Resources / Guide
Your first 90 days as ΥΑΣΠΕ
Updated 2 November 2026
ΥΑ 1899/2025 sets out what the security officer the law requires (ΥΑΣΠΕ) does, in force since 1 November 2025[1]. Here are the duties in the order the decision gives them, and where Vardion helps.
Before you start
- The entity checks your background before you take up the duties (Article 5(1) and (4))[1].
- The entity declares you on the ΕΑΚ's registration platform (Article 8)[1].
- You answer directly to the top management level, with the autonomy to apply your decisions across the entity (Article 6(4))[1].
Vardion records the appointment, the background check and whom you report to.
Your duties, in the decision's order
Article 6(1) lists 16 duties[1].
| Point | Duty | Where Vardion helps |
|---|---|---|
| α | Continuous care for the security of the systems, and oversight of the measures | The overview, the ranked findings and the fix plan |
| β | Every communication with the ΕΑΚ | The self-assessment file the authority's tool opens |
| γ | Contacts with security forums, interest groups and professional bodies | |
| δ | Compliance with Article 15 of Law 5160/2024 and KYA 1689/2025 | The ΕΑΚ gap analysis and self-assessment, and KYA 1689/2025 article by article |
| ε | Notifying significant incidents (Article 16) and voluntary notifications to the CSIRT (Article 22) | An incident register with the significance assessment, the drafted reports and every deadline |
| στ | Oversight of the single cybersecurity policy, and its submission to the authority for approval | 16 drafts of policies and procedures in Greek and English, with who approved each and when |
| ζ | Cooperation with the other competent authorities | |
| η | Presenting the strategy and policy to management for approval, and briefing it on threats | The ΥΑΣΠΕ's quarterly pack and the board report |
| θ | Training and awareness for management and staff (Law 5160/2024, Article 14(2)) | Training as a recurring duty, and policy acknowledgement by every employee |
| ι | Supply chain security in procurement and over the life of each contract | The supplier register, its grades and the yearly questionnaire |
| ια | Risk analysis, business continuity and disaster recovery | The risk register, the impact analysis, playbooks and exercises |
| ιβ | The register of ICT infrastructure, software and information assets | The asset register, from scans, agents and cloud accounts |
| ιγ | Taking part in audits and on-site inspections (Articles 24 and 25) | The evidence pack for the auditor |
| ιδ | Cooperating with the inspectors and the authority on security scans | Scans of the addresses you approve, on your own server |
| ιε | Answering requests for information, access to data and evidence | Exports of the records with their evidence |
| ιστ | Following new security technologies and tools |
Your first 90 days
- Days 1 to 30: you are declared on the platform, and the ΕΑΚ gap analysis shows where the entity stands.
- Days 31 to 60: the policies go to management for approval, and incidents and suppliers get a register.
- Days 61 to 90: management reads its first quarterly pack, and the self-assessment is ready for the ΕΑΚ.
See who can be a ΥΑΣΠΕ and the ΕΑΚ gap analysis.
Sources
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
Run your first 90 days in Vardion
The duties, the policies, the ΕΑΚ assessments and the deadlines, on sample data.