• gkanidis
• October 21, 2026
• No Comments

Cybersecurity Compliance Is Now a Business Resilience Issue

Cybersecurity is no longer exclusively an IT concern. Disruptions caused by cyberattacks, technology failures and third-party incidents can affect customer services, business continuity, reputation and financial performance.

For organizations operating in Greece and across the European Union, two important regulatory frameworks are the Network and Information Security Directive 2 (NIS2) and the Digital Operational Resilience Act (DORA).

In Greece, the NIS2 Directive has been transposed into national law through Law 5160/2024, which entered into force on 27 November 2024. Organizations operating in Greece should therefore assess their obligations against the applicable Greek legal and regulatory framework, rather than considering the EU Directive alone.

DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 and establishes digital operational resilience requirements for financial entities within its scope.

Both address cyber and technology-related risks, but they have different scopes and requirements. Understanding which framework applies to your organization is an essential first step towards building a proportionate compliance programme.

What Is NIS2?

NIS2 establishes an EU-wide framework for strengthening cybersecurity across a broad range of essential and important entities.

Depending on the sector, size, applicable national legislation and specific circumstances, organizations may be subject to requirements concerning:

• Risk analysis and information system security.
• Incident handling and business continuity.
• Supply-chain and third-party security.
• Vulnerability handling and security testing.
• Access control, cryptography and other protective measures.
• Management accountability and incident reporting.

NIS2 is intended to improve the overall cybersecurity and resilience of organizations whose services are important to the economy and society.

Businesses should not assume that they are in scope—or out of scope—based on their industry alone.  A documented applicability assessment that considers the legal entity, sector, size, activities and applicable Greek requirements is a sensible starting point.

What Is DORA?

DORA, the Digital Operational Resilience Act, establishes a digital operational resilience framework for financial entities within its scope.

Unlike a directive requiring national transposition, DORA is an EU Regulation and has applied since 17 January 2025.

Its objective is to help financial organizations withstand, respond to and recover from ICT-related disruptions and threats.

Its principal areas include:

• ICT risk management.
• ICT-related incident management, classification and reporting.
• Digital operational resilience testing.
• Management of ICT third-party risk.
• Information-sharing arrangements concerning cyber threats, where applicable.

DORA also includes requirements concerning contractual arrangements with ICT service providers and oversight of certain critical ICT third-party providers.

For financial organizations, compliance involves more than preventing attacks. It also requires demonstrating that technology-related risks are identified, managed and addressed through appropriate resilience arrangements.

DORA vs NIS2: Understanding the Difference

Although the two frameworks share cybersecurity objectives, they are not interchangeable.

NIS2 provides a broader cybersecurity framework for covered entities across multiple sectors.

DORA establishes more specific digital operational resilience requirements for financial entities within its scope.

Some organizations may need to assess both frameworks, while others may primarily fall under one. The relationship between the frameworks, including applicable exclusions and overlapping requirements, must be evaluated in the context of the organization and the relevant legislation.

A compliance assessment should therefore establish the applicable framework before translating requirements into operational controls.

Five Practical Priorities for Greek Organizations

1. Confirm Regulatory Applicability

Identify the legal entity, sector, size, activities and jurisdiction relevant to your operations. Determine whether the organization falls within the applicable NIS2 national framework, DORA or another relevant regulatory regime.

Where the answer is unclear, obtain appropriate legal or regulatory advice.

2. Assess Your Current Cybersecurity Posture

Review existing policies, technical controls, incident response procedures, continuity arrangements and supplier-management practices.

Compare the current state with the requirements that apply to your organization. Record gaps, owners, priorities and target completion dates.

3. Strengthen Incident Response

An incident response plan should clearly define roles, escalation paths, communication procedures and decision-making responsibilities.

Test the plan through realistic exercises. Confirm that security teams, management, legal advisers and relevant business stakeholders understand their responsibilities.

Incident classification and reporting timelines must be mapped to the specific rules applicable to the organization.

4. Review Third-Party and Supply-Chain Risks

External technology providers can introduce risks that are difficult to identify through internal security controls alone.

Maintain an inventory of relevant providers, assess their access to critical systems, review contractual security provisions and understand how incidents affecting suppliers could disrupt business operations.

5. Establish Management Oversight

Effective compliance requires clear ownership. Senior management should receive meaningful information about significant risks, remediation progress, incidents and resilience testing.

Assign responsibilities, establish review cycles and retain evidence that relevant controls are operating as intended.

From Compliance to Operational Resilience

A compliance exercise that ends with a policy document is unlikely to deliver sufficient operational value.

Organizations should connect regulatory requirements with practical security capabilities: monitoring, vulnerability management, identity security, backup and recovery, incident response and third-party oversight.

Useful performance indicators include the number of unresolved high-risk findings, completion of resilience tests, remediation times and progress against an approved risk treatment plan.

Conclusion

DORA and NIS2 reflect the growing importance of cybersecurity and operational resilience across the European economy. However, requirements differ according to the organization, its activities and the applicable legal framework.

Greek businesses should begin with a clear applicability assessment, establish their current level of readiness and prioritize the gaps that create the greatest operational and regulatory risks.

Need support assessing your cybersecurity readiness? Contact Algosystems to discuss your organization’s security posture, risk priorities and potential improvement roadmap.

Important: This article is general information, not legal advice. Regulatory applicability, national implementation and reporting obligations should be verified against current official legislation and guidance before publication or use for compliance decisions.