NIS2 in Greece: the legal side of cybersecurity compliance.

Who is in scope

Law 5160/2024 (Government Gazette A' 195, 27 November 2024) applies to public and private entities in the sectors listed in its two annexes that are at least medium-sized under the EU SME definition, meaning 50 or more employees, or both annual turnover and balance sheet total above 10 million euros. The high-criticality sectors in Annex I are energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. The other critical sectors in Annex II are postal and courier services, waste management, chemicals, food production and distribution, manufacturing, digital providers and research.

Some entities are covered whatever their size, including providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers. Large entities in Annex I sectors are essential entities, as are certain other categories named in the law; the remaining in-scope entities are important entities. Financial entities covered by the EU DORA Regulation follow that Regulation for risk management and incident reporting instead.

What the law requires

Entities in scope submit their details, including domain names and IP ranges, to the National Cybersecurity Authority through the digital platform. The original deadline was two months from the law's entry into force and has passed, so a company that has not registered should do so now. Changes to the registered details must be notified within two weeks.

The management body approves the cybersecurity risk-management measures, oversees their implementation and is responsible for breaches. Its members must follow training, and staff must receive similar training at least once a year. The measures must cover, at a minimum, risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control, asset management, and multi-factor authentication where appropriate.

The company designates a ΥΑΣΠΕ, whose duties are incompatible with those of the data protection officer, keeps a single cybersecurity policy and an inventory of its information and communication assets. Essential entities submit the single policy to the Authority for approval at least once a year.

A significant incident is reported to the Authority's CSIRT in stages: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. Where appropriate, the recipients of the company's services must also be informed. The law states that the act of notification does not in itself make the company liable.

Supervision, penalties and management liability

Essential entities are subject to proactive supervision, including on-site inspections and regular security audits. Important entities are supervised after the event, when there is evidence that they may not be complying.

For breaches of the risk-management or incident-reporting duties, essential entities face fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher, and important entities up to 7 million euros or 1.4%. Separate fines apply where management fails to approve and oversee the measures or to follow training. If an essential entity does not remedy deficiencies within the deadline set, the Authority may temporarily prohibit the chief executive or legal representative from exercising managerial functions. Fines can be challenged by an application for annulment before the competent Administrative Court of Appeal.