ITER/ISIceland
What the record establishes for Iceland: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Persónuvernd reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The cybersecurity team, netöryggissveit, operated by the telecommunications authority reported | https://island.is/tilkynna-oryggisatvik-til-cert-ischecked 2026-09-11 Not set by the act. The cybersecurity team takes notifications on its own reporting page, through an application form on island.is, and at cert@cert.is. The service page adds what the act does not: «ef um skyldutilkynningu er að ræða ... verður tilkynningin send áfram til viðeigandi eftirlitsstjórnvalds»: a mandatory notification is passed on to the relevant supervisory authority. | is log 78 2019 · island is tilkynna |
| Financial supervisorDORA, article 19 | Central Bank of Iceland reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Central Bank of Iceland reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Lög nr. 78/2019 um öryggi net- og upplýsingakerfa mikilvægra innviða |
|---|---|
| In force | 1 September 2020 |
| Recipient | The cybersecurity team, netöryggissveit, operated by the telecommunications authority |
| Moves a term | Yes. There are no hours. Article 8 requires notification «svo fljótt sem verða má», as soon as may be, for serious incidents or risks threatening the security of network and information systems, and sets no interval at all. There is no early warning at twenty-four hours, no notification at seventy-two, and no final report at one month. The act does not cite Directive (EU) 2022/2555 anywhere. |
| Standing | Read in the consolidated act on the Althingi's site. Iceland is in the EEA and the NIS2 Directive is not what this act implements; the regime in force is the earlier one. An organization applying the ITER cascade in Iceland is applying terms that Icelandic law does not contain. |
| Source | is log 78 2019 |
An event in Iceland
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.