Checked on September 27, 2026
NIS2 in Cyprus
How Cyprus applies the NIS2 cybersecurity directive: the national law, who supervises, and how to register and report incidents.
- Transposition status
- In force
- National law
- Security of Networks and Information Systems (Amendment) Law of 2025 (amending Law 89(I)/2020) · Law 60(I)/2025 · from April 25, 2025
- Competent authority
- Digital Security Authority (DSA) (Αρχή Ψηφιακής Ασφάλειας)
- National CSIRT
- National CSIRT-CY (under the DSA)
- Registration
- See note
The DSA identifies and lists essential and important entities; no self-registration portal or deadline confirmed.
- Incident reporting
- Significant incidents to CSIRT-CY: early warning 24h, notification 72h, final report 1 month per Directive.
- National specifics
- The Commissioner of Communications also has a supervisory role for certain sectors.
Where does your company stand?
The free assessment applies these national rules to your answers and scores every area of the law.
Sources
National laws and portals change. This page is general information, not legal advice; confirm with the authority before relying on it.