GreeceLaw 5160/2024, Cybersecurity Risk-Management Measures and Governance
Law 5160/2024 (Ν. 5160/2024), Arts. 14-15
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential entity or an important entity drawn from Annex I (high-criticality sectors) or Annex II (other critical sectors), which the law's own table of contents captions as corresponding directly to NIS2 Directive Annexes I and II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform (each a defined term in Article 6), reached at the medium-enterprise threshold of Commission Recommendation 2003/361/EC or above (Article 3(1)); the wider sector classes Annexes I and II reach by designation (energy, transport, banking, health, drinking water, public administration and the rest) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 5, paragraph 3 sets the risk-management and supervision provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.
- Within three months of this duty's entry into force, have your management body approve the cybersecurity risk-management measures you take to comply with the measures below, supervise their implementation, and ensure every board member receives training and that equivalent training reaches your staff at least annually.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your activities or to provide your services, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.NIST CSF 2.0ID.RA-06
- Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where relevant, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication and secure voice, video, text and emergency communications.NIST CSF 2.0GV.PO-01
- Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.NIST CSF 2.0GV.RR-02NIST CSF 2.0GV.PO-01NIST CSF 2.0ID.AM-02
These lines are LexLint's reading of the law's text. Also read by: Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.AM-02Inventories of software, services, and systems managed by the organization are maintained
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 26's own penalty provision for an Article 15 infringement is an administrative fine (διοικητικό πρόστιμο); Law 5160/2024 creates no criminal offence for the infringement. A significant incident separately suspected to be criminal in nature leads the National Cybersecurity Authority to give the entity guidance on reporting it to the prosecutorial authorities or the Hellenic Police under Article 16(5), which concerns the incident rather than this Article 15 duty.
Penalty structure
Article 26(4) sets the maximum administrative fine for an essential entity's infringement of Article 15 or 16 at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the undertaking in the preceding financial year, whichever is higher. Article 26(5), the mirror provision for an important entity, sets the equivalent cap at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher. Both mirror NIS2 Directive Article 34(4) and (5). The gazette text of paragraph 4 ends with the clause "της επιχείρησης στην οποία ανήκει η σημαντική οντότητα" ("the undertaking to which the important entity belongs"), the same wording as paragraph 5; paragraph 4 opens by naming essential entities, which fixes the class it binds, and the two figures are those NIS2 Article 34(4) and (5) prescribe for essential and important entities. Narrower infringements carry lower caps: Article 26(9) sets EUR 200,000 for a breach of Article 14(1), EUR 100,000 for Article 14(2) and EUR 300,000 for Article 15(6).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority, EAK); for the national-security, public-order, defence and law-enforcement entity class of Article 3(2)(στ), the CSIRT of the Εθνική Υπηρεσία Πληροφοριών (National Intelligence Service) with parallel notice to the EAK.
Settledness
- As of
- Guidance link
- https://cyber.gov.gr/nomothesia/elliniki-nomothesia-gia-tin-kyvernoasfaleia/
- Guidance body
- Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority)
- Open questions
- Does the Εθνικό Πλαίσιο Απαιτήσεων Κυβερνοασφάλειας Βασικών και Σημαντικών Οντοτήτων (National Cybersecurity Requirements Framework for essential and important entities), adopted by ΚΥΑ 1689/2025 (ΦΕΚ Β' 2186/06.05.2025), create any duty beyond what Articles 14 and 15 already state?
- Article 26(4), the EUR 10,000,000/2% ceiling for essential entities, closes with the same words as paragraph 5, the undertaking "to which the important entity (η σημαντική οντότητα) belongs"; does that clause identify the turnover base for both ceilings, or is paragraph 4 meant to refer to the essential entity?
What this law does
Article 14 requires the management body of an essential or important entity to approve, within three months of this law's entry into force, the cybersecurity risk-management measures the entity takes to comply with Article 15, to supervise their implementation, and holds the management body responsible for the entity's breach of this duty; its members must undergo training and ensure the entity provides equivalent training to its staff at least annually.
Article 15 requires appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems the entity uses for its activities or to provide its services, and to prevent or minimise the impact of an incident on the recipients of its services or on other services, at a level of security proportionate to the risk, covering at minimum: risk-analysis and information-system security policy; incident handling; business continuity including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; cryptography and, where relevant, encryption policy; human-resources security, access-control policy and asset management; and the use of multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency-communications systems.
Article 15(5) adds national duties: an essential or important entity designates a qualified ICT Security Officer (Υ.Α.Σ.Π.Ε.) who handles communications with the National Cybersecurity Authority and coordinates compliance internally, keeps a unified cybersecurity policy that an essential entity submits to the Authority for approval at least annually, and keeps a ranked inventory of its information and communication assets.
Article 5, paragraph 3 sets this Law's provisions on risk-management and supervision aside for a financial entity covered by Regulation (EU) 2022/2554, subject to its duty to cooperate with the National Cybersecurity Authority under Article 13. Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity answers under that Regulation instead.
This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 20 (Article 14) and Article 21 (Article 15).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .