What does the KYA ask for?

• A self-assessment every year, and after any serious incident.
• Using the guide the ΕΑΚ issues and revises.
• The results sent to the ΕΑΚ with a corrective action plan.

The decision sets no date or channel for sending it^[2]. Confirm both with the authority.

How is it scored?

Each question earns 0 to 3 points, or 0 to 4 on the 20 policy questions, times its weight. The maximum is 1,683 points, unanswered questions stay in the maximum and the percentage is banded at 25, 50 and 75. The policy questions on their own give the maturity.

How Vardion runs the self-assessment

• The 234 questions in the ΕΑΚ's original Greek, reproduced unaltered under cyber.gov.gr's CC BY-ND 4.0 licence, with the credit on every page.
• The same score as the authority's tool, tested against a set of answers measured in that tool.
• Reads and writes the file the ΕΑΚ's tool saves: answer in Vardion and open the answers in the tool, or bring into Vardion what was answered there.
• Hand sections to the colleagues who know the answers and approve each answer before it counts.

Vardion works out the compliance figures from the organisation's answers by the method the ΕΑΚ publishes. They are not the authority's determination, and Vardion gives no legal advice.

See a sample

Open a sample self-assessment file for an invented company. The file opens in the ΕΑΚ's own self-assessment tool.

What to do now

• Name who answers each section.
• Answer the 20 policy questions first, since they give the maturity.
• Write the corrective action plan for each gap, because it is sent with the results.

Sources

1. ΕΑΚ, self-assessment tool, checked 24 October 2026
2. KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026