Resources / Public sector
Municipalities after 27 November
Updated 2 November 2026
From 27 November 2026 Law 5160/2024 applies to first tier local authorities, the municipalities, whatever their size (Article 3(2)(στ)(στβ))[1][2].
What the ΕΑΚ expects
- Registration on the ΕΑΚ's digital platform (Article 4(3))[1], with the ΥΑΣΠΕ declared there (ΥΑ 1899/2025, Article 8)[3].
- The risk-management measures of Article 15, as KYA 1689/2025 sets them out[1][4].
- Incident reports to the National CERT, informing the ΕΑΚ: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Articles 10 and 16)[1].
- Management approves and oversees the measures, and its members are trained (Article 14)[1].
- Fines from €20,000 to €500,000 (Article 26(8))[1].
The ΕΑΚ's priority actions
Circular 20718 of 8 June 2026 sets the priority actions for public sector bodies that are essential entities, with a deadline for each[5].
| Action | Deadline |
|---|---|
| Register on the ΕΑΚ's registry | 30 days |
| Multi-factor authentication on administrator accounts and supplier accounts | 90 days |
| Multi-factor authentication on every other account reachable from the internet | 180 days |
| A plan to move email from on-premises servers that cannot be maintained to the cloud | 90 days |
| The move completed, or a written confirmation that the infrastructure is maintained | 10 months |
Central procurement
GRNET (ΕΔΥΤΕ ΑΕ) has run an open tender for a 36-month framework agreement titled «Ενίσχυση της κυβερνοασφάλειας των ΟΤΑ Α' βαθμού», with an estimated value of €8,246,830.65 before VAT[6].
How Vardion helps
- It checks multi-factor authentication in Microsoft 365 and Google Workspace.
- It keeps the gap analysis and the ΕΑΚ self-assessment with their evidence.
- It runs on your own server with Docker, so the data stays with the municipality.
See also Law 5160/2024 in the public sector.
Sources
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- KYA 2267/2025 (ΦΕΚ Β' 5472/14.10.2025) on when first-tier local authorities come under the law, checked 25 October 2026
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
- ΕΑΚ, circular 20718/8.6.2026 on cybersecurity measures in the public sector, checked 25 October 2026
- TED, notice 315815-2026 by GRNET (ΕΔΥΤΕ ΑΕ) for first tier local authorities, checked 2 November 2026
See Vardion for your municipality
What an attacker sees, multi-factor authentication and the ΕΑΚ's evidence, on sample data.