What would happen if your company lost access to its systems tomorrow morning?
New EU cybersecurity rules require certain Cyprus businesses to strengthen their digital security, manage cyber risks, and report serious incidents within strict deadlines. For companies covered by NIS2, EU cybersecurity compliance is now a management responsibility, not just an IT concern.
Imagine a business in Limassol suddenly losing access to customer records after a ransomware attack. Employees cannot work, clients are waiting, and management has no clear recovery plan.
The biggest problem isn’t always the attack itself. It’s not knowing what to do next. So, which rules apply to your business, and how can you prepare without unnecessarily complicating cybersecurity?
Not every Cyprus company has the same cybersecurity obligations. The rules depend on your industry, business activities, size, and whether you provide certain digital products or services. Three EU frameworks are particularly relevant, and understanding the difference can save you from preparing for rules that don’t apply while overlooking those that do.
NIS2 affects businesses operating in sectors where a serious cyberattack could disrupt important services: energy, transport, healthcare, digital infrastructure, certain IT services, and other activities listed in the legislation.
Cyprus has implemented NIS2 through Law 60(I)/2025, which amended its national cybersecurity framework in April 2025. The Cyprus Digital Security Authority (DSA) oversees the relevant national requirements.
NIS2 generally distinguishes between essential entities and important entities, depending on the sector, company size, and services provided. Some organizations may be covered regardless of size.
A managed IT service provider serving several businesses may fall within the rules. A small clothing store with a basic online shop will not automatically be covered simply because it uses computers or accepts online payments.
Sensible first step: if your business operates in a potentially covered sector, confirm its status with the Cyprus Digital Security Authority and check whether national registration or notification requirements apply.
For companies covered by NIS2, cybersecurity means protecting systems, reducing risk, and ensuring essential services can continue during an incident. Article 21 of NIS2 identifies 10 areas of cybersecurity risk management. Rather than treating them as separate paperwork exercises, organize your preparation around three practical priorities.
Start with the systems you couldn’t operate without: financial records, customer databases, cloud platforms, essential operational software. Limit access to those who genuinely need it, use strong authentication, keep systems updated, encrypt data, and run regular security reviews. When an employee leaves, remove their access promptly.
Even well-protected businesses can experience incidents, so NIS2 includes business continuity, backup management, disaster recovery, and incident handling. A good recovery plan explains which systems are restored first, who makes decisions, and how staff continue essential work if the network is down. Test your backups: copies are of little use if no one knows they can be restored.
Covered businesses must also consider risks involving suppliers, service providers, and technology partners. Under NIS2, management bodies must approve and oversee cybersecurity risk-management measures. Clear decision-making arrangements help important concerns reach the right people.
NAKLAW’s corporate governance services support decision-making and accountability, complementing the separate technical and regulatory work involved in cybersecurity compliance.
When a cyberattack happens, the first few hours can make a significant difference. Your business needs to contain the problem, protect essential information, and determine whether a regulatory notification is required.
For Cyprus companies covered by NIS2, a significant incident can trigger an initial reporting deadline of just six hours under national law, shorter than the EU Directive’s general 24-hour early-warning period.
Not every suspicious email or failed login must be reported. The obligation applies to incidents that meet the applicable significance criteria, with specific rules for certain types of entities.
Contact the person responsible for cybersecurity and activate your incident-response procedure.
Work with your IT specialists to isolate affected systems where appropriate, while preserving important evidence.
Identify affected services, possible data exposure, customer disruption, and whether the incident meets reporting thresholds.
If reportable, contact the relevant authority within the applicable deadline, even if your investigation is still underway.
Restore priority services safely and record actions, findings, and communications.
For qualifying significant incidents, Cyprus’s national rules generally require the following. Trust service providers and certain circumstances have specific provisions, so confirm the correct reporting route in advance.
Submit an initial warning to the Digital Security Authority.
Provide an incident notification with an initial assessment.
Submit a final report after the incident notification, subject to the rules for ongoing incidents.
If the incident is still ongoing at the final-report stage, provide progress updates until the required final report.
NIS2 is not the only EU cybersecurity law to consider. The Cyber Resilience Act (CRA) and DORA may also apply, depending on what a company does.
CRA reporting requirements started.
Most CRA product security rules apply.
DORA requirements have applied since this date.
A Cyprus company developing smart devices needs to focus on product security. A bank must ensure its digital services can continue or recover when technology problems occur.
Begin with a focused review of your existing systems and responsibilities. You don’t need to solve every security problem in one week, but you should know which weaknesses need attention first. Identify the services your business depends on, check which legal rules apply, and ask your IT team what would happen if your most important systems became unavailable.
Check NIS2, CRA, or DORA applicability. Result: a clear view of relevant obligations.
Identify critical systems and suppliers. Result: a priority risk list.
Review access controls, backups, and incident procedures. Result: an initial security gap assessment.
Assign responsibilities and plan improvements. Result: a documented action plan.
A European Commission survey published in September 2026 found that 39% of EU employees had encountered phishing attempts at work, so staff awareness is just as important as technical safeguards.
This is a suggested preparation schedule, not a statutory compliance deadline. Businesses already subject to reporting or security obligations must meet those requirements now.
No. It mainly covers businesses in specified sectors, based on their size, activities, and other legal criteria. Some smaller organizations may also be included.
Covered entities generally must provide an initial warning within 6 hours under Cyprus’s national law, followed by further reporting within the applicable deadlines.
Potentially, yes. The CRA can apply to covered software products regardless of the manufacturer’s size, although specific provisions and support measures may differ.
No. GDPR focuses on personal data protection, while NIS2 sets broader cybersecurity risk-management and incident-reporting requirements for covered entities.
New EU cybersecurity rules give Cyprus businesses a clear reason to review how they protect essential systems, manage technology risks, and respond to incidents.
The most useful preparation starts with knowing which laws apply, who makes security decisions, and whether the business can keep operating during a serious disruption.
If you’re reviewing company responsibilities or wider ongoing corporate compliance, NAKLAW can help you discuss the corporate legal support available and determine whether additional cybersecurity expertise is needed.
Here’s a question to ask your team today: if our main systems stopped working tomorrow, would we have a plan ready, or would we have to make one up on the spot?