Cyprus and Malta NIS2 Implementation Guide: Laws, regulators, reporting clocks and fines compared

Cyprus and Malta have both transposed NIS2, but a group with entities on both islands will meet two different legal routes, two regulators and, most importantly, two different incident clocks: Cyprus asks for an early warning within 6 hours, Malta within 24. Cyprus amended its 2020 network and information systems law in April 2025, while Malta adopted a ministerial Order in April 2025 that only commenced in January 2026. This guide covers each country in alphabetical order: the law, its status, the authority, scope, registration, security measures, incident reporting, management duties and sanctions. It then sets out how to run one programme across both, and what it means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Cypriot or Maltese operations. The Directive itself is explained in the NIS2 Directive Guide and every Member State's status sits in the NIS2 Transposition Tracker; this page goes into the national detail. Countries are listed alphabetically.

Key takeaways

• Both laws are in force. Cyprus Law 60(I)/2025 applies from its publication in the Official Gazette on 25 April 2025; Malta's Order (Subsidiary Legislation 460.41) commenced in full on 23 January 2026.
• Cyprus has the tighter clock. The Cypriot law requires an early warning within 6 hours of becoming aware of a significant incident and progress reports every 15 days for ongoing incidents, while Malta follows the Directive's 24 hours, 72 hours and one month.
• Different regulators, one per island. Cyprus supervises through the Digital Security Authority (DSA), which also hosts the national CSIRT; Malta supervises through the Critical Infrastructure Protection (CIP) Department, with the Malta Communications Authority covering digital infrastructure and postal services.
• Fines follow the Directive ceilings. Both set maximum fines of EUR 10 million or 2 per cent of worldwide turnover for essential entities and EUR 7 million or 1.4 per cent for important entities, whichever is higher; Malta adds a periodic penalty of EUR 100 per day.
• Boards carry the duty. In both countries the management body must approve the risk measures, oversee them and complete training, and both laws provide for personal accountability of managers.

The two laws at a glance

Cyprus

Status (checked 14 November 2026): in force. Law 60(I)/2025 was published in the Official Gazette of the Republic (Part I(I), No. 5036) on 25 April 2025 and, under its Article 57(1), took effect from that date. Article 57(2) leaves one provision (Article 8) to a date set by Council of Ministers notice. The DSA publishes both the amending law and a consolidated text of Law 89(I)/2020; the earlier NIS law, Law 17(I)/2018, is marked as repealed.

Authority and scope

• Regulator: the Digital Security Authority is the competent authority and runs the national CSIRT.
• Who is in scope: entities of the types in NIS2 Annexes I and II that are medium-sized or larger, plus size-independent categories such as electronic communications, trust service and DNS providers, sole providers of an essential service in Cyprus, and public administration bodies selected on a risk basis (according to PwC Legal).
• Self-check: the DSA offers an online NIS2 self-assessment tool so organisations can test whether they fall in scope, and a Greek-language summary guide to the Directive.

Registration and the entity list

The DSA keeps the list of essential and important entities and reviews it at least every two years (Article 27(3)). Entities must report changes to the details they have submitted within two weeks of the change (Article 27(4)). The Authority can also require logs and other information covering at least six months (Article 17), which matters for log retention design.

Security measures

Article 35 requires appropriate and proportionate technical, operational and organisational measures, taking account of the state of the art, relevant standards and cost, and scaled to exposure, size and the likely impact of incidents. Article 35(2) lists the Directive's minimum measures: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition, development and maintenance including vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control and asset management, and multi-factor or continuous authentication with secured communications. Article 35(3) adds supplier vulnerabilities and secure development practices. PwC Legal reports that the DSA's audit programme uses a Cybersecurity Maturity Assessment Report built on C2M2, ISO/IEC 27002 and NIST SP 800-53, completed in Greek.

Incident reporting

Affected service recipients must also be told without undue delay (Article 35B(2)). The 6 hour window is the main operational difference from the Directive, which allows 24 hours for the early warning.

Management duties and sanctions

• Board approval: top management must approve the risk-management measures, oversee their implementation and can be held accountable for breaches of Article 35 (Article 35A(1)).
• Training: management members must undergo regular training and offer similar training to staff (Article 35A(3)).
• Personal liability: a natural person who represents or controls an essential entity can be held liable for breaches (Article 36A(6)), and Article 44 provides for criminal liability of responsible persons.
• Fines: maximum fines of at least EUR 10 million or 2 per cent of the previous year's worldwide turnover for essential entities, and at least EUR 7 million or 1.4 per cent for important entities, whichever is higher (Article 43A(4) and (5)). Fines can be combined with the other supervisory measures.

Malta

Status (checked 14 November 2026): in force. The Order was published as Legal Notice 71 of 2025 on 8 April 2025 but left commencement to the Minister. Legal Notice 22 of 2026, published in the Government Gazette on 23 January 2026, brought all provisions into force from that date, and legislation.mt shows a consolidated version as at 7 April 2026.

Authority and scope

• Regulator: the Critical Infrastructure Protection (CIP) Department is the national supervisory authority and single point of contact, and houses the national CSIRT. The Malta Communications Authority is the competent authority for digital infrastructure and postal and courier services.
• Who is in scope: entities of a listed type that are medium-sized enterprises or larger (Article 3(1)). Essential entities are those above the medium-sized ceilings, plus qualified trust service providers, TLD registries and DNS service providers regardless of size (Article 4(1)); other listed entities are important (Article 4(2)). PwC Legal notes that Malta does not apply Article 3(4) of the annex to Commission Recommendation 2003/361/EC when sizing entities, a deviation that can change how group companies are counted.

Registration

Essential and important entities, and domain name registration providers, register through the CIP Department's national self-registration mechanism, which the Order required to be in place by 30 October 2025. Registration covers the entity name, sector, address and contacts, Member States served, IP ranges and, under Article 24(1) for the digital categories, a detailed list of IT, network and operational technology resources. Article 7(4) also asks which CSIRT provides monitoring and whether it is internal. Changes must be reported within two weeks (Article 7(5)), or within three months for Article 24 entities.

Security measures

Article 18 makes the management body approve the measures and oversee them. Article 19(2) lists the minimum measures on an all-hazards basis, items (a) to (j) mirroring the Directive, and adds item (k), logging and traceability, which goes beyond the ten items in Directive Article 21(2). The Order does not mandate a named standard, so ISO/IEC 27001 or the Implementing Regulation's technical annex are practical baselines.

Incident reporting

Reports go to the CSIRT, and recipients of the service must be told without undue delay where a significant incident is likely to affect them. The Order also sets up coordinated vulnerability disclosure to the CSIRT; PwC Legal reports that people reporting under an entity's disclosure policy are treated as authorised for the purposes of Article 337C of the Criminal Code.

Management duties and sanctions

• Board approval and training: management bodies approve and oversee the measures, members must complete training, and staff should be trained regularly (Article 18(1), (3) and (4)).
• Manager accountability: members can be held liable for infringements of Article 19, and the authority can ask courts or tribunals to prohibit temporarily a person with managerial responsibilities until remedial action is taken (Article 31(10)(b)).
• Fines: up to EUR 10 million or 2 per cent of worldwide turnover for essential entities and EUR 7 million or 1.4 per cent for important entities, whichever is higher, for infringing Articles 19 or 20 (Article 32(3) and (4)).
• Periodic penalties: EUR 100 for each breach for each day it persists (Article 38(2)).

Running one programme across both islands

Where a group holds entities in both jurisdictions, the practical approach is to build to the stricter rule and record the national differences in one register.

Implementation sequence

1. Classify each entity using the DSA self-assessment tool for Cyprus and the Maltese size rules (remembering the Recommendation deviation), and record essential or important status with the reasoning.
2. Register or confirm listing with the CIP Department's self-registration mechanism and check the DSA entity list; assign an owner for two week change updates.
3. Rebuild the incident runbook around the 6 hour clock: on-call criteria for "significant", pre-approved early warning templates, and named authority contacts on each island.
4. Run a gap assessment against Article 35 (Cyprus) and Article 19(2) (Malta) in one control matrix; in Cyprus, prepare for the DSA maturity assessment.
5. Brief and train the boards, then minute approval of the measures for each entity.
6. Test with a tabletop that starts on a Friday evening, measures time to early warning, and checks that both CSIRT routes work. Fix, then repeat twice a year.

Measuring it

• Time to early warning: median and worst case in exercises, target under 6 hours.
• Registration accuracy: days between a change (new IP range, new contact) and the update to the authority, target under 14.
• Control coverage: share of Article 35 and Article 19(2) items with evidence.
• Board training completion: percentage of management body members trained in the last 12 months.
• Log coverage: share of in-scope systems sending logs to central storage with at least six months' retention.

What it means for AI agents and non-human identities

Both laws list access control and multi-factor or continuous authentication as minimum measures, and Malta adds logging and traceability. Those measures apply to machine access as much as to staff. Service accounts, API keys, OAuth applications and AI agents with production access are part of "access control and asset management", so keep an owned inventory of them, rotate their secrets, and make sure their actions reach the same logs the DSA or CIP Department may request. A compromised CI/CD token or agent credential that changes production systems can be a significant incident, and in Cyprus the 6 hour clock starts when you become aware of it, so detection for anomalous machine identity behaviour needs to feed the same triage queue. See the NIS2 Implementing Regulation 2024/2690 Guide for the control detail.

Common failure patterns

• Copying a 24 hour runbook into Cyprus: group playbooks written to the Directive miss the 6 hour early warning and the 15 day progress cadence.
• Treating the 2025 Maltese Order as dormant: teams that noted Malta's Order "not yet in force" in 2025 may not have revisited it after the 23 January 2026 commencement.
• Sizing entities the general EU way in Malta: ignoring the Recommendation deviation can misclassify group subsidiaries.
• Stale registration data: IP ranges and contacts change faster than the two week window when nobody owns the update.
• Board approval without training: a minute alone does not meet either law; both require management training.
• Machine identities outside the logs: service accounts and agents that bypass central logging leave the entity unable to answer an authority request or scope an incident.

Practitioner checklist

• Confirm essential or important status for every Cypriot and Maltese entity and file the reasoning.
• Register with the CIP Department mechanism and check the DSA entity list; set a two week change process.
• Set a 6 hour early warning target group-wide and pre-draft notices for both CSIRTs.
• Add 15 day progress reporting to the Cyprus incident procedure.
• Map controls once to Cyprus Article 35 and Malta Article 19(2), including logging and traceability.
• Retain logs for at least six months across in-scope systems, including machine identity activity.
• Minute board approval of the measures and record management training each year.
• Inventory service accounts, API keys and AI agents and include them in access reviews.
• Run a cross-island tabletop twice a year and track time to early warning.

Standards and references

• Republic of Cyprus: Law 60(I)/2025 amending the Security of Networks and Information Systems Law
• Digital Security Authority: Laws (consolidated Law 89(I)/2020)
• Digital Security Authority: NIS2 summary guide
• Laws of Malta: S.L. 460.41 Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order
• Laws of Malta: Legal Notice 22 of 2026, commencement notice
• PwC Malta: Malta's NIS2 framework comes into force
• PwC Legal: NIS-2 implementation status, Cyprus
• PwC Legal: NIS-2 implementation status, Malta

Related NHI Mgmt Group resources: NIS2 Transposition Tracker · NIS2 Directive Guide · Greece NIS2 Implementation Guide · NIS2 Readiness Checklist · Cyber Incident Reporting Requirements Map. This guide summarises the Cypriot and Maltese NIS2 laws as they stood on 14 November 2026 and is not legal advice.