NIS2 for Greek ship managers

Updated 24 October 2026

By Vardion

The Greek-owned fleet is close to 5,800 vessels^[14], and 572 ship-management companies in Piraeus and Athens run ocean-going ships of over 1,000 gt^[15]. Many of those companies are in scope of Law 5160/2024 and KYA 1689/2025, which bring NIS2 into Greek law.

The company is in scope, not the ship

NIS2 Annex I lists water transport among the sectors of high criticality: inland, sea and coastal passenger and freight water transport companies as Regulation (EC) No 725/2004 defines them for maritime transport, not including the individual vessels those companies operate, together with port managing bodies and vessel traffic services^[1]^[2]. The obligations fall on the company. Greece has no official test yet for which ship managers are covered. The one cited here is Cypriot practice: the entity that holds the ISM Code responsibility, shown by its Document of Compliance^[7]. By that test, a Greek manager holding Documents of Compliance is the clearest case.

Establishment decides, not flag

An entity falls under the jurisdiction of the member state where it is established^[1]. A Liberian, Marshall Islands or Maltese flag does not change it: what matters is whether the managing company is established in Greece. How the authority treats the Greek offices of foreign companies under Law 27/1975 is pending legal confirmation.

The size test counts the group

An entity of high criticality is in scope from medium size: 50 or more staff, or an annual turnover and a balance sheet both above €10 million^[1]^[3]. The Recommendation adds the figures of linked enterprises in full and of partner enterprises in proportion to the share held^[3]. A management office of 20 people can cross the threshold once the single-ship owning companies behind it are added. Above the medium ceiling the entity is essential, and medium-sized it is important; the authority can also designate an entity whatever its size^[1].

How do you register?

Entities in scope had to register with the National Cybersecurity Authority by 30 September 2025^[16]. An entity that has not registered submits its details without delay^[5].

Who should be the ΥΑΣΠΕ in a shipping office?

Every essential and important entity appoints a security officer for information and communication systems (ΥΑΣΠΕ) from its own staff, or exceptionally from another company of the same group. The role cannot be held together with that of the data protection officer or of the person responsible for ICT^[6]. In a shipping office that usually points to the Designated Person Ashore or the Technical Director, not to the head of IT.

What you already cover

Much of the evidence the authority asks for overlaps with what these instruments cover.

Instrument	What it asks	Who checks
IMO MSC.428(98) and the ISM Code^[8]	Cyber risk in the safety management system from the first annual verification of the Document of Compliance after 1 January 2021	Flag and recognised organisation auditors
MSC-FAL.1/Circ.3/Rev.3^[9]	Six functional elements: govern, identify, protect, detect, respond and recover	Guidance for the safety management system
IACS UR E26 and E27^[10]	Cyber resilience of ships and of onboard systems and equipment, for newbuilds contracted from 1 July 2024	Classification societies
BIMCO Guidelines, version 5^[11]	Risk assessment, protection and detection measures, contingency plans and incident response for ships	Industry guidance
TMSA 3, Element 13^[12]	Maritime security, cyber included, in four stages from documented threat identification to innovative methods	Self-assessed by the operator
SIRE 2.0^[13]	A focused campaign on maritime security from 1 October 2025	OCIMF-accredited inspectors
NIS2, Law 5160/2024, KYA 1689/2025^[1]^[4]	The 22 requirement articles, the security officer, incident reporting and the authority's assessments	National Cybersecurity Authority

The crosswalk sets the KYA's articles against the IMO functions, the BIMCO chapters and the TMSA stages, so one piece of evidence answers each audience.

Vardion is also measuring the email security of Greek ship managers from public DNS. The method says how the results are reported: As shares across all the companies and by fleet size band. No company is named.

Sources

Your KYA assessment beside your ISM evidence

See the assessment of Greece's National Cybersecurity Authority (ΕΑΚ), the policy drafts and the scan of your shore office run in Vardion, with sample data.

Book a demo Check your domain