NIS 2 Status in Greece
What the directive requires, how Greece transposes it, and where the National Cybersecurity Authority sits in the picture.
Overview
The NIS 2 Directive is the EU layer. It binds every Member State, Greece included, with a single minimum level for essential and important entities. Greece had to translate that level into Greek law and operate a supervisor underneath.
Greece transposes NIS 2 through Law 5160/2024, published in Government Gazette A' 195 on 27 November 2024. The text arrived after the EU deadline of 17 October 2024, which is why Greece appears on the European Commission's November 2024 letter of formal notice list. The infringement procedure was closed after the law entered into force.
De Nationale Cyberbeveiligingsautoriteit (Εθνική Αρχή Κυβερνοασφάλειας), onder toezicht van het Ministerie van Digitaal Bestuur, is het centrale contactpunt, de bevoegde autoriteit en het nationale CSIRT (EL-CSIRT). Voor entiteiten van het openbaar bestuur treedt het Nationale CERT van de nationale inlichtingendienst (EYP) op als CSIRT.
EU directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. It sets the obligations every Member State must transpose, including the size and sector test for essential and important entities.
EU implementing act
Implementing Regulation (EU) 2024/2690
Technische en methodologische eisen voor DNS-aanbieders, TLD-registers, cloud-, datacenter- en CDN-aanbieders, aanbieders van beheerde (beveiligings)diensten, online marktplaatsen, zoekmachines, sociale netwerken en verleners van vertrouwensdiensten. Rechtstreeks van toepassing in Griekenland zonder nationale omzetting.
Greek transposition
Law 5160/2024, Government Gazette A' 195 of 27 November 2024
Greece's NIS 2 transposition. It designates the National Cybersecurity Authority, defines essential and important entities, sets supervisory powers, reporting duties and sanctions. Secondary acts and authority guidance fill in operational detail.
Law 5160/2024
Brings NIS 2 obligations into Greek law. Defines essential and important entities, the supervisory powers of the National Cybersecurity Authority, incident reporting duties and sanctions. Operational detail is set by secondary acts and authority guidance.
National Cybersecurity Authority as supervisor and contact point
The Εθνική Αρχή Κυβερνοασφάλειας, sitting under the Ministry of Digital Governance, is the single point of contact, the national competent authority and the addressee for cooperation with ENISA and other Member States. Sector regulators keep their role where lex specialis applies, in particular in finance under DORA.
Registration and reporting
Entiteiten registreren zich bij de Nationale Cyberbeveiligingsautoriteit op haar digitale platform via gov.gr (inloggen met taxisnet). De registratietermijn is twee keer verlengd en eindigde op 30 september 2025; entiteiten die later binnen de reikwijdte vallen, registreren zich via hetzelfde platform. Significante incidenten worden gemeld aan het CSIRT van de autoriteit (incident@cyber.gov.gr); entiteiten van het openbaar bestuur melden aan het CSIRT van de EYP en informeren de autoriteit. De melding volgt de richtlijn: vroege waarschuwing binnen 24 uur, melding binnen 72 uur, eindrapport binnen een maand.
In Greece, Greek law applies
Activities on Greek territory follow the Greek transposition. A German managing director with a Greek subsidiary reads Law 5160/2024 for that subsidiary, not the BSIG. The directive obligations are identical. The procedure, the contact point and the sanctions sit in Greek law.
Greece cannot fall below the EU floor
The directive is minimum harmonisation. Greece may go stricter. Greece may not fall below the directive, neither on obligations for essential and important entities, nor on reporting deadlines, nor on management body accountability.
National Cybersecurity Authority
Lead competent authority, single point of contact and supervisor under the Ministry of Digital Governance. Handles registration, guidance, audits and sanction proposals. Carries the cooperation channel into ENISA and the NIS Cooperation Group.
EL-CSIRT (Nationale Cyberbeveiligingsautoriteit)
Onder wet 5160/2024 is de Nationale Cyberbeveiligingsautoriteit zelf het nationale CSIRT en ontvangt zij incidentmeldingen op incident@cyber.gov.gr. Entiteiten van het openbaar bestuur melden in plaats daarvan aan het Nationale CERT van de nationale inlichtingendienst (EYP). De Griekenlandpagina van de Commissie noemt nog het eerdere CSIRT van de strijdkrachten uit de NIS 1-periode.
ENISA
The EU cybersecurity agency. Publishes guidance, runs the European vulnerability database and coordinates across borders. No supervisor for Greek entities. That role sits with the National Cybersecurity Authority.
Our German parent is compliant under BSIG, so the Greek subsidiary is covered.
The Greek subsidiary follows Law 5160/2024, registers with the Greek authority and reports incidents to the Greek contact point. The directive obligations match. The procedure, portal and sanctions sit in Greek law. Group-level documentation helps but does not replace the local registration and reporting channel.
Greece was late, so registration does not apply yet.
Law 5160/2024 entered into force on 27 November 2024. The transposition delay does not suspend the directive's substantive obligations. Once an entity meets the size and sector test, registration, incident reporting, supply chain duties and management body accountability run on the directive's clock.
Only the sectors listed in the old NIS 1 regime are in scope.
NIS 2 widens the sector list beyond NIS 1. Wastewater, food production, manufacturing of medical devices, postal and courier services, public administration and several digital sub-sectors come in fresh. Each entity in Greece has to run the new sector and size test, not the NIS 1 list.
Most Greek mid-market operators we meet still read NIS 2 as a continuation of NIS 1. The supervisor sits in the same ministry, but the scope is wider and the management body sits on the hook personally. The Greek managing director, the διαχειριστής or νόμιμος εκπρόσωπος, signs off on risk management and on their own training.
The practical step is the same as everywhere in the EU: run applicability against the directive, register with the national authority, set up the four ongoing duties (keep registration data current, incident reporting, supply chain risk, management body oversight) and document the minimum. The late transposition does not change that ordering.
- Directive (EU) 2022/2555 (NIS 2), EUR-Lex
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- Law 5160/2024, Government Gazette A' 195 of 27 November 2024
- National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας), Ministry of Digital Governance
- European Commission, NIS 2 Directive country page for Greece (digital-strategy.ec.europa.eu)
- European Commission, November 2024 letter of formal notice on NIS 2 transposition
- Besluit 1990/2025 van de Nationale Cyberbeveiligingsautoriteit (ΦΕΚ Β' 4241/04.08.2025), registratietermijn
In de praktijk
Wat de nationale wet verandert, en wat niet
De nationale wet bepaalt onder meer waar u zich registreert en aan wie u incidenten meldt. De maatregelen zelf gaan in elke lidstaat uit van dezelfde minimumlijst (art. 21 NIS 2). De begeleide doorloop neemt u er stap voor stap doorheen:
De doorloop zelf is in het Duits en het Engels.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Moet u zich met NIS2 bezighouden?
We begeleiden u stap voor stap. U vult in, wij leggen elk punt in eenvoudige woorden uit, en aan het eind tekent de directie.
