Runs an essential service, in Greece

Law 5160/2024 (Ν. 5160/2024), Art. 16 · Read the law's page

• This binds an essential entity or an important entity drawn from Annex I or Annex II, on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, reached at the medium-enterprise threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 5, paragraph 3 sets the incident-reporting provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.
• Notify the CSIRT of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects.
• Follow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects.
• Submit an interim report if the National Cybersecurity Authority requests one.
• Submit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution.
• If you are a trust-service provider, notify the National Cybersecurity Authority of a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour notification.
• Without undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response.

Law 5160/2024 (Ν. 5160/2024), Arts. 14-15 · Read the law's page

• Within three months of this duty's entry into force, have your management body approve the cybersecurity risk-management measures you take to comply with the measures below, supervise their implementation, and ensure every board member receives training and that equivalent training reaches your staff at least annually.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your activities or to provide your services, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.
• Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where relevant, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication and secure voice, video, text and emergency communications.
• Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.
• This binds an essential entity or an important entity drawn from Annex I (high-criticality sectors) or Annex II (other critical sectors), which the law's own table of contents captions as corresponding directly to NIS2 Directive Annexes I and II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform (each a defined term in Article 6), reached at the medium-enterprise threshold of Commission Recommendation 2003/361/EC or above (Article 3(1)); the wider sector classes Annexes I and II reach by designation (energy, transport, banking, health, drinking water, public administration and the rest) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 5, paragraph 3 sets the risk-management and supervision provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.

Ν. 4961/2022 (ΦΕΚ Α' 146/27.07.2022), Chapter Γ' of Part B, Arts. 32-42 · Read the law's page

• If you manufacture, import or distribute an Internet of Things device intended for operators of essential services, digital service providers or local government organizations in Greece, design it to reach an appropriate level of cybersecurity throughout its life cycle, with measures such as secure passwords, timely software updates from trusted sources, encryption of critical security data in transit and a vulnerability disclosure policy or procedure (Law 4961/2022, Article 32). Devices used by the National Intelligence Service and the Ministry of National Defence are outside the chapter.
• As a manufacturer, supply each such device with a declaration of conformity to the technical security specifications set by ministerial decision under Article 113, paragraph 12α, together with instructions for use and security information that end users can easily understand, keep the declaration, and give it to the National Cybersecurity Authority or the competent response team on request (Article 33(1) to (3)).
• As a manufacturer that learns a device does not comply with those specifications, inform the importer, the National Cybersecurity Authority and the competent response team immediately (Article 33(5)).
• As a manufacturer, keep for each device a procedure for handling an incident or vulnerability that a user finds, documenting its nature, giving detailed instructions for dealing with it and listing mitigation measures (Article 39).
• As an importer or distributor, check before supplying a device to an Internet of Things operator that it comes with the declaration of conformity, and stop supplying a device you know does not comply until it does, informing the manufacturer and, if it has already been supplied, the authority, the response team and the distributor or operators using it (Article 34).
• If you are an operator of essential services, a digital service provider or a local government organization using such devices, use them in accordance with the technical security specifications, appoint an Internet of Things Security Officer, keep a register of the devices you use and update it annually, suspend use of a device that presents a risk, and carry out a data protection impact assessment of the related processing (Articles 35, 37(2), 38 and 41(2)).