Resources / Legislation
Law 5160/2024: NIS2 in Greek law
Updated 24 October 2026
Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024) brings the NIS2 Directive into Greek law[1]. It sets who it applies to, what their management owes, how incidents are reported and the fines the National Cybersecurity Authority (ΕΑΚ) imposes. KYA 1689/2025 sets out the measures in detail.
Who does Law 5160/2024 apply to?
- Public or private entities in the sectors of Annexes I and II that are medium-sized or larger under Recommendation 2003/361/EC and are established or active in Greece (Article 3(1))[1][2].
- Whatever their size: providers of public electronic communications networks and services, trust service providers, top-level domain registries and DNS service providers, the sole provider of an essential service and critical entities (Article 3(2) and (3))[1].
- Central government bodies and second tier local authorities, and first tier local authorities from 27 November 2026 (Article 3(2)(στ))[1][3]. See the law in the public sector.
Article 4 divides entities into essential and important. A medium-sized company counts its group: the Recommendation adds the figures of linked enterprises in full and of partner enterprises by the share held[2].
What is management responsible for?
The management bodies approve the risk-management measures, oversee their implementation and are responsible for infringements of them (Article 14(1)). Their members are trained, and the entity trains its staff at least once a year (Article 14(2))[1].
Which measures and reports does it require?
Entities take the measures of Article 15, which KYA 1689/2025 sets out in detail[1][4]. They notify every significant incident to the ΕΑΚ's CSIRT without delay, within the Directive's deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 16)[1][5]. Central government bodies and local authorities notify the National CERT of the ΕΥΠ, the National Intelligence Service, informing the ΕΑΚ at the same time (Articles 10 and 16)[1].
What Vardion does for each KYA article
- Measured continuously: your scans and connected accounts add evidence on every run.
- Documented and evidenced in Vardion: assessed in the ΕΑΚ gap analysis or drafted in the policy kit, with its evidence files.
| Measure | In Vardion |
|---|---|
| Article 4Obligations and accountability of the management bodies | Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy |
| Article 5Risk management framework | Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Risk management procedure |
| Article 6Information security policies and procedures | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy, Exception management procedure |
| Article 7Roles, responsibilities and authorities | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Information security policy |
| Article 8Independent review of information security | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysis |
| Article 9Compliance monitoring procedures | Documented and evidenced in VardionAssessed against 3 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Exception management procedure |
| Article 10Human resources security | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Acceptable use policy |
| Article 11Hardware and software asset management | Measured continuouslyVardion provides evidence about the internet-facing names, addresses and services it discovered, internal services on declared ranges and the hosts that report their software. Documented and evidenced in VardionAssessed against 10 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Asset management policy, Acceptable use policy, Removable media policy |
| Article 12Risk management of relationships with suppliers and ICT service providers | Measured continuouslyVardion provides evidence about DNS records left pointing at a provider's resource that nobody holds, and lists the providers its records name under Reports, Suppliers. Documented and evidenced in VardionAssessed against 10 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Supply chain security policy |
| Article 13Account management and access control | Measured continuouslyVardion provides evidence about default and leaked credentials, administration and sign-in pages reachable from the internet and, in connected cloud and identity accounts, multi-factor authentication, administrators and guest access. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Access control policy |
| Article 14Secure configuration of hardware, software, services and networks | Measured continuouslyVardion provides evidence about configuration weaknesses on scanned services and the email and DNS settings of scope domains. Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Network security policy |
| Article 15Secure application development principles | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
| Article 16Change management | Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysis |
| Article 17Vulnerability handling and disclosure | Measured continuouslyVardion runs the periodic vulnerability scans Article 17 names, and provides evidence about vulnerabilities found, end-of-life software and the fixes later scans confirmed. Documented and evidenced in VardionAssessed against 11 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Security testing policy |
| Article 18Assessment of the effectiveness of cybersecurity risk-management measures | Measured continuouslyVardion provides evidence that scans ran in the period and which reported fixes a scan confirmed. Documented and evidenced in VardionAssessed against 6 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Security testing policy |
| Article 19Network security | Measured continuouslyVardion provides evidence about services and administration pages reachable from the internet and risky services on the declared internal ranges. Documented and evidenced in VardionAssessed against 21 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Network security policy |
| Article 20Protection against malicious software | Documented and evidenced in VardionAssessed against 9 controls of the ΕΑΚ gap analysis |
| Article 21Cybersecurity training and awareness | Documented and evidenced in VardionAssessed against 4 controls of the ΕΑΚ gap analysis |
| Article 22Use of cryptography | Measured continuouslyVardion provides evidence about certificates, TLS and SSH settings, CAA records and DNSSEC on scanned services and domains. Documented and evidenced in VardionAssessed against 5 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Removable media policy, Cryptography policy |
| Article 23Physical and environmental security | Documented and evidenced in VardionAssessed against 7 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Physical and environmental security policy |
| Article 24Cybersecurity incident management | Measured continuouslyVardion provides evidence about whether connected cloud accounts keep an activity or audit log. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Incident management policy, Incident management procedure |
| Article 25Business continuity and crisis management | Measured continuouslyVardion provides evidence about backup files served to the internet, name server redundancy and domain registrations running out. Documented and evidenced in VardionAssessed against 13 controls of the ΕΑΚ gap analysisDrafted in the policy kit: Backup policy |
How do you register and appoint a ΥΑΣΠΕ?
Every essential and important entity registers on the ΕΑΚ's digital platform (Law 5160/2024, Article 4(3))[1], which runs under KYA 1381/2025[6]. The deadline to register passed on 30 September 2025[7]. An entity that has not registered submits its details without delay, and any change to them within two weeks[8][7]. The security officer the law requires (ΥΑΣΠΕ) is declared on the platform too[9].
The law (Article 34) and ΥΑ 1899/2025 set the role of the security officer for information and communication systems[1][9]. See who can be a ΥΑΣΠΕ.
Who supervises, and what are the fines?
The ΕΑΚ supervises essential entities before and after the fact, and important entities after the fact (Articles 24 and 25)[1].
| Breach | Fine | Article of Law 5160/2024 |
|---|---|---|
| Essential entity, for the measures (Article 15) or incident reporting (Article 16) | Up to €10,000,000 or 2% of worldwide annual turnover, whichever is higher | 26(4) |
| Important entity, for the same | Up to €7,000,000 or 1.4% of worldwide annual turnover, whichever is higher | 26(5) |
| Approval and oversight of the measures by the management bodies (Article 14(1)) | Up to €200,000 | 26(9)(a) |
| Training of management body members and staff (Article 14(2)) | Up to €100,000 | 26(9)(b) |
| Public sector entities of Article 3(2)(στ) | From €20,000 to €500,000 | 26(8) |
The authority imposes fines by a reasoned decision after a hearing, and how long a breach has lasted is one of the factors it weighs[1].
What changes with the Commission's 2026 proposal?
On 20 January 2026 the European Commission proposed targeted amendments to NIS2, together with a revision of the Cybersecurity Act[10]. It is a proposal: until the European Parliament and the Council adopt it and it is transposed, the obligations of Law 5160/2024 and KYA 1689/2025 apply as they stand.
What to do now
- Check whether the law applies to you, with the scope test of Greece's National Cybersecurity Authority (ΕΑΚ) or with Vardion's applicability check, which adds up the group.
- If you have not registered on the ΕΑΚ's platform, register now.
- Appoint the security officer the law requires (ΥΑΣΠΕ) from your own staff and declare them on the platform. See who can be a ΥΑΣΠΕ.
- Start the ΕΑΚ self-assessment, which is sent every year with a corrective action plan.
- Take the measures to the management body for approval and record the approval.
Frequently asked questions
Is Law 5160/2024 the same as NIS2?
It brings the NIS2 Directive into Greek law, and KYA 1689/2025 sets out its measures.
Who supervises it?
The ΕΑΚ: essential entities before and after the fact, important entities after the fact.
How do we know whether the law applies to us?
Run Vardion's applicability check: it adds up the group and keeps the scope memo your management signs.
Sources
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- Recommendation 2003/361/EC on micro, small and medium-sized enterprises, checked 24 October 2026
- KYA 2267/2025 (ΦΕΚ Β' 5472/14.10.2025) on when first-tier local authorities come under the law, checked 25 October 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
- Directive (EU) 2022/2555 (NIS2), checked 24 October 2026
- KYA 1381/2025 (ΦΕΚ Β' 463/2025) on the registration platform, checked 24 October 2026
- ΕΑΚ, circular οικ. 28211/10.9.2025 on registering on the platform, checked 24 October 2026
- ΕΑΚ, questions and answers on the registration platform, checked 24 October 2026
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
- European Commission, proposal for a directive COM(2026) 13, 20 January 2026, checked 24 October 2026
Run your yearly ΕΑΚ self-assessment in Vardion
The 234 questions in the authority's own Greek, scored as its tool scores them.