AI312Tec
NIS2 Directive

The NIS2 Directive (EU) 2022/2555

The NIS2 Directive establishes the European Union's most comprehensive cybersecurity framework, strengthening cyber resilience across critical infrastructure and essential services. In Greece, the Directive has been transposed into national legislation through Law 5160/2024. Its primary objective is to enhance the cybersecurity posture of organizations operating in critical and important sectors by introducing mandatory governance, risk management, incident reporting, and business resilience requirements.

Scope of Application

The NIS2 Directive significantly expands the number of organizations subject to cybersecurity obligations, affecting more than 2,000 entities in Greece. It applies to medium-sized and large organizations (more than 50 employees or an annual turnover and/or balance sheet exceeding €10 million) operating across 18 critical sectors.

Organizations are classified into two categories based on their criticality.

Essential Entities

The Directive applies to organizations operating in sectors such as:

  • Energy (Electricity, Oil, Natural Gas, Hydrogen)
  • Transport (Air, Rail, Maritime and Road)
  • Banking & Financial Market Infrastructures
  • Healthcare (Hospitals, Pharmaceutical Manufacturers and Medical Device Providers)
  • Drinking Water & Wastewater
  • Digital Infrastructure (Cloud Service Providers, Data Centres and Telecommunications Providers)
  • Public Administration

Important Entities

The Directive also applies to organizations operating in sectors including:

  • Postal & Courier Services
  • Waste Management
  • Chemical Manufacturing, Production & Distribution
  • Food Production, Processing & Distribution
  • Manufacturing & Industrial Production
  • Digital Service Providers (Online Marketplaces, Search Engines and Social Media Platforms)
The Four Core Compliance Pillars

A comprehensive cybersecurity governance framework

Executive Accountability

Cybersecurity becomes a board-level responsibility. Executive management and Board Members are responsible for approving, overseeing and continuously reviewing cybersecurity risk management measures. The Directive introduces executive accountability, mandatory cybersecurity training for senior management and significant financial liability for non-compliance. Failure to comply may result in administrative fines of up to €10 million or 2% of the organization's worldwide annual turnover, whichever is higher.

Cyber Risk Management Measures

Organizations must implement appropriate technical, operational and organizational security measures, including:

  • Information Security Policies
  • Supply Chain Security
  • Business Continuity & Disaster Recovery
  • Crisis Management Procedures
  • Encryption & Multi-Factor Authentication (MFA)
  • Identity & Access Management (IAM)
  • Privileged Access Management (PAM)
  • Endpoint Detection & Response (EDR)
  • Extended Detection & Response (XDR)
  • Security Information & Event Management (SIEM)
  • Appointment of a Chief Information Security Officer (CISO)

These measures aim to establish a proactive cybersecurity strategy capable of preventing, detecting and responding to cyber threats.

Incident Reporting Obligations

Organizations must report significant cybersecurity incidents to the National CSIRT according to a strict reporting timeline:

  • Within 24 Hours – Early Warning Notification
  • Within 72 Hours – Initial Incident Notification including a preliminary assessment
  • Within One Month – Final Incident Report detailing the root cause, impact assessment and remediation measures

Registration Requirements

Organizations falling within the scope of the Directive are required to register with the official Registry of Obligated Entities maintained by the Hellenic National Cybersecurity Authority.

Audits & Administrative Penalties

Enforcement and non-compliance consequences

The NIS2 Directive grants national competent authorities the power to conduct:

  • On-site Audits
  • Security Assessments
  • Compliance Inspections
  • Third-Party Security Audits

Non-compliance may lead to significant administrative sanctions. Authorities may also impose additional corrective measures, including temporary suspension of operating authorizations or restrictions on executive management responsibilities until full compliance has been achieved.

Entity CategoryMaximum Administrative Fine
Essential EntitiesUp to €10 million or 2% of worldwide annual turnover (whichever is higher)
Important EntitiesUp to €7 million or 1.4% of worldwide annual turnover (whichever is higher)
Recommended Steps Towards NIS2 Compliance

A structured cybersecurity roadmap

Organizations preparing for NIS2 compliance should establish a structured cybersecurity roadmap that includes:

  1. 1
    Conducting a comprehensive Gap Analysis
  2. 2
    Performing an organization-wide Cyber Risk Assessment
  3. 3
    Developing an Incident Response Plan
  4. 4
    Implementing Business Continuity & Disaster Recovery procedures
  5. 5
    Strengthening Identity & Access Management (IAM) controls
  6. 6
    Deploying advanced cybersecurity technologies such as EDR, XDR, SIEM and MDR
  7. 7
    Appointing a qualified Chief Information Security Officer (CISO)
  8. 8
    Delivering continuous Cybersecurity Awareness Training to employees
  9. 9
    Establishing a continuous compliance and governance framework aligned with the NIS2 Directive
Book a NIS2 readiness call