NIS2 in Cyprus: why your incident plan needs a six-hour clock

Most NIS2 guidance quotes the same timeline: 24 hours, 72 hours, one month. That is the EU directive. Member States can go further, and Cyprus has. If you are an essential or important entity here, the first deadline is much shorter than most templates assume.

What the Cypriot law says

NIS2 is transposed in Cyprus by the Security of Networks and Information Systems Law, Law 89(I)/2020, as amended by Law 60(I)/2025. The Digital Security Authority is the supervisor. For a significant incident, entities must submit:

• A warning within 6 hours of becoming aware of it, indicating where applicable whether it is suspected to be malicious or could have a cross-border impact
• An incident notification within 72 hours, with an initial assessment of severity and impact
• An intermediate report if the Authority asks for one
• A final report within one month of the notification
• Progress reports every 15 days if the incident is still ongoing at that point, with the final report following within 15 days of restoring the affected system

Trust service providers have a separate 24-hour rule for incidents affecting their services.

Why six hours changes things

An incident spotted at 7pm on a Friday needs a warning out by 1am. That is hard to do if your plan relies on someone reading email on Monday, or on a committee agreeing the wording. The warning itself can be short, so the challenge is not writing it. It is knowing who decides, and being able to reach them.

The warning can be brief. What you cannot improvise is who decides, who sends it, and how they are reached at 1am.

It reaches the boardroom

Under the Cypriot law, management bodies must approve the risk-management measures, oversee them and may be held liable for infringements. Members must also follow training, and offer similar training to employees regularly. Fines reach at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important ones, whichever is higher in each case.

Five things to do now

1. Confirm whether you are in scope, and whether you are essential or important.
2. Rewrite your incident plan around the 6-hour warning, not the 24-hour one.
3. Name an on-call decision-maker and a deputy, with authority to send the warning.
4. Prepare a short warning template and test how you will submit it to the Authority.
5. Run a tabletop exercise that starts out of hours, and brief your management on the result.

Our Cyber Security Framework Consulting builds incident playbooks around the local deadlines, and our vCISO service can lead the programme if you have no CISO of your own.

This article is general information, not legal advice.