CyprusSecurity of Networks and Information Systems Law, Incident Notification Obligations
Art. 35B of the Security of Networks and Information Systems Law of 2020 N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a top-level domain (TLD) registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. The obligation runs to this jurisdiction's own row, which is a companion of this jurisdiction's risk-management and governance row.
- Notify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact.
- Follow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
- Submit an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every fifteen days counted from the incident notification until the final report, and a final report within fifteen days of restoring the affected network or information system's normal operation).
- Where you are a trust service provider, notify within 24 hours rather than 72 for a significant incident affecting the trust services you supply.
- Where applicable, notify without undue delay the recipients of your services who may be affected by a significant cyber threat, of any measures or corrective action they can take, and notify them of a significant incident likely to adversely affect their use of the service.
These lines are LexLint's reading of the law's text. Also read by: Digital Security Authority (DSA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 44(1) makes it an offence for an essential or important entity not to notify the Authority, without undue delay, of an incident with a serious impact on the continuity of its essential services, punishable on conviction by imprisonment of up to two years, a fine of up to EUR 10,000, or both. That trigger is narrower than the Article 35B significant incident; the Article 43A administrative fines apply to the Article 35B duty as a whole. Article 54's express legal-person liability provision names Articles 22 and 43, not Article 44.
Penalty structure
The same Article 43A(4) and (5) tiers that govern an Article 35 infringement govern an Article 35B infringement: at least EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity, and at least EUR 7,000,000 or 1.4 percent for an important entity, whichever is higher in each case.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Digital Security Authority (Αρχή Ψηφιακής Ασφάλειας), Cyprus's national competent NIS authority, acting through the national CSIRT, which the Authority forwards each notification to on receipt.
Settledness
- As of
- Guidance link
- https://dsa.cy/en/legislation/laws
- Guidance body
- Digital Security Authority (DSA)
What this law does
Article 35B requires an essential or important entity to notify the Digital Security Authority, without undue delay, of any incident that has a significant impact on the provision of its services, on a graduated clock: an early warning within six hours of becoming aware of the significant incident (stricter than NIS2 Article 23(4)(a)'s 24-hour floor), a fuller incident notification within 72 hours, an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every 15 days and a final report within 15 days of restoring the affected network or system).
A trust-service provider notifies within 24 hours rather than 72 for an incident affecting its trust services. The Authority responds to the early warning within 24 hours with initial feedback and, on request, guidance, and forwards the notification to the national computer security incident response team (CSIRT). Section 31(10) disapplies this Law's cybersecurity risk-management, incident-reporting, supervision and enforcement provisions to a financial entity that Regulation (EU) 2022/2554 (DORA) covers.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .