Cyprus NIS2 scope: essential and important entity assessment

Use the Cyprus 2025 law as the starting point

Cyprus transposed NIS2 through the 2025 amendment to the Security of Networks and Information Systems Law 89(I)/2020. A Cyprus company should classify itself against the consolidated national law, especially Article 2A, Article 27 and Annexes I and II. The EU directive explains the architecture but does not by itself answer every national scope or reporting question. The Digital Security Authority is the competent body that identifies and designates essential and important entities. Keep a dated copy of the national text and any designation correspondence in the compliance file.

The initial screening question is not whether a company has an IT department or holds personal data. It is whether its actual services or activities fall within a listed type, and then whether size or an exception brings it within scope. An ordinary retailer using cloud software is not automatically a cloud-computing service provider. Conversely, a managed service provider delivering ICT management to business customers should not dismiss NIS2 because its own headcount looks small. Describe the service supplied to others and the legal entity supplying it before matching a sector label.

Scope is a legal classification, not a security certification. A business outside NIS2 may still have GDPR, sectoral, contractual or product-security duties. A business inside NIS2 needs a documented risk-management and incident-reporting programme, not just a one-page memo saying it is essential or important. This guide deals with classification and first actions. The existing guides on the Cyber Resilience Act, DORA contracts and GDPR breach response cover those different regimes and should not be treated as substitutes for this national-law assessment.

For product-security obligations, compare the Cyber Resilience Act guide.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Digital Security Authority: Cyprus NIS2 transposition announcement; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Map the service to the precise Annex entry

Annex I covers high-criticality sectors such as energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, business-to-business ICT service management, public administration and space. Annex II covers other critical sectors including postal and courier services, waste management, chemicals, food production and wholesale distribution, specified manufacturing, digital providers and research. Each heading has narrower defined entity types. A company should quote the exact row it believes applies, not just a broad industry word such as “healthcare” or “technology”.

For example, Annex I includes cloud-computing and data-centre service providers, DNS service providers, managed service providers and managed security service providers. Those labels must be tested against what the entity actually offers, contracts, infrastructure and customer base. A software vendor selling an application is not necessarily a managed security service provider; a provider operating customers’ networks may be. Annex II food coverage refers to businesses engaged in wholesale distribution and industrial production and processing, not every café or small shop. The annex definitions and exclusions matter as much as the sector name.

Create a service map for each Cyprus legal entity: customer-facing offering, supporting operations, NACE or other classification, locations, contracting entity, third-party operators and countries served. Large groups should avoid treating a brand as one legal person. A group company providing an in-scope service may be covered while another group company merely buying it is not. A hybrid business can be in scope through one service even if its main revenue comes from a different line. Preserve reasons for rejected Annex rows so a later acquisition or product launch can be assessed efficiently.

For a narrower financial-firm supplier issue, see DORA ICT contract requirements.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Apply the size rule and test exceptions separately

Article 2A(1) generally covers Annex I or II entity types that qualify as medium-sized enterprises under the EU SME Recommendation or exceed the medium-sized ceilings, while operating or providing services in the Union. The SME Recommendation uses staff and financial criteria; its calculation rules require attention to partner and linked enterprises. A simple count of Cyprus payroll employees can therefore be misleading. Collect the latest headcount, turnover, balance sheet and ownership information, and record how the relevant entity is measured. Confirm the exact Recommendation method with an adviser where there are subsidiaries or controlling interests.

Size is not a universal safe harbour. Article 2A(2) lists irrespective-of-size routes for certain public electronic communications, trust, TLD and DNS providers, and for entities whose services are uniquely or critically important or whose disruption could have serious public, systemic or regional effects. Article 2A also covers specified public-administration and critical-entity cases. A small provider can therefore be in scope if it falls into one of these routes. Document why each exception is or is not relevant, particularly where a client or sector regulator regards the service as critical.

Do not equate “small” with “unregulated” based solely on a sales pitch or an external NIS2 calculator. Conversely, do not classify every supplier to a hospital as an essential healthcare entity: supplying a covered entity does not automatically make the supplier itself the listed service provider. Its own activities may still qualify through ICT management or another Annex row. Revisit the analysis after a merger, new service, new market or major change in size. A clear, dated decision file is more useful than a permanent yes/no field in a CRM.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Distinguish essential from important status

Article 27 places certain Annex I entities above the medium-sized ceiling in the essential category. It also treats qualified trust service providers, TLD registries and DNS service providers as essential regardless of size, and includes medium-sized public electronic communications providers and certain public-administration or critical-entity categories. Other in-scope Annex I or II entities that do not qualify as essential are generally important entities. The classification is therefore not the same thing as the Annex I versus Annex II label alone. A medium-sized cloud provider can be important unless another essential route applies.

The Digital Security Authority may designate entities following a criticality assessment under national criteria, and the national list is approved through a confidential Council of Ministers decision. Article 27 says the Authority serves the designation decision on the entity. The list is not a public lookup table, so absence from a website does not prove a company is out of scope. Preserve any notice, ask the Authority for guidance when the categorisation is uncertain, and avoid publishing a claimed official status that the organisation cannot evidence.

Essential and important entities both face core risk-management and significant-incident obligations; their supervision and enforcement posture differs. Board and management should therefore ask two questions: does the entity fall within scope, and what is its national designation or reasoned provisional classification? If the answer is still uncertain, do not delay basic cyber controls and incident readiness. Treat the classification memo as an accountable compliance decision with named owner, source documents, legal review date and trigger for reassessment.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Inform the Authority when a new or missed entity may be in scope

The consolidated Cyprus law requires the Authority to establish and periodically update its list of essential and important entities and domain-name-registration service providers. Article 27(4) contemplates collection of entity name, address and current contact details, relevant Annex sector and subsector, and the Member States where the relevant service is provided. Changes to submitted details must be notified without delay and in any event within two weeks. Keep a controlled contact register so an email-address change, new operations country or corporate reorganisation reaches the compliance owner rather than disappearing in a shared inbox.

Article 27B specifically says newly created entities and entities falling within Article 2A that were not included in the list must inform the Authority for assessment. Article 27A also asks newly created in-scope entities that may be identified as essential or important to inform and seek the Authority’s opinion or guidance on security measures from the design of their computer infrastructure. A startup should not wait for a surprise designation letter after it has built its service. Determine the appropriate official contact route and retain evidence of the notification and any response.

Do not invent a fixed registration deadline or use another Member State’s portal. Check the Digital Security Authority’s current notices and decisions at the time of filing. The Commission’s country page names the Cyprus Authority as the single point of contact, but its transposition-status text is a high-level tracker and should not override the later consolidated national law published by the Authority. This is particularly important because the Commission page still records a 2025 reasoned opinion. The operative classification workflow depends on current Cyprus legislation and Authority communication.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Digital Security Authority: Cyprus NIS2 transposition announcement; European Commission: NIS2 implementation in Cyprus, authority contact

Translate classification into a board-owned control programme

Once in scope, Article 35 requires proportionate technical, operational and organisational measures for network and information-system risks and their impact on service recipients. It lists risk-analysis policies, incident handling, continuity and disaster recovery, supply-chain security, secure acquisition and development, vulnerability handling, effectiveness testing, cyber hygiene and training, cryptography, access and asset management, and multi-factor or continuous authentication. Build an inventory of the specific service, systems, suppliers and failure modes before buying a generic “NIS2 compliant” package. Controls should match the risk and the Authority’s applicable decisions.

Article 35A makes the management body approve and oversee the risk-management measures and requires management training and regular employee training. Put cyber risk on the board agenda with a named accountable owner, budget, decision log and measurable remediation dates. Ask whether backup restoration has been tested, whether critical suppliers provide incident notice, whether privileged accounts use strong authentication and whether an on-call team can make a legal reporting decision. A policy library without tested operations will not carry the same weight as evidence that the controls work.

For an entity already subject to another sectoral regime, map requirements rather than assume one framework displaces the other. A Cyprus financial firm may have DORA obligations; a controller may need GDPR breach notifications; a maker of connected products may face product security rules. The underlying incident could trigger more than one legal clock and authority. The classification memo should name the legal owner for each regime and connect it to a single operational incident process, so teams do not discover the overlap only when systems are down.

If personal data is involved, add the GDPR breach-response workflow.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Build incident triage around the Cyprus reporting clock

Article 35B defines a significant incident by severe or potential operational disruption or financial loss, or considerable material or non-material damage to others. It requires an early warning to the Authority without undue delay and in any event within six hours of awareness of a significant incident. The national text then calls for an incident notification within seventy-two hours, with an initial assessment, and a final report generally within one month of that notification. Trust-service providers have a specific twenty-four-hour notification route for relevant trust-service incidents. Check Authority decisions for the detailed format and current procedure.

The six-hour Cyprus early-warning rule is easy to miss because EU-wide NIS2 summaries often say twenty-four hours. Incident playbooks for a Cyprus-designated entity should follow the applicable national law and any sector-specific instructions. Arrange 24/7 technical escalation, a threshold decision-maker, alternate contact channels, an evidence log and a prepared minimum-information template. A definitive root cause is not required for an early warning; waiting for perfect forensic certainty can consume the statutory window. The report can be updated as facts develop.

Not every malware alert is necessarily a significant incident, and a data-security event may also be reportable under GDPR or a contract even if it is not significant under Article 35B. Triage should record the service affected, current and potential disruption, customers or other persons affected, cross-border reach, awareness time and reason for the decision. Article 35B also addresses information to service recipients where appropriate. Run an exercise before the first real incident. A governance team that can classify the organisation but cannot make a timely event decision has completed only half of the job.

Keep the separate privacy clock in view with the GDPR incident guide.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II

Close the assessment with a traceable decision file

A defensible NIS2 scope memo has five exhibits: the exact Annex row and service description; the size calculation including relevant ownership; each irrespective-of-size route considered; any Authority correspondence or designation; and the board-approved next-action plan. Date the sources and identify the version of Cyprus law used. If the conclusion is outside scope, state the facts that would change it: for example, becoming a managed service provider, crossing the SME size boundary or being identified as nationally critical. This makes future reviews faster and reduces dependence on a departing compliance manager’s memory.

For a borderline group, run examples against the real contracts. A company that merely licenses accounting software has a different factual profile from one that operates customer networks as a managed service. A private clinic’s own healthcare service may trigger Annex I; its outsourced cloud supplier must be assessed on the supplier’s separate activity and size or exception. A food wholesaler may be in Annex II whereas a small café is not automatically included. These are screening examples, not categorical answers: the statutory definitions, service model, group data and national designation determine the result.

Before signing the decision, have legal, security, operations and the relevant business owner challenge the service description and exceptions. Contact the Authority where identification or notification is uncertain. Then schedule annual and event-driven reassessment, with a board-level control owner if in scope. Avoid public claims that a company is “NIS2 certified”: the law creates duties and supervision, not a single universal certificate. What matters operationally is whether the correct entity was identified, the Authority was informed when required, and the controls and reporting process can be evidenced when tested.

For cross-border cloud exit obligations, see the Data Act cloud-switching guide.

Basis and guidance: Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation; Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises; European Commission: NIS2 implementation in Cyprus, authority contact

Primary sources and scope

Sources checked: October 8, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Security of Networks and Information Systems Law 89(I)/2020, current Greek consolidation
• Digital Security Authority English consolidation of Law 89(I)/2020 with Law 60(I)/2025
• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 21 and 23, Annexes I and II
• Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises
• Digital Security Authority: Cyprus NIS2 transposition announcement
• European Commission: NIS2 implementation in Cyprus, authority contact