The effective implementation of the NIS2 Directive, as transposed into Greek law by Law 5160\/2024, requires not only the establishment of substantive cybersecurity obligations but also an effective framework for supervision, accountability and enforcement.<\/p>\n
Within this framework, the role of senior management assumes particular importance. Cybersecurity must now be embedded at the core of the organisational and strategic operation of entities falling within the scope of NIS2. The potential penalties for non-compliance are far from insignificant.<\/p>\n
Supervision<\/strong><\/p>\n The supervisory regime applicable to Entities falling within the scope of the NIS2 Directive and its implementing legislation in Greece (Law 5160\/2024) differs according to whether they are classified as Essential or Important Entities.<\/p>\n Essential Entities are subject to a comprehensive supervisory regime encompassing both preventive and reactive controls. Important Entities are subject to a simplified supervisory regime, which is activated only ex post.<\/p>\n An ex ante supervisory regime<\/strong> refers to audits and supervision carried out periodically or on an ad hoc basis without a cybersecurity incident having occurred. An ex post supervisory regime<\/strong>, by contrast, refers to audits and supervision conducted following the occurrence of an incident.<\/p>\n During ex ante and ex post audits, the Entity concerned must provide the relevant evidence, indications or information necessary to demonstrate its compliance with the applicable requirements, in accordance with the principle of accountability.<\/p>\n The competent authority responsible for supervision, audits and the imposition of penalties under Law 5160\/2024 is the National Cybersecurity Authority<\/strong>, which has the necessary powers and means to exercise these responsibilities.<\/p>\n Responsibility & Role of Senior Management<\/strong><\/p>\n Senior management means any natural person who, as applicable, is responsible for or acts as the legal representative of the Entity by virtue of their authority to represent it, has the authority to take decisions on its behalf, or exercises control over it.<\/p>\n The regulatory framework established by the NIS2 Directive, as transposed into Greek law, places particular emphasis on the obligations and accountability of senior management, effectively bringing cybersecurity into the boardroom.<\/p>\n Compliance with the requirements of the legislation is no longer treated as a purely technical matter. It is a matter of management responsibility and corporate governance. Effective implementation and compliance therefore require senior management to adopt a strategic approach and actively participate in the design, implementation, supervision and evaluation of compliance measures.<\/p>\n More specifically, the senior management of in-scope Entities, pursuant to Article 14 of Law 5160\/2024:<\/p>\n (a)<\/strong> approves the cybersecurity risk-management measures adopted by the Entity;<\/p>\n (b)<\/strong> oversees their implementation;<\/p>\n (c)<\/strong> undertakes training providing the knowledge and skills necessary to assess, adopt and monitor relevant decisions. This does not, of course, mean that members of senior management must become cybersecurity specialists. They must, however, possess sufficient knowledge to participate meaningfully in relevant discussions and make informed decisions;<\/p>\n (d)<\/strong> ensures that the Entity provides similar training to its employees on a regular basis, enabling them to acquire sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the Entity; and<\/p>\n (e)<\/strong> is accountable for breaches by the Entity of the obligations provided for in Article 14.<\/p>\n These obligations of senior management are further specified in Article 4 of Joint Ministerial Decision 1689\/30.4.2025 (Government Gazette B\u0384 2186\/6.5.2025).<\/p>\n There may be circumstances in which enforcement measures imposed by the National Cybersecurity Authority prove ineffective or the Entity fails to respond effectively within the prescribed period.<\/p>\n In such cases, the Governor of the National Cybersecurity Authority has the power to temporarily prohibit any natural person responsible for discharging managerial responsibilities at chief executive officer or legal representative level within an Essential Entity from exercising managerial functions.<\/p>\n Any temporary suspension or prohibition imposed applies only until the Entity concerned takes the necessary measures to remedy the deficiencies or comply with the requirements of the competent authority.<\/p>\n Information and Communication Systems Security Officer<\/strong><\/p>\n As part of its organisational compliance obligations, senior management must appoint an employee of the Entity as its Information and Communication Systems Security Officer (ICSSO)<\/strong>, who:<\/p>\n (a)<\/strong> acts as the point of contact and cooperates with the National Cybersecurity Authority and the competent CSIRT;<\/p>\n (b)<\/strong> coordinates and oversees the Entity’s compliance with obligations arising under European and national legislation concerning the security of network and information systems;<\/p>\n (c)<\/strong> supervises the implementation of the Entity’s Unified Security Policy and compliance with the basic security requirements, as well as the training and awareness of employees on information and network security;<\/p>\n (d)<\/strong> prepares the Entity’s self-assessment report to be submitted to the National Cybersecurity Authority; and<\/p>\n (e)<\/strong> attends audits conducted by the Inspection and Audit Team appointed by the National Cybersecurity Authority and provides all appropriate means necessary to facilitate its work.<\/p>\n As regards the qualifications and incompatibilities applicable to the ICSSO, pursuant to Ministerial Decision 1899\/27.6.2025 (Government Gazette B\u0384 4250\/5.8.2025), the following should be noted:<\/p>\n (a)<\/strong> The ICSSO must possess sufficient knowledge of the Entity’s business processes and satisfy at least one of the following minimum qualification requirements:<\/p>\n iii.<\/strong> certified knowledge of methodologies, procedures, techniques, tools and standards relating to information and digital systems security, together with at least two years of expertise in information and network security or cybersecurity.<\/p>\n (b)<\/strong> A person may not be appointed as ICSSO where they have previously been irrevocably convicted of at least one of the offences referred to in Article 6 \u00a7\u00a71 and 2 of Law 5002\/2022 or Articles 292A\u2013293 and 370\u2013370F of the Greek Criminal Code. To demonstrate the absence of such an impediment, Entities must require the prospective ICSSO to provide a copy of their criminal record.<\/p>\n (c)<\/strong> The duties of the ICSSO are incompatible with those of the Data Protection Officer (DPO) under Article 37 of the General Data Protection Regulation and Articles 7 and 8 of Law 4624\/2019, as well as with those of the person responsible for the Entity’s information and communication technologies (ICT) and electronic governance functions.<\/p>\n Finally, the ICSSO’s role within the organisational structure of the Entity must be independent and must not give rise to conflicts of interest with any other employment roles held by that person.<\/p>\n Penalties<\/strong><\/p>\n The sanctions framework established by the NIS2 Directive, as further specified by Law 5160\/2024, is intended to ensure a high level of cybersecurity through proportionate, effective and dissuasive enforcement measures.<\/p>\n Penalties vary according to the seriousness of the infringement and whether the Entity is classified as Essential or Important.<\/p>\n In addition to specific administrative measures\u2014such as temporary suspensions and prohibitions under Article 24\u2014the following financial penalties may be imposed:<\/p>\n (a) Failure to implement cybersecurity risk-management measures or comply with incident-reporting obligations<\/strong><\/p>\n Where an Entity fails to implement appropriate cybersecurity risk-management measures, implements inadequate measures, or breaches its security incident-reporting obligations\u2014that is, where Articles 15 or 16 are infringed\u2014a fine may be imposed of:<\/p>\n whichever is higher.<\/p>\n (b) Failure by management to approve and supervise cybersecurity risk-management measures<\/strong><\/p>\n Where management fails to comply with its obligation to approve cybersecurity risk-management measures and supervise their implementation\u2014that is, where Article 14 \u00a71 is infringed\u2014a fine of up to \u20ac200,000<\/strong> may be imposed.<\/p>\n (c) Failure to undertake or provide cybersecurity training<\/strong><\/p>\n Where management fails to undertake cybersecurity training or to ensure that relevant training is provided to the Entity’s employees\u2014that is, where Article 14 \u00a72 is infringed\u2014a fine of up to \u20ac100,000<\/strong> may be imposed.<\/p>\n (d) Failure to register<\/strong><\/p>\n Failure to register with the Register of Entities\u2014that is, an infringement of Article 19\u2014may result in a fine of up to \u20ac200,000<\/strong>.<\/p>\n (e) Failure to maintain a specific domain name registration database<\/strong><\/p>\n Failure to maintain the specific domain name registration database required under Article 20 may result in a fine of up to \u20ac800,000<\/strong>.<\/p>\n (f) Failure to notify participation in an information-sharing arrangement<\/strong><\/p>\n Failure to promptly notify the National Cybersecurity Authority of participation in, or withdrawal from, an information-sharing arrangement\u2014that is, an infringement of Article 21 \u00a73\u2014may result in a fine of up to \u20ac100,000<\/strong>.<\/p>\n\n
\n