Cyprus
Cyprus has one of the EU's densest concentrations of investment firms and FX brokers, alongside a growing fintech and technology sector. For licensed firms DORA is a direct obligation; for the technology companies that serve them it arrives through contracts. Kellwick provides independent ISO 27001 internal audits, implementation, DORA readiness and fractional security leadership, delivered remotely with onsite days where they help.
Buyers
Local context
Context for scoping, not legal advice. Whether a law applies to you depends on your entity type, sector and size; where a formal legal position is needed we work alongside your counsel.
Investment firms, payment and e-money institutions, crypto-asset service providers and other entities listed in DORA Article 2 have been subject to DORA since 17 January 2025: ICT risk management, major incident reporting, resilience testing, ICT third-party risk and the annual register of information. Technology suppliers are reached through the contract terms those entities must impose, unless designated critical.
Cyprus transposed NIS2 in 2025 by amending its law on the security of network and information systems; the Digital Security Authority is the competent authority. Whether NIS2 applies to a given company depends on its sector and size. Licensed financial entities are generally governed by DORA for ICT risk.
ISO 27001 is not required by law, but it is the management system most Cypriot firms use to make DORA, NIS2 and client due-diligence evidence repeatable rather than assembled each time it is asked for.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.
Services
Delivery
Sectors
Questions
No. DORA applies to the financial entities listed in its Article 2, such as investment firms and payment institutions. ICT providers to those entities usually meet DORA requirements through contract terms, not as directly regulated entities, unless the European Supervisory Authorities designate them as critical.
No. ISO 27001 covers much of the ICT risk management ground, but DORA adds specific requirements - major incident classification and reporting, resilience testing, register of information and contract terms - that a certificate does not demonstrate. We map one to the other so the work is not done twice.
No. We provide GRC consulting, internal audits and readiness work. Where an engagement needs a formal legal position, we work alongside your legal counsel.
The standards, the sites and the deadline are enough to start. A specialist replies within one business day and confirms whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.