ITER/CYCyprus
What the record establishes for Cyprus: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Office of the Commissioner for Personal Data Protection reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The relevant competent authority or the National CSIRT, as the guide puts it reported | There is no portal. The national CSIRT states it plainly: «Μπορείτε να αναφέρετε ένα περιστατικό χρησιμοποιώντας την ηλεκτρονική φόρμα αναφοράς, στέλνοντας την κατάλληλα συμπληρωμένη φόρμα υποβολής περιστατικού στην ηλεκτρονική διεύθυνση REPORTING@CSIRT.CY ή να μας τηλεφωνήσετε στο 1490»: a form, an address, and a telephone number. | cy dsa nis2 guide, csirt cy anafora |
| Financial supervisorDORA, article 19 | Central Bank of Cyprus reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Επιτροπή Κεφαλαιαγοράς (CySEC) reported | — | esma mar nca |
Transposition of NIS2 reported
| Act | Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών (Τροποποιητικός) Νόμος του 2025, Ν. 60(Ι)/2025, amending Ν. 89(Ι)/2020 |
|---|---|
| In force | 25 April 2025, the date of publication in the Official Gazette, by article 57(1); article 7 commences on a date the Council of Ministers sets |
| Recipient | The Αρχή, the Digital Security Authority, to which subsection (4) owes the submissions |
| Moves a term | Yes. The first term is six hours. Subsection (4)(α) owes the early warning «εντός έξι (6) ωρών από τη στιγμή που αντιλήφθηκαν το σημαντικό περιστατικό», where the Directive gives twenty-four. The second stage keeps the Directive's «εντός εβδομήντα δύο (72) ωρών» on the same footing, trust service providers have twenty-four hours, and the Authority owes a response within twenty-four hours of the early warning. The anchor is the entity having perceived the incident, αντιλήφθηκαν, the Greek text's word for becoming aware. |
| Standing | Read in the amending law as gazetted. The six hours the Authority's guide shows are the law's own, not a reading of the Directive. The final report's term was not read in this pass. |
| Source | cy dsa nis2 guide |
An event in Cyprus
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.