NIS2 in Greece: What Greek Businesses Need to Know

NIS2 is the European Union’s cybersecurity directive for essential and important entities. Like every EU directive, it takes effect through national law, so Greek companies need to look at two things at once: what the directive requires and how Greece applies it. This guide covers the first in detail and tells you what to check on the second.

Which Greek businesses are likely to be covered?

NIS2 lists sectors of high criticality and other critical sectors. They include energy, transport (including maritime and aviation), banking and financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management for other businesses (managed service providers), public administration, space, postal services, waste management, chemicals, food, manufacturing of certain products and digital providers. In general, medium-sized and large organisations in those sectors fall in scope, and some entities are covered regardless of size.

Shipping, energy, healthcare and technology services are strong parts of the Greek economy, so a large number of Greek companies are likely to be affected, directly or as suppliers to a covered customer. A supplier that is not covered itself will often still be asked to meet NIS2-style requirements by contract.

What the directive requires

• Risk management measures that are appropriate to the risk: policies, incident handling, business continuity and backup, supply chain security, secure acquisition and maintenance, vulnerability handling, access control, multi-factor authentication and encryption.
• Management responsibility. The management body approves the measures and oversees them, and can be held accountable.
• Incident reporting. An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month.
• Penalties. The directive sets maximum fines of at least 10 million euro or 2% of worldwide turnover for essential entities, and 7 million euro or 1.4% for important entities.

What to confirm for Greece

Because the details are set nationally, confirm the following with your legal adviser and the competent Greek authority: the current status of the national law that transposes NIS2, which authority supervises your sector, how and where incidents must be reported, whether your company is classed as essential or important, and what evidence the authority expects to see. Do not wait for the final wording to start. The technical work is the same whatever the legal text says.

How to prepare now

1. Map your position. Sector, size, subsidiaries and the customers that depend on you.
2. Assess the gaps against the measures above and rank them by risk.
3. Document. Policies, an asset inventory, a risk register and an incident response plan.
4. Prepare to report. Name who detects, decides and notifies, and test the 24-hour clock with an exercise.
5. Review suppliers, especially those that run your systems or hold your data.
6. Brief your board. Directors need to understand and approve the plan.

How Guardbyte can help

Guardbyte works with businesses in Greece and Cyprus. We assess whether NIS2 or DORA applies to you, run the gap analysis and help close the gaps. Read our NIS2 and DORA compliance guide, see our compliance platform, or talk to us.

This article is general information and not legal advice. Confirm your obligations under Greek law with your legal adviser.