NIS2 in Greece: What Law 5160/2024 Requires of Essential and Important Entities
NIS2 is not an IT law. It is a law for management, with personal liability, mandatory training and reporting deadlines measured in hours. Most Greek companies in scope know this. Fewer can prove it.
From Directive to law
Directive (EU) 2022/2555, known as NIS2, replaced the first NIS Directive and widened the circle of obliged entities dramatically. In Greece it was transposed by Law 5160/2024 (Government Gazette A’ 195/27.11.2024). The competent authority is the National Cybersecurity Authority (ΕΑΚ), which also acts as the single point of contact for cross-border cooperation, while incident reports go to its CSIRT.
The fundamental change compared with the past is not technical. It is that the law addresses the entity’s management body, makes it responsible for the measures, requires it to be trained and provides for personal consequences in case of non-compliance.
Who is in scope
The law follows the Directive’s logic: any entity operating in a sector of Annex I or II that is at least a medium-sized enterprise under Recommendation 2003/361/EC is in scope, meaning 50 or more employees, or annual turnover and balance sheet total above €10 million.
Essential entities are, as a rule, large enterprises in Annex I sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure (telecoms, cloud, data centres), ICT service management, public administration, space. Regardless of size, DNS providers, TLD registries and trust service providers are essential, as are entities that had been designated operators of essential services under NIS1.
Important entities are medium-sized enterprises in Annex I and medium and large enterprises in Annex II: postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, machinery, vehicles), digital providers (online marketplaces, search engines, social networks) and research organisations.
The Authority can also designate entities below the size threshold on qualitative criteria, where disruption of their service would have significant impact.
Financial sector
Financial entities covered by the DORA Regulation (EU 2022/2554) are exempt from the risk management, incident reporting and supervision provisions of Law 5160/2024. DORA acts as lex specialis. In practice, an insurer or a bank will find the equivalent obligations in DORA, with a similar architecture but different details and a different supervisor.
The first practical obligation was registration in the Authority’s register (nis2register.cyber.gov.gr), with details such as tax number, commercial registry number, legal representative, type of services, IP ranges and domain names. The initial 2025 deadlines have passed. An entity in scope that has not registered must do so without delay, and any change of details requires a new submission.
What management owes
The point that sets NIS2 apart from every previous cybersecurity framework is the governance article. The entity’s management body:
- approves the cybersecurity risk management measures and oversees their implementation,
- is liable for infringements, with the possibility of a temporary ban on exercising managerial functions for natural persons with CEO or legal representative responsibilities,
- is required to undergo training in cybersecurity, so that it can identify risks and assess practices, and to encourage equivalent training of staff.
The Greek law adds a role: each entity appoints an Information and Communication Systems Security Officer (ΥΑΣΠΕ), who is the point of contact with the Authority and oversees compliance. This is not necessarily the CISO and it is not merely a technical role.
In practice, this means that in an audit the Authority will ask for board minutes approving the policy, training records of its members and the appointment decision for the ΥΑΣΠΕ. If cybersecurity remains “an IT matter” that has never passed through the board, the gap is visible from the first question.
The ten mandatory measures
The law, following Article 21 of the Directive, requires appropriate and proportionate technical, operational and organisational measures covering at least:
- Risk analysis and information system security policies
- Incident handling
- Business continuity, including backup management and disaster recovery
- Supply chain security, including relationships with suppliers and service providers
- Security in acquisition, development and maintenance of systems, including vulnerability handling
- Policies to assess the effectiveness of the measures
- Basic cyber hygiene practices and training
- Cryptography policies
- Human resources security, access control policies and asset management
- Multi-factor authentication and secure communications
The Greek law adds two elements not obvious from the Directive. First, the entity maintains a single cybersecurity policy, submitted to the Authority at least annually. Second, it maintains a complete inventory of physical and digital ICT assets, classified by criticality.
For anyone who has worked with ISO 27001, the list is familiar. The difference is that here it is not an optional standard but law, and that responsibility for applying it does not stop at the security officer.
Incident reporting: 24 hours, 72 hours, one month
A significant incident is one that causes or can cause serious disruption of the service or financial loss to the entity, or affects third parties with considerable material or non-material damage. Reporting to the Authority’s CSIRT happens in stages:
- Within 24 hours of becoming aware: early warning, indicating whether unlawful or malicious action is suspected and whether there is cross-border impact.
- Within 72 hours: incident notification, with an initial assessment of severity and impact and, where available, indicators of compromise.
- On request: intermediate updates.
- Within one month of the notification: final report, with detailed description, type of threat, root cause, mitigation measures and any cross-border impact.
The 24-hour problem
Twenty-four hours is very little time for an organisation that has not decided in advance who judges whether an incident is "significant", who signs the report and who submits it. If those decisions are made for the first time on the night of the incident, the deadline is missed. The procedure must exist in writing, tested, with deputies.
Supervision and fines
For essential entities supervision is proactive: regular and ad hoc security audits, on-site and off-site inspections, requests for information and access, binding instructions. For important entities it is reactive, triggered by indications of non-compliance, but with the same tools.
Administrative fines reach up to €10 million or 2% of worldwide annual turnover for essential entities and up to €7 million or 1.4% for important ones, whichever is higher. Beyond fines, the law provides for suspension of certifications or authorisations and the temporary management ban mentioned above.
What we see in practice
From conversations with organisations in scope, the problem is rarely ignorance. It is the distance between “we have measures” and “we can prove it”. Three gaps recur.
Documentation is scattered. The policy is in a Word file, the inventory in an Excel, the board minutes with Legal, the training records with HR, the supplier contracts with Procurement. None of this is wrong. But in an audit, the question “show me that measure 4 is applied” takes a week to answer.
The supply chain is ignored. Measure 4 asks you to assess the security of your suppliers. Most organisations have contracts with confidentiality clauses, but no risk assessment per supplier and no security requirements in the contracts. When the cloud provider, the integrator and the security guard company all have access to systems, “we have an NDA” is not an answer.
Management training has not happened. Or it happened as a ten-minute briefing at a board meeting, without a record. It is the easiest obligation to cover and the first that will be requested.
The link to the other frameworks
NIS2 is not the only framework asking for risk management, training, supplier assessment and incident reporting. DORA asks the same of the financial sector. The Cyber Resilience Act asks it for products with digital elements. GDPR asks for breach notification within 72 hours. The AI Act asks for governance and training around AI systems. For an organisation subject to two or three of these, keeping a separate documentation system for each is the surest way to end up with contradictions.
That observation is the starting point of Provenly: one core of controls, assets, suppliers and evidence, from which the documentation for each framework is produced separately. The supply chain security measure is recorded once and appears in NIS2, DORA and GDPR wherever it is needed.
Where to start
If your entity is in scope and you do not have a structured programme, the order we suggest is: confirm your category and register, if not done; a board decision approving the policy and appointing the ΥΑΣΠΕ; management training with a record; a gap analysis against the ten measures; an incident reporting procedure with names and deputies; and then a prioritised plan to close the gaps.
A 30-minute conversation is usually enough to say which category you fall in, where you stand against the ten measures and what is worth doing first.