Resources / Guide

KYA 1689/2025 in one page

Updated 16 October 2026

Joint ministerial decision KYA 1689/2025 (ΦΕΚ Β' 2186/2025) sets the cybersecurity requirements that Greek essential and important entities must meet under Law 5160/2024, which transposes NIS2 into Greek law.

The 22 requirement articles

Articles 4 to 25 set out the requirements, each with its Greek heading.

1. Obligations and accountability of the management bodiesΥποχρεώσεις και ευθύνη των ανωτάτων οργάνων διοίκησης
2. Risk management frameworkΠλαίσιο διαχείρισης κινδύνων
3. Information security policies and proceduresΠολιτικές και διαδικασίες ασφάλειας πληροφοριώνVardion drafts all 12 in Word, in English and Greek: the information security policy and the access control, asset management, acceptable use, removable media, incident management, supply chain security, network security, security testing, backup, cryptography and physical and environmental security policies.
4. Roles, responsibilities and authoritiesΡόλοι, αρμοδιότητες και εξουσίεςVardion records the security officer's (ΥΑΣΠΕ) appointment, who they report to and where the decision is kept. Their name goes into the policy drafts.
5. Independent review of information securityΑνεξάρτητος έλεγχος ασφάλειας πληροφοριών
6. Compliance monitoring proceduresΔιαδικασίες παρακολούθησης της συμμόρφωσης
7. Human resources securityΑσφάλεια ανθρώπινου δυναμικού
8. Hardware and software asset managementΔιαχείριση υλικού και λογισμικούThe asset register combines scans, agents and cloud accounts.
9. Risk management of relationships with suppliers and ICT service providersΔιαχείριση κινδύνων από τις σχέσεις με προμηθευτές και παρόχους υπηρεσιών Τ.Π.Ε.Supplier register and weekly supplier monitoring.
10. Account management and access controlΔιαχείριση λογαριασμών και έλεγχος πρόσβασης
11. Secure configuration of hardware, software, services and networksΑσφαλής παραμετροποίηση υλικού, λογισμικού, υπηρεσιών και δικτύων
12. Secure application development principlesΑρχές ασφαλούς ανάπτυξης εφαρμογών
13. Change managementΔιαχείριση αλλαγών
14. Vulnerability handling and disclosureΔιαχείριση και γνωστοποίηση ευπαθειώνArticle 17 names vulnerability scanning, which Vardion runs on demand or on a schedule.
15. Assessment of the effectiveness of cybersecurity risk-management measuresΑξιολόγηση της αποτελεσματικότητας των μέτρων διαχείρισης κινδύνων κυβερνοασφάλειαςRequires an external penetration test at least once a year, and an internal one for essential entities. Vardion records the tests and imports the tester's findings.
16. Network securityΑσφάλεια δικτύων
17. Protection against malicious softwareΠροστασία από κακόβουλο λογισμικό
18. Cybersecurity training and awarenessΕκπαίδευση και ευαισθητοποίηση σε θέματα κυβερνοασφάλειας
19. Use of cryptographyΧρήση κρυπτογραφίας
20. Physical and environmental securityΦυσική και περιβαλλοντική ασφάλεια
21. Cybersecurity incident managementΔιαχείριση περιστατικών κυβερνοασφάλειαςIncident register with every reporting deadline.
22. Business continuity and crisis managementΕπιχειρησιακή συνέχεια και διαχείριση κρίσεωνBusiness impact analysis, playbooks and exercises.

The authority's assessment tools

The National Cybersecurity Authority (ΕΑΚ) publishes two instruments for measuring compliance.

Run both ΕΑΚ tools in Vardion

• Both tools in the authority's published Greek, with the same score the authority's method gives.
• Hand sections to the colleagues who know the answers and approve each answer before it counts.
• Turn every gap into an action with an owner and a date.
• Open your self-assessment answers in the authority's online tool, or bring its saved file into Vardion.