 days of the restoration of the operation of the network or information system that was affected. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim reports at the request of the Competent Authority. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2 with higher threshold for early warnings and additional requirement for interim report for ongoing incidents. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 43, 43A

• Up to 200.000 EUR for doing or omitting to do any act that is in breach of the legislation and 10.000 EUR additional fine for every day of continuing the breach (Art. 43). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 300.400 EUR for doing or omitting to do any act that is in breach of a Decision or Regulation of the European Union and 200.000 EUR additional fine for every day of continuing the breach (Art. 43). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover for breach of Art. 35 and 35(B) (essential entities) (Art. 43A). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover Art. 35 and 35(B) (important entities) (Art. 43A). ecs-org.eu · 28 Oct 2026 · secondary source
• Apart from the abovementioned administrative fines, criminal penalties may be imposed for national law violations. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 35

• National security measures framework is as per NIS2 Directive. The published security measures secondary legislation includes mapping that corresponds to ISO 27001, NIST SP 800-53 and NIS CG guidelines and will be amended within 2025 to align with the NIS2 requirements. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Cyprus requires structured, risk-based assessments covering all critical IT/OT systems, cloud infrastructure, and third-party services. While no specific methodology is mandated, annual reviews are expected to be conducted. Entities must prepare for inspections and documentation checks by the Digital Security Authority. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Primary Law

What changed recently

No dated changes recorded.