Resources / Guide
NIS2: who it applies to and what it requires
Updated 2 November 2026
Directive (EU) 2022/2555 (NIS2) requires medium and large companies in 18 sectors to manage cybersecurity risk and report significant incidents[1]. In Greece it applies through Law 5160/2024 and KYA 1689/2025.
Why does it matter now?
Of the intrusions ENISA analysed, 60% started with phishing and 21.3% with an exploited vulnerability[2].
Who does NIS2 apply to?
Public or private entities in the sectors of Annexes I and II that are at least medium-sized: 50 or more staff, or turnover and balance sheet both above €10 million[1][3]. Some entities are covered whatever their size, such as trust service providers, top-level domain registries and DNS service providers[1].
An entity falls under the member state where it is established (Article 26)[1]. Large companies in the sectors of high criticality are as a rule essential entities and the others important; the difference changes the supervision and the fines.
In Greece some entities are essential whatever their size (Law 5160/2024, Article 4(1))[4]:
- qualified trust service providers, top-level domain registries and DNS service providers (point β);
- providers of public electronic communications networks or services that are medium-sized (point γ);
- central government bodies (point δ);
- entities the ΕΑΚ designates as essential, such as the sole provider of an essential service (point ε and paragraph 3);
- critical entities under Directive (EU) 2022/2557 (point στ);
- operators of essential services recognised before 16 January 2023 (point ζ).
What does NIS2 require?
Each entity takes appropriate and proportionate measures that cover at least the following.
- Policies on risk analysis and information system securityIn Vardion: risk register, policy drafts and the ISMS records
- Incident handlingIn Vardion: incident register with the significance assessment, drafted reports and the Article 23 deadlines
- Business continuity, such as backup management and disaster recovery, and crisis managementIn Vardion: business impact analysis, playbooks, exercises and the crisis team
- Supply chain security, including security-related aspects of the relationships with direct suppliers or service providersIn Vardion: supplier register with a passive check of their domains and questionnaires
- Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosureIn Vardion: scheduled vulnerability scanning with a fix plan
- Policies and procedures to assess the effectiveness of the measuresIn Vardion: maturity assessments, internal audits and the evidence pack
- Basic cyber hygiene practices and cybersecurity trainingIn Vardion: results of phishing simulations and training
- Policies and procedures on the use of cryptography and, where appropriate, encryptionIn Vardion: TLS, certificate and SSH checks on every scanned service, with DNSSEC for each domain
- Human resources security, access control policies and asset managementIn Vardion: asset register, owners and identity posture reviews
- Multi-factor or continuous authentication, secured communications and secured emergency communication systemsIn Vardion: multi-factor authentication checks for Microsoft 365 and Google Workspace
What Vardion does for each NIS2 measure
- Measured continuously: your scans and connected accounts add evidence on every run.
- Documented and evidenced in Vardion: assessed in the ΕΑΚ gap analysis or drafted in the policy kit, with its evidence files.
| Measure | In Vardion |
|---|---|
| 21(2)(a)Policies on risk analysis and information system security | Documented and evidenced in VardionAssessed against 20 controls of the ΕΑΚ gap analysis |
| 21(2)(b)Incident handling | Measured continuouslyVardion provides evidence about whether connected cloud accounts keep an activity or audit log. Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
| 21(2)(c)Business continuity, such as backup management and disaster recovery, and crisis management | Measured continuouslyVardion provides evidence about backup files served to the internet, name server redundancy and domain registrations running out. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysis |
| 21(2)(d)Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers | Measured continuouslyVardion provides evidence about DNS records left pointing at a provider's resource that nobody holds. Documented and evidenced in VardionAssessed against 8 controls of the ΕΑΚ gap analysis |
| 21(2)(e)Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure | Measured continuouslyVardion provides evidence about weaknesses found on approved addresses, the fixes later scans confirmed and whether each site publishes a contact for vulnerability reports. Documented and evidenced in VardionAssessed against 44 controls of the ΕΑΚ gap analysis |
| 21(2)(f)Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Measured continuouslyVardion provides evidence that scans ran in the period and which reported fixes a scan confirmed. Documented and evidenced in VardionAssessed against 18 controls of the ΕΑΚ gap analysis |
| 21(2)(g)Basic cyber hygiene practices and cybersecurity training | Documented and evidenced in VardionAssessed against 22 controls of the ΕΑΚ gap analysis |
| 21(2)(h)Policies and procedures regarding the use of cryptography and, where appropriate, encryption | Measured continuouslyVardion provides evidence about certificates, TLS settings and CAA records on scanned services. Documented and evidenced in VardionAssessed against 3 controls of the ΕΑΚ gap analysis |
| 21(2)(i)Human resources security, access control policies and asset management | Measured continuouslyVardion provides evidence about exposed sign-in pages, default and leaked credentials, forgotten assets and, in connected cloud and identity accounts, administrators, guest access and public sharing. Documented and evidenced in VardionAssessed against 17 controls of the ΕΑΚ gap analysis |
| 21(2)(j)The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate | Measured continuouslyVardion provides evidence about sign-in pages reachable from the internet and leaked credentials, and about whether multi-factor authentication is registered and enforced in a connected Microsoft 365 tenant or Google Workspace domain. Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
What is management responsible for?
The management bodies approve the measures, oversee their implementation and can be held liable for infringements (Article 20(1)). Their members follow training (Article 20(2))[1].
How do you report an incident?
| Report | Deadline (Article 23(4)) |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident |
| Incident notification | Within 72 hours of becoming aware of it, with an initial assessment |
| Intermediate report | When the CSIRT or the authority asks for one |
| Final report | Within one month of the incident notification. If the incident is still ongoing then, a progress report at that time and the final report within one month of handling it |
What are the fines?
The Directive sets the minimum maximum each member state must allow for: €10,000,000 or 2% of worldwide annual turnover for an essential entity and €7,000,000 or 1.4% for an important one, whichever is higher (Article 34)[1]. Law 5160/2024 adds fines for the management duties; see the page on the law.
What changes with the Commission's 2026 proposal?
On 20 January 2026 the European Commission proposed targeted amendments to NIS2, together with a revision of the Cybersecurity Act[5]. It is a proposal: until the European Parliament and the Council adopt it and it is transposed, the obligations of Law 5160/2024 and KYA 1689/2025 apply as they stand.
What to do now
- Check whether the law applies to you, with the scope test of Greece's National Cybersecurity Authority (ΕΑΚ) or with Vardion's applicability check, which adds up the group.
- If you have not registered on the ΕΑΚ's platform, register now.
- Appoint the security officer the law requires (ΥΑΣΠΕ) from your own staff and declare them on the platform. See who can be a ΥΑΣΠΕ.
- Start the ΕΑΚ self-assessment, which is sent every year with a corrective action plan.
- Take the measures to the management body for approval and record the approval.
Frequently asked questions
Does NIS2 apply to my company?
It applies to medium and large companies in the 18 sectors of Annexes I and II, and to some entities whatever their size. Run Vardion's applicability check, which adds up your group.
Which Article 21 measures does Vardion measure?
Every point a scan or a connected account can see, marked Measured continuously in the table above. Vardion assesses and documents the rest with their evidence.
Where does Greece set out the detail?
In KYA 1689/2025, whose Articles 4 to 25 set out the measures, under Law 5160/2024.
Sources
- Directive (EU) 2022/2555 (NIS2), checked 24 October 2026
- ENISA Threat Landscape 2025, checked 24 October 2026
- Recommendation 2003/361/EC on micro, small and medium-sized enterprises, checked 24 October 2026
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- European Commission, proposal for a directive COM(2026) 13, 20 January 2026, checked 24 October 2026
Run your yearly ΕΑΚ self-assessment in Vardion
The 234 questions in the authority's own Greek, scored as its tool scores them.