Three separate regulatory clocks are now running for Cyprus-regulated financial firms at the same time, and most compliance teams are still tracking them as if they were one. DORA has been fully in force across the EU since January 2025. NIS2 became Cyprus law in April 2025 under Law 60(I)/2025. And CySEC’s own ICT risk circulars, C571 and C609, have been setting capital-tier deadlines for CIFs since 2023. None of these three frameworks is optional, and none of them is satisfied by the same evidence.
DORA: threat-led testing, not a checkbox questionnaire
DORA’s Article 26 requires certain financial entities to run advanced testing based on threat intelligence, the TIBER-EU framework being the reference model across the EU. This is not a vulnerability scan and it is not an annual audit questionnaire. It’s a scoped, adversarial simulation against critical or important functions, designed to show what a real attacker chasing a specific outcome could actually reach.
The scope question trips up most firms first. DORA testing has to cover live production systems supporting critical functions, not a staging environment that resembles them. That means testing has to be planned carefully around business continuity, with rules of engagement that reflect a genuine adversary rather than a friendly scan. We cover exactly this in our DORA threat-led penetration testing service, built around the same TIBER-EU structure supervisors expect to see.
NIS2 Cyprus: a new regulator, a wider net
Cyprus’s NIS2 transposition brought in the Digital Security Authority as the supervising body, and it pulled a much wider set of organisations into scope than the previous NIS regime did. Essential and important entities under Annex I and Annex II now carry direct obligations under Article 21: risk management measures, incident reporting within tight deadlines, and the ability to show the regulator evidence of testing, not just policy documents.
For a lot of mid-sized Cyprus companies, this is the first time a cybersecurity regulation has applied to them directly rather than through a client contract. If your sector falls under NIS2 Cyprus and you haven’t yet had an independent penetration test mapped to Article 21 measures, that gap is now a supervisory one, not just an operational one. Our NIS2 penetration testing service maps findings straight back to the specific Article 21 measure each one relates to, so the report reads as compliance evidence rather than a generic vulnerability list.
CySEC ICT risk: the framework CIFs already live under
For Cyprus Investment Firms, CySEC’s Circulars C571 and C609 set out ICT risk management expectations aligned with EBA guidelines, with capital-based thresholds that determine how deep the requirements go. The original compliance deadline was 31 December 2023, with an internal audit report due by 30 June 2024, and DORA has since layered on top of that same baseline rather than replacing it.
The practical effect for most CIFs is that CySEC ICT risk and DORA testing now overlap significantly, and a well-scoped engagement can produce evidence for both at once rather than running two separate projects. That’s how we structure our CySEC ICT risk penetration testing engagements: one technical assessment, mapped to both frameworks’ documentation requirements.
Where ISO 27001 fits, and where it doesn’t
ISO 27001 is worth a specific mention because it’s the standard most often misunderstood in this stack. Annex A.8.29 requires security testing during development, but the standard itself never mandates a “penetration test” by that exact name, certification auditors accept a range of evidence. In practice, though, a genuine penetration test is still the clearest way to demonstrate Annex A.8.29 is more than a paper control, and it’s the evidence CySEC and DORA supervisors are already used to seeing. If you’re pursuing or maintaining ISO 27001 certification alongside CySEC or DORA obligations, one properly scoped test can support all three.
The practical takeaway
These three frameworks were built by different bodies on different timelines, but a Cyprus financial firm sitting under all three doesn’t need three separate testing projects to prove it. What it needs is one engagement scoped broadly enough to generate evidence each regulator recognises, run by a team that understands what CySEC, the Digital Security Authority, and DORA’s TLPT model each expect to see in the final report. Get in touch and we’ll scope it against whichever combination applies to you.