Resources / Guide
KYA 1689/2025: what it asks of Greek entities
Updated 24 October 2026
Joint ministerial decision 1689/2025 (ΦΕΚ Β' 2186/2025) sets the cybersecurity measures that the essential and important entities of Law 5160/2024 put in place[1].
Who does KYA 1689/2025 apply to?
Every essential and important entity under Law 5160/2024: medium and large companies in the sectors of Annexes I and II that are established or active in Greece, some entities whatever their size and the public sector bodies of Article 3(2)[2]. The scope test of Greece's National Cybersecurity Authority (ΕΑΚ) gives an indicative answer[3].
What does the KYA require?
Articles 4 to 25 set out the requirements, each with its Greek heading[1]. The decision follows the Annex of Implementing Regulation (EU) 2024/2690 section by section.
- Obligations and accountability of the management bodiesΥποχρεώσεις και ευθύνη των ανωτάτων οργάνων διοίκησης
- Risk management frameworkΠλαίσιο διαχείρισης κινδύνων
- Information security policies and proceduresΠολιτικές και διαδικασίες ασφάλειας πληροφοριώνVardion drafts the 12 policies the KYA names, plus 3 procedures and a privacy policy (16 drafts), in Greek and English, with the ΕΑΚ controls each statement puts in place.
- Roles, responsibilities and authoritiesΡόλοι, αρμοδιότητες και εξουσίεςVardion records the ΥΑΣΠΕ's appointment, who they report to and where the decision is kept.
- Independent review of information securityΑνεξάρτητος έλεγχος ασφάλειας πληροφοριών
- Compliance monitoring proceduresΔιαδικασίες παρακολούθησης της συμμόρφωσης
- Human resources securityΑσφάλεια ανθρώπινου δυναμικού
- Hardware and software asset managementΔιαχείριση υλικού και λογισμικούThe asset register combines scans, agents and cloud accounts.
- Risk management of relationships with suppliers and ICT service providersΔιαχείριση κινδύνων από τις σχέσεις με προμηθευτές και παρόχους υπηρεσιών Τ.Π.Ε.A supplier register with a passive check of each supplier's domain.
- Account management and access controlΔιαχείριση λογαριασμών και έλεγχος πρόσβασης
- Secure configuration of hardware, software, services and networksΑσφαλής παραμετροποίηση υλικού, λογισμικού, υπηρεσιών και δικτύων
- Secure application development principlesΑρχές ασφαλούς ανάπτυξης εφαρμογών
- Change managementΔιαχείριση αλλαγών
- Vulnerability handling and disclosureΔιαχείριση και γνωστοποίηση ευπαθειώνArticle 17 names vulnerability scanning, which Vardion runs on demand or on a schedule.
- Assessment of the effectiveness of cybersecurity risk-management measuresΑξιολόγηση της αποτελεσματικότητας των μέτρων διαχείρισης κινδύνων κυβερνοασφάλειαςAn external penetration test at least once a year, an internal one for essential entities and a yearly self-assessment sent to the ΕΑΚ. Vardion records the tests, imports the tester's findings and helps complete the self-assessment.
- Network securityΑσφάλεια δικτύων
- Protection against malicious softwareΠροστασία από κακόβουλο λογισμικό
- Cybersecurity training and awarenessΕκπαίδευση και ευαισθητοποίηση σε θέματα κυβερνοασφάλειας
- Use of cryptographyΧρήση κρυπτογραφίας
- Physical and environmental securityΦυσική και περιβαλλοντική ασφάλεια
- Cybersecurity incident managementΔιαχείριση περιστατικών κυβερνοασφάλειαςAn incident register with the significance assessment, the drafted reports and every deadline.
- Business continuity and crisis managementΕπιχειρησιακή συνέχεια και διαχείριση κρίσεωνBusiness impact analysis, playbooks and exercises.
What Vardion does for each KYA article
- Measured continuously: your scans and connected accounts add evidence on every run.
- Documented and evidenced in Vardion: assessed in the ΕΑΚ gap analysis or drafted in the policy kit, with its evidence files.
| Measure | In Vardion |
|---|---|
| Article 4Obligations and accountability of the management bodies | Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy |
| Article 5Risk management framework | Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Risk management procedure |
| Article 6Information security policies and procedures | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy, Exception management procedure |
| Article 7Roles, responsibilities and authorities | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy |
| Article 8Independent review of information security | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysis |
| Article 9Compliance monitoring procedures | Documented and evidenced in VardionAssessed against 3 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Exception management procedure |
| Article 10Human resources security | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Acceptable use policy |
| Article 11Hardware and software asset management | Measured continuouslyVardion provides evidence about the internet-facing names, addresses and services it discovered, internal services on declared ranges and the hosts that report their software. Documented and evidenced in VardionAssessed against 10 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Asset management policy, Acceptable use policy, Removable media policy |
| Article 12Risk management of relationships with suppliers and ICT service providers | Measured continuouslyVardion provides evidence about DNS records left pointing at a provider's resource that nobody holds, and lists the providers its records name under Reports, Suppliers. Documented and evidenced in VardionAssessed against 10 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Supply chain security policy |
| Article 13Account management and access control | Measured continuouslyVardion provides evidence about default and leaked credentials, administration and sign-in pages reachable from the internet and, in connected cloud and identity accounts, multi-factor authentication, administrators and guest access. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Access control policy |
| Article 14Secure configuration of hardware, software, services and networks | Measured continuouslyVardion provides evidence about configuration weaknesses on scanned services and the email and DNS settings of scope domains. Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Network security policy |
| Article 15Secure application development principles | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
| Article 16Change management | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
| Article 17Vulnerability handling and disclosure | Measured continuouslyVardion runs the periodic vulnerability scans Article 17 names, and provides evidence about vulnerabilities found, end-of-life software and the fixes later scans confirmed. Documented and evidenced in VardionAssessed against 11 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Security testing policy |
| Article 18Assessment of the effectiveness of cybersecurity risk-management measures | Measured continuouslyVardion provides evidence that scans ran in the period and which reported fixes a scan confirmed. Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Security testing policy |
| Article 19Network security | Measured continuouslyVardion provides evidence about services and administration pages reachable from the internet and risky services on the declared internal ranges. Documented and evidenced in VardionAssessed against 21 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Network security policy |
| Article 20Protection against malicious software | Documented and evidenced in VardionAssessed against 9 controls of the ΕΑΚ gap analysis |
| Article 21Cybersecurity training and awareness | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysis |
| Article 22Use of cryptography | Measured continuouslyVardion provides evidence about certificates, TLS and SSH settings, CAA records and DNSSEC on scanned services and domains. Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Removable media policy, Cryptography policy |
| Article 23Physical and environmental security | Documented and evidenced in VardionAssessed against 7 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Physical and environmental security policy |
| Article 24Cybersecurity incident management | Measured continuouslyVardion provides evidence about whether connected cloud accounts keep an activity or audit log. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Incident management policy, Incident management procedure |
| Article 25Business continuity and crisis management | Measured continuouslyVardion provides evidence about backup files served to the internet, name server redundancy and domain registrations running out. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Backup policy |
How do you register on the platform?
Every essential and important entity registers on the ΕΑΚ's digital platform (Law 5160/2024, Article 4(3))[2], which runs under KYA 1381/2025[4]. The deadline to register passed on 30 September 2025[5]. An entity that has not registered submits its details without delay, and any change to them within two weeks[6][5]. The security officer the law requires (ΥΑΣΠΕ) is declared on the platform too[7].
What is the yearly self-assessment?
Every essential and important entity carries out a self-assessment of the security of its systems every year, and after any serious incident, using the guide the ΕΑΚ issues. It sends the results to the ΕΑΚ with a corrective action plan (KYA 1689/2025, Article 18(1)(δ))[1].
The decision sets no date or channel for sending it. The ΕΑΚ publishes the online self-assessment tool[8]. Confirm the date and the channel with the authority. See the page on the self-assessment.
Do you need penetration tests?
The same article asks every essential and important entity for an external penetration test at least once a year or after a serious incident. Essential entities also owe an internal test at the same frequency (Article 18(1)(β) and 18(2)(α))[1].
Do you need a security officer (ΥΑΣΠΕ)?
Every entity appoints a security officer for information and communication systems (ΥΑΣΠΕ) from its own staff, who reports directly to the management body (Article 7)[1]. ΥΑ 1899/2025 sets the qualifications and incompatibilities[7]; see who can be a ΥΑΣΠΕ.
What are the fines?
Article 26 of Law 5160/2024 sets the fines.
| Breach | Fine | Article of Law 5160/2024 |
|---|---|---|
| Essential entity, for the measures (Article 15) or incident reporting (Article 16) | Up to €10,000,000 or 2% of worldwide annual turnover, whichever is higher | 26(4) |
| Important entity, for the same | Up to €7,000,000 or 1.4% of worldwide annual turnover, whichever is higher | 26(5) |
| Approval and oversight of the measures by the management bodies (Article 14(1)) | Up to €200,000 | 26(9)(a) |
| Training of management body members and staff (Article 14(2)) | Up to €100,000 | 26(9)(b) |
| Public sector entities of Article 3(2)(στ) | From €20,000 to €500,000 | 26(8) |
The authority imposes fines by a reasoned decision after a hearing, and how long a breach has lasted is one of the factors it weighs[2].
Which ΕΑΚ assessment do you need?
| Instrument | Scope |
|---|---|
| Gap analysis (September 2025, with ENISA) | 169 controls in 24 sections, each weighted 1 to 5, for Law 5160/2024 and KYA 1689/2025 |
| Self-assessment (December 2024 guide) | 234 questions in 19 sections, online since January 2026 |
What changes with the Commission's 2026 proposal?
On 20 January 2026 the European Commission proposed targeted amendments to NIS2, together with a revision of the Cybersecurity Act[9]. It is a proposal: until the European Parliament and the Council adopt it and it is transposed, the obligations of Law 5160/2024 and KYA 1689/2025 apply as they stand.
What to do now
- Check whether the law applies to you, with the scope test of Greece's National Cybersecurity Authority (ΕΑΚ) or with Vardion's applicability check, which adds up the group.
- If you have not registered on the ΕΑΚ's platform, register now.
- Appoint the security officer the law requires (ΥΑΣΠΕ) from your own staff and declare them on the platform. See who can be a ΥΑΣΠΕ.
- Start the ΕΑΚ self-assessment, which is sent every year with a corrective action plan.
- Take the measures to the management body for approval and record the approval.
Frequently asked questions
Who must follow KYA 1689/2025?
Every essential and important entity under Law 5160/2024.
How often is the self-assessment sent?
Every year, and after any serious incident, with a corrective action plan.
Sources
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- ΕΑΚ, scope test, checked 24 October 2026
- KYA 1381/2025 (ΦΕΚ Β' 463/2025) on the registration platform, checked 24 October 2026
- ΕΑΚ, circular οικ. 28211/10.9.2025 on registering on the platform, checked 24 October 2026
- ΕΑΚ, questions and answers on the registration platform, checked 24 October 2026
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
- ΕΑΚ, self-assessment tool, checked 24 October 2026
- European Commission, proposal for a directive COM(2026) 13, 20 January 2026, checked 24 October 2026
Run your yearly ΕΑΚ self-assessment in Vardion
The 234 questions in the authority's own Greek, scored as its tool scores them.