Pursuant to Joint Ministerial Decision 1689/2025 (Government Gazette B’ 2186), the National Cybersecurity Requirements Framework is now in effect for “essential” and “important” entities under Law 5160/2024, which transposes the NIS2 Directive into Greek legislation.
This Ministerial Decision introduces mandatory cybersecurity obligations for public and private sector organizations that provide critical services or operate in key sectors such as health, transport, digital infrastructure, energy, financial services, and more.
🔎 What is practically required:
✔ Development and implementation of cybersecurity policies and procedures
✔ Appointment of an Information Security Officer (Υ.Α.Σ.Π.Ε.)
✔ Risk assessments and penetration testing
✔ Vulnerability, incident, and supply chain management
✔ Technical measures such as encryption and access control
✔ Training and awareness for staff and senior management
📍 At Stergios Konstantinou & Associates Law Office – SGK Legal, we have already developed a comprehensive compliance checklist, mapping the requirements of the Decision article by article, including documentation examples and priority levels for each action point.
If you represent an entity subject to this regulation, now is the time to plan your compliance strategy.
🛡️ How we can support your organization:
• Gap Analysis and compliance reports
• Drafting cybersecurity policies and contract adjustments
• Legal support for the implementation of JMD 1689/2025
• Tailored training seminars for management & staff
• Strategic advisory on alignment with the NIS2 Directive (Law 5160/2024)
📩 Feel free to contact us for more information or to schedule a consultation to assess your organization’s needs.