NIS2 Cyprus: Essential or Important Entity? A Self-Check

NIS2 applies to a Cyprus company that operates in a sector listed in Annex I or Annex II of Directive (EU) 2022/2555 and is at least medium-sized, or that falls into a small set of categories caught regardless of size. Whether you are an essential or important entity then decides how the Digital Security Authority supervises you and how high the fines can go.

Does NIS2 apply to my company in Cyprus, and how do I check?

You check with two questions, in this order: is your activity listed in Annex I or Annex II of the directive, and are you at least a medium-sized enterprise? Two yeses put you in scope. A yes and a no put you out, unless you fall into one of the size-independent categories covered below.

NIS2 replaced the first NIS Directive, which Cyprus implemented through Law 32(I)/2018. Under that law the Digital Security Authority (DSA) designated a short list of operators of essential services in energy, transport, banking, financial market infrastructure, health, water and digital infrastructure. NIS2 has no automatic carry-over, but those operators will mostly fall back into scope under its sector-and-size test.

NIS2 also reaches much further. It adds sectors, replaces case-by-case designation with a size rule, and makes boards accountable. That is why companies the DSA never contacted under NIS1 are now getting supplier questionnaires and registration notices.

The DSA sits under the Deputy Ministry of Research, Innovation and Digital Policy. It is the national competent authority and single point of contact, and it hosts CSIRT-CY. Cyprus missed the EU transposition deadline of 17 October 2024, so confirm the national law, its entry-into-force date and any sector co-regulators with the DSA. This article explains the directive; the Cyprus text decides the details.

Which Cyprus sectors sit in Annex I and which sit in Annex II?

Annex I lists the sectors of high criticality. Annex II lists the “other critical” sectors, as the directive calls them. Your annex is the main driver of whether you end up essential or important.

Annex I (high criticality):

• Energy, transport (air, rail, water, road) and water (drinking water and wastewater)
• Banking (credit institutions) and financial market infrastructure (trading venue operators, central counterparties)
• Health
• Digital infrastructure: internet exchange points, DNS providers, TLD registries, cloud computing, data centers, CDNs, trust service providers and public electronic communications
• ICT service management (B2B): managed service providers and managed security service providers
• Public administration and space ground infrastructure

Annex II (other critical):

• Postal and courier services, waste management, chemicals, food production and distribution
• Manufacturing of medical devices, electronics, machinery and vehicles
• Digital providers: online marketplaces, search engines and social networks
• Research organizations

Notably missing from both lists: legal and accounting firms, most real estate, general retail, hospitality, gambling, and plain software or SaaS vendors that are not cloud, data center, CDN or managed service providers.

The MSP line matters on this island. A Limassol IT company that runs servers, networks or security monitoring for clients under contract is an Annex I entity if it passes the size test, even if it thinks of itself as a small consultancy.

What is the NIS2 size threshold, and is it employees or turnover?

NIS2 catches entities that are medium-sized or larger under Article 2 of the Annex to Commission Recommendation 2003/361/EC. An enterprise is small if it has fewer than 50 staff and either its annual turnover or its balance sheet total is no more than €10m. Flip that around and you are medium or above if you have 50 or more staff, or if both your turnover and your balance sheet exceed €10m.

That is the OR/AND trap. A trading company with 20 staff, €30m turnover and a €6m balance sheet is still small. Group structure and headcount rules can also change the answer:

• Group aggregation. Partner and linked enterprises count toward headcount and financials, so a 30-person Cyprus subsidiary of a large group is usually not small.
• Annual work units. Headcount is measured in annual work units, so part-time and seasonal staff count pro rata.

A short list of entities is in scope whatever their size: qualified trust service providers, TLD registries, DNS service providers and public administration at central level (regional level depends on national choice).

The state can also designate entities regardless of size, for example the sole provider of a critical service in Cyprus or an entity identified as critical under the CER Directive (EU) 2022/2557.

NIS2 in Cyprus: essential or important entity, and what changes?

Essential entities are, first, Annex I entities that exceed the medium-sized ceilings in the same Recommendation. Read the same way as the small-firm test, that means 250 or more staff, or both turnover above €50m and a balance sheet above €43m.

Qualified trust service providers, TLD registries and DNS providers are essential regardless of size; medium-sized-or-larger telecoms, central government and designated critical entities are also essential.

Everything else in scope is important, including medium-sized Annex I companies and every qualifying Annex II company. Annex I does not automatically mean essential. A 120-person Cypriot MSP with €20m turnover sits in Annex I and is still an important entity.

Dimension	Essential entity	Important entity
Typical profile	Large Annex I entity, plus QTSPs, TLD/DNS, medium+ telecoms, central government, designated entities	Medium-sized Annex I entity, or any in-scope Annex II entity
Risk measures (Art. 21)	Same 10 minimum measures	Same 10 minimum measures
Incident reporting (Art. 23)	24h / 72h / one month	24h / 72h / one month
Supervision	Proactive (Art. 32): inspections, audits, security scans, evidence requests without a prior incident	Reactive (Art. 33): triggered by evidence or indications of non-compliance
Fine ceiling, at least (Art. 34)	€10m or 2% of worldwide turnover, whichever is higher	€7m or 1.4% of worldwide turnover, whichever is higher
Manager suspension	Possible under Art. 32(5)	Not provided for in the directive

The core obligations are identical. What differs is the supervision regime, the fine ceilings, and how likely the DSA is to examine your evidence before anything goes wrong.

Penalties and management liability

The Article 34 figures are the lowest maximum fines national law must allow. Cyprus may have set higher amounts or added periodic penalty payments, so quote the national text to your board, not the directive.

Management is directly exposed. Article 20 requires the management body to approve the risk measures, oversee their implementation and take cybersecurity training, and it makes the body liable for breaches. For essential entities, Article 32(5) lets authorities seek a temporary ban on a CEO or legal representative exercising managerial functions.

In practice, the board needs three records: a dated approval of the risk-management plan, a test and remediation summary at least yearly, and its own training records.

How do DSA registration and CSIRT-CY incident reporting work?

Registering with the Digital Security Authority

You give the DSA your entity name, address and current contact details (including email, telephone and IP ranges), your Annex sector and subsector, and the other Member States where you provide services. Under the directive, Member States had to compile their entity lists by 17 April 2025. Changes must be reported within two weeks, and the list is reviewed at least every two years.

DNS, TLD, cloud, data center, CDN, MSP, MSSP and digital-provider entities submit additional details under Article 27. Because Cyprus transposed late, its registration window and portal may not match the EU dates, so confirm the current form and deadline with the DSA.

Keep two internal records: who owns the registration, and which events trigger an update (new IP ranges, a new country of operation, a merger). Registration does not make you compliant. It tells the supervisor you exist, and inspectors often check it against your actual footprint first.

Reporting significant incidents to CSIRT-CY

An incident is significant if it has caused, or can cause, severe operational disruption or financial loss, or considerable material or non-material damage to others. Essential and important entities report these in three stages:

• Early warning within 24 hours of becoming aware, stating whether you suspect unlawful or malicious action or cross-border impact.
• Incident notification within 72 hours of becoming aware, with an initial assessment of severity, impact and, where available, indicators of compromise.
• Final report within one month of the incident notification (not of the incident itself), covering root cause, mitigation and cross-border effects. The CSIRT or authority may request an intermediate report before then.

Reports go to CSIRT-CY or the competent authority, depending on the Cyprus routing rules, so confirm your sector’s channel in advance. The 24-hour clock starts when you become aware of a significant incident, not when the investigation ends.

An internal SLA of “triage within 72 hours” misses the first deadline by design. Rewrite the runbook so that a named person sends the early warning as soon as a significant incident is suspected.

Does NIS2 apply to CySEC firms, EMIs, iGaming or shipping in Cyprus?

CySEC firms, EMIs and CASPs: DORA comes first

For most regulated Cyprus financial firms, DORA (Regulation (EU) 2022/2554), applicable since 17 January 2025, governs ICT risk. Article 4 of NIS2 says that where a sector-specific EU act imposes cybersecurity and reporting requirements at least equivalent in effect, the matching NIS2 provisions, including supervision, do not apply. DORA is that act for finance.

• Credit institutions, trading venues and CCPs are listed in Annex I but handled under DORA in practice, supervised by the Central Bank of Cyprus or CySEC.
• Investment firms, payment institutions, EMIs, fund managers and MiCA-licensed CASPs are not in the NIS2 annexes at all. DORA is their regime.
• Their ICT suppliers are different. A Cyprus MSP or data center serving those firms can be a NIS2 entity in its own right and also face DORA contract terms passed down by its clients.

DORA’s testing burden is heavier: an annual testing program for critical systems and, for firms identified by their regulator, threat-led penetration testing at least every three years. We cover the overlap in what Cyprus financial firms must test under DORA, NIS2 and CySEC.

iGaming operators

Gambling is not listed in either annex, so a Cyprus betting license does not by itself pull an operator into NIS2 scope. Confirm that the Cyprus law did not extend national scope before you close the question.

An iGaming group can still be caught indirectly. If it runs hosting or managed services for third parties, it can be an entity in its own right. If it supplies an in-scope entity, expect NIS2 supplier questionnaires.

Shipping companies and ports

Shipping is the opposite case, and it is often wrongly dismissed. Annex I water transport covers sea and coastal passenger and freight companies as defined by reference to Regulation (EC) 725/2004 (excluding the individual vessels they operate), port managing bodies, port facility operators and vessel traffic services.

For a Limassol ship manager, scope turns on two things: whether its activity matches the definition of a shipping company, and group-level size. What the company calls itself does not matter. Port operators at Limassol and Larnaca fall under the port definitions.

Shipping firms already have a cyber overlay. IMO Resolution MSC.428(98) requires cyber risk to be addressed in the ISM safety management system, and IACS UR E26 and E27 apply to newer vessels. NIS2 adds the shore side: office networks, fleet management platforms and the remote links into ships. Our maritime and shipping penetration testing covers exactly that boundary.

Does NIS2 require penetration testing, and is ISO 27001 enough?

NIS2 does not prescribe a testing frequency. Article 21 requires appropriate, proportionate measures that take account of the state of the art, including vulnerability handling (21(2)(e)) and “policies and procedures to assess the effectiveness” of those measures (21(2)(f)). An inspector who asks how you know your MFA, segmentation and patching work wants test reports, not policies.

A defensible evidence trail maps test types to clauses:

• Vulnerability scanning and patch metrics support 21(2)(e).
• External and internal penetration tests, with retests showing fixes, support 21(2)(f) and 21(2)(i) access control.
• Phishing simulation supports 21(2)(g) training.
• Supplier security reviews support 21(2)(d) supply chain.
• Red team or assumed-breach exercises show detection and incident handling under 21(2)(b) for mature essential entities.

Most teams settle on an annual test plus a test after significant change, the same cadence PCI DSS v4.0 sets for penetration testing under requirement 11.4.

ISO/IEC 27001:2022 helps but does not settle the question. Article 24 points to European certification schemes under the Cybersecurity Act, and Article 25 encourages European and international standards, so ISO is useful evidence rather than proof of compliance. It does not cover the 24-hour reporting clock, board liability or NIS2 supplier evidence. Use ISO controls 8.8 and 8.29 as the backbone and close the gaps.

A 90-day plan for a Cyprus mid-market company

Run the classification, then build evidence in the order an inspector would ask for it.

• Days 1-15: Map every legal entity in the group against Annex I and II. Compute size under 2003/361/EC with linked-enterprise aggregation. Write down the outcome and reasoning, including out-of-scope decisions.
• Days 15-30: Register with the DSA or confirm your entry is current, as described above. Name an owner for the 24-hour early warning and confirm the reporting channel.
• Days 30-60: Run a gap assessment against the ten Article 21 measures. Run an external and internal penetration test, prioritizing internet-facing services and identity.
• Days 60-90: Fix critical and high findings and retest. Send supplier questionnaires to key ICT providers. Present the results to the board for formal approval.

If classification shows DORA rather than NIS2, or both in different group entities, our NIS2 and DORA compliance readiness work separates the two tracks so you do not test or report twice.

FAQ

Does NIS2 apply to small companies in Cyprus?

Usually not. Companies below the medium-size threshold are out of scope unless they are qualified trust service providers, TLD registries, DNS providers, central public administration bodies or entities specifically designated by the state.

Is a medium-sized Annex I company an essential entity?

No. Under Article 3 of NIS2, Annex I entities are essential only when they exceed the medium-sized ceilings, unless they fall into a size-independent category. A medium-sized Annex I company is an important entity.

Does NIS2 apply to Cyprus EMIs and CySEC investment firms?

Generally no. They are not listed in the NIS2 annexes and fall under DORA, which acts as the sector-specific regime under NIS2 Article 4. Their ICT suppliers may still be NIS2 entities.

Is iGaming covered by NIS2 in Cyprus?

Gambling is not listed in Annex I or II, so a betting license alone does not create NIS2 obligations. Check the Cyprus transposing law for any national extension, and remember that hosting or managed services for third parties can bring a group into scope.

How often should a NIS2 entity run a penetration test?

NIS2 sets no fixed frequency. Annual testing plus testing after significant changes is the common, defensible baseline, provided each test leads to tracked remediation and a retest.

Does a Cyprus subsidiary of a non-EU group need to register?

Usually yes, if the subsidiary is established in Cyprus, operates in an Annex I or II sector and passes the size test. Linked-enterprise rules count group headcount and financials, so a small local team can still qualify. For DNS, cloud, data center, MSP and similar digital entities, Article 26 assigns jurisdiction by main establishment, so confirm which Member State supervises you.

Once you know your label, the next question is whether your evidence would survive a DSA request. Our NIS2 penetration testing in Cyprus maps every test and retest to the Article 21 clause it proves.