This statement explains how three EU cybersecurity laws relate to Cyprus Connect and what we do about each of them. We review it whenever the law, official guidance or our Services change.
1. EU Cybersecurity Act, Regulation (EU) 2019/881
The Cybersecurity Act gives ENISA, the EU Agency for Cybersecurity, a permanent mandate and creates a European framework for voluntary cybersecurity certification of ICT products, services and processes. In Cyprus, the Digital Security Authority acts as the national cybersecurity certification authority.
Our position: Cyprus Connect is not certified under any European cybersecurity certification scheme. Certification under the Act is voluntary unless EU or national law makes a particular scheme mandatory, and no scheme is currently mandatory for our Services. We follow ENISA guidance in designing our security measures and will consider certification as relevant schemes, such as the planned scheme for cloud services, become available.
2. Cyber Resilience Act (CRA), Regulation (EU) 2024/2847
The CRA sets cybersecurity requirements for products with digital elements, meaning hardware and software placed on the EU market. Most of its requirements apply from 11 December 2027. Its duty for manufacturers to report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform has applied since 11 September 2026.
Our position: Cyprus Connect is offered as an online service used in the browser; we do not place software or devices on the market for customers to install. Software-as-a-service is generally outside the CRA, unless it is the remote data processing solution of a product with digital elements, which our Services are not. We therefore do not consider ourselves a manufacturer under the CRA. We nevertheless apply its principles voluntarily:
- security by design and by default, including end-to-end encryption and two-step sign-in for everyone;
- a published Vulnerability Disclosure Policy and security.txt contact;
- timely security updates for the whole lifetime of the Services;
- a documented incident response procedure, described in Policies and Procedures.
3. NIS2 Directive, Directive (EU) 2022/2555
NIS2 sets cybersecurity risk-management and incident-reporting obligations for essential and important entities in specified sectors, including some digital and ICT service providers. Cyprus transposed it by amending its Law 89(I)/2020 on the Security of Networks and Information Systems through Law 60(I)/2025, in force since 25 April 2025. The Digital Security Authority is the competent authority, and the Cyprus law requires an early warning of a significant incident within 6 hours.
Our position: NIS2 generally applies to medium-sized and larger entities in its listed sectors, with some exceptions regardless of size. On our current assessment Topify Consulting Ltd is not an essential or important entity, and we have not been designated as one. We still apply the NIS2 risk-management measures as good practice (risk analysis, incident handling, business continuity, supply-chain security, secure development, access control, encryption, multi-factor authentication and training) and we will register and report as required if we come within scope.
4. Customers who are in scope themselves
If your firm is subject to NIS2, DORA or similar rules, you may need information about us as an ICT supplier. We will provide our security documentation and answer reasonable questionnaires on request at security@cyprusconnect.net.
5. Sources
- Regulation (EU) 2019/881 (Cybersecurity Act)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Directive (EU) 2022/2555 (NIS2)
- ENISA CRA Single Reporting Platform
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.