CyprusSecurity of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance
Arts. 35 and 35A of the Security of Networks and Information Systems Law of 2020 N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a top-level domain (TLD) registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your activities or to provide your services, proportionate to the risk, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.NIST CSF 2.0ID.RA-06
- Cover at least: risk-analysis and information-system security policies; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security of your relationships with your direct suppliers and service providers; secure acquisition, development and maintenance of systems, including vulnerability handling and disclosure; policies to assess the effectiveness of these measures; basic cyber hygiene practices and cybersecurity training; cryptography and, where appropriate, encryption policies; human-resources security, access-control policies and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.NIST CSF 2.0GV.PO-01
- Have your senior management approve these risk-management measures and oversee their implementation; senior management can be held accountable for the entity's breach of this duty, and must undergo, and offer staff, regular training so they can identify risks and assess cybersecurity risk-management practices.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Digital Security Authority (DSA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 44(3) makes it an offence for an essential or important entity not to take appropriate and proportionate technical and organizational measures to manage the risks to the security of the network and information systems it uses, punishable on conviction by imprisonment of up to three years, a fine of up to EUR 15,000, or both. The Article 43A administrative fines apply to the same duty. Article 54's express legal-person liability provision names Articles 22 and 43, not Article 44.
Penalty structure
Article 43A(4): an essential entity's breach of Article 35 or 35B draws an administrative fine of a maximum of at least EUR 10,000,000 or 2 percent of the undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher. Article 43A(5) sets an important entity's maximum at at least EUR 7,000,000 or 1.4 percent, whichever is higher, mirroring NIS2 Article 34(4) and (5). Article 43 sets a separate, lower general fine (up to EUR 200,000, plus EUR 10,000 per day of continuing violation) for a breach of the Law that Article 43A does not itself cover.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Digital Security Authority (Αρχή Ψηφιακής Ασφάλειας), Cyprus's national competent NIS authority (formerly the Office of the Commissioner of Electronic Communications and Postal Regulation), acting through the national CSIRT.
Settledness
- As of
- Guidance link
- https://dsa.cy/en/legislation/laws
- Guidance body
- Digital Security Authority (DSA)
What this law does
Article 35 requires an essential or important entity to take appropriate and proportionate technical, operational and organisational measures, proportionate to the risk, to manage the risks to the security of the network and information systems it uses for its activities or to provide its services, covering at least risk-analysis and security policy, incident handling, business continuity and disaster recovery, supply-chain security, secure system acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policies, cyber hygiene and training, cryptography and encryption, human-resources security and access control, and multi-factor authentication, transposing NIS2 Article 21.
Article 35A requires the entity's senior management to approve these measures, oversee their implementation, and undergo (and offer staff) regular cybersecurity training, and it can be held accountable for the entity's breach of the Article 35 duty. Section 31(10) disapplies this Law's cybersecurity risk-management, incident-reporting, supervision and enforcement provisions to a financial entity that Regulation (EU) 2022/2554 (DORA) covers.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .