The directive on security of network and information systems (NIS directive) is one of the latest steps that the EU has taken in order to strengthen security of its systems. The directive describes specific steps that each member state should follow. Greece that has recently published its cyber security strategy is moving towards the implementation of the NIS directive. The road ahead is long and a cooperation in both technical and strategic level is needed. This article describes the roadmap of the implementation of the NIS directive in Greece, the milestones, the problems and possible solutions.

This article presents the cyber security progress in Greece since the creation of the Greek National Cyber Security Authority as a nation-wide cybersecurity coordination and policy making unit. During this period, Greece issued a Ministerial Decree that established the National Cyber Security Authority, issued the National Cybersecurity strategy, transposed the NIS Directive to National Law and issued a Ministerial Decree that helped establish a cybersecurity framework for the public sector and the critical infrastructures that reside in Greece. This structured effort led to the achievement of gaining the 1 st position in the prestigious NCSI index for Greece, amongst 160 countries.

The EU NIS Directive introduces obligations related to the security of the network and information systems for Operators of Essential Services and for Digital Service Providers. Moreover, National Competent Authorities for cybersecurity are required to assess compliance with these obligations. This paper describes a novel Cybersecurity Maturity Assessment Framework (CMAF) that is tailored to the NIS Directive requirements. CMAF can be used either as a self-assessment tool from Operators of Essential Services and Digital Service Providers or as an audit tool from the National Competent Authorities for cybersecurity.

No abstract