Resources / Public sector
Law 5160/2024 in the public sector
Updated 25 October 2026
Central government bodies, the regions and, from 27 November 2026, the municipalities apply Law 5160/2024 whatever their size[1][2]. Vardion shows what an attacker sees from the internet and keeps the evidence Greece's National Cybersecurity Authority (ΕΑΚ) asks for.
Who does it apply to?
- Central government bodies, which are essential entities (Articles 3(2)(στ) and 4(1)(δ))[1].
- Second tier local authorities, the regions[1].
- First tier local authorities, the municipalities, from 27 November 2026[2]. See municipalities after 27 November.
Where do you report an incident?
To the National CERT of the ΕΥΠ's Cyberspace Directorate, informing the ΕΑΚ at the same time (Articles 10 and 16). The deadlines are those of every entity: an early warning within 24 hours, a notification within 72 hours and a final report within one month[1].
What are the fines?
From €20,000 to €500,000 (Article 26(8)), with no supervision or inspection fee (Article 23(1))[1]. The obligations fall personally on the members of each body's management[3].
What has the ΕΑΚ asked for since June 2026?
Circular 20718 of 8 June 2026 sets the first actions and a deadline for each[3].
| Action | Deadline |
|---|---|
| Register on the ΕΑΚ's registry | 30 days |
| Multi-factor authentication on administrator accounts and supplier accounts | 90 days |
| Multi-factor authentication on every other account reachable from the internet | 180 days |
| A plan to move email from on-premises servers that cannot be maintained to the cloud, with the servers hardened meanwhile | 90 days |
| The move completed, or a written confirmation that the infrastructure is maintained | 10 months |
The ΕΑΚ notes that these actions alone are not full compliance.
How does Vardion help?
- It checks multi-factor authentication in Microsoft 365 and Google Workspace.
- It finds the body's mail servers, RDP and VPNs from the internet, actively exploited flaws first.
- It keeps the gap analysis and the ΕΑΚ self-assessment with their evidence.
- It runs on your own server with Docker, so the data stays with the body.
For a direct award, which the law defines as an award after a market survey, we send a written offer[4].
Sources
- Law 5160/2024 (ΦΕΚ Α' 195/27.11.2024), the authority's copy, checked 24 October 2026
- KYA 2267/2025 (ΦΕΚ Β' 5472/14.10.2025) on when first-tier local authorities come under the law, checked 25 October 2026
- ΕΑΚ, circular 20718/8.6.2026 on cybersecurity measures in the public sector, checked 25 October 2026
- Law 4412/2016 as in force, Articles 2 and 118, the procurement authority's text, checked 25 October 2026
See Vardion for your body
What an attacker sees, multi-factor authentication and the ΕΑΚ's evidence, on sample data.