Where we work · Cyprus
ISO and GRC certification consulting in Cyprus
Achieve ISO and GRC certification in Cyprus with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Cyprus
Clients include
ISO and GRC certification in Cyprus at a glance
Cypriot demand for ISO and GRC certification comes from shipping and maritime services, tourism, financial services, technology and energy, sectors that sell to foreign customers who ask for documented controls. The Digital Security Authority, under the Commissioner of Communications, is the national cybersecurity authority and publishes a NIS2 guide and self-assessment tool, while the Office of the Commissioner for Personal Data Protection supervises the GDPR beside Law 125(I)/2018. The Central Bank of Cyprus supervises banks, payment institutions and electronic money institutions, CySEC carries a Digital Resilience (DORA) section, and Pharmaceutical Services is the national competent authority for human medicines. CYS is the national standards body, and CYSAB, the Cyprus Accreditation Body, is listed by EA for testing, calibration, inspection and product certification, so management-system certificates often carry accreditation from another economy. Sterling does not certify. Sterling serves Cypriot clients from its Frankfurt office, on site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Cyprus
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Cyprus (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Cypriot Law 125(I)/2018 Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (the Office of the Commissioner for Personal Data Protection) — the European Data Protection Board lists it as the Cypriot Data Protection Authority | Law 125(I)/2018 sits beside the GDPR as the national data protection law. The Official Gazette text of the network and information security Law 89(I)/2020 requires the Digital Security Authority to process personal data under that Law and the GDPR, and to cooperate closely with the Commissioner on incidents that lead to personal data breaches. | |
| Αρχή Ψηφιακής Ασφάλειας (the Digital Security Authority, DSA) — an independent governmental agency under the supervision of the Commissioner of Communications, the national single point of contact for network and information security and the supervisor of the national CSIRT Operators of essential services in energy, water, transport, health, banking, financial market infrastructure and digital infrastructure, digital service providers (online marketplaces, search engines, cloud computing) and electronic communications providers | Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2020 (Law 89(I)/2020, Official Gazette 4770, 12 August 2020), which the DSA publishes in a consolidated version as amended by Law 60(I)/2025. The Law lists the factors that security measures must take into account: security of systems and facilities, incident handling, business continuity management, monitoring, audits and tests, and compliance with international standards. It also directs the DSA to encourage European or internationally accepted standards and specifications. The DSA publishes a summary guide to the NIS2 Directive and an online self-assessment tool that gives an indication of whether an organisation falls into the Directive's sectors. | ISO/IEC 27001, ISO 22301 |
| The DSA, designated by decision of the Council of Ministers as the National Cybersecurity Certification Authority Providers of ICT products, services and processes under European cybersecurity certification schemes | Regulation (EU) 2019/881 (Cybersecurity Act); the DSA says the authority supervises conformity assessment bodies and the technical laboratories involved, and handles complaints about them and about certified products and services. | |
| Central Bank of Cyprus (CBC) — its licensing and supervision pages cover banks, payment institutions and electronic money institutions, and the CBC is governed by the Central Bank of Cyprus Law, 2002 as amended Banks, payment institutions and electronic money institutions | Regulation (EU) 2022/2554 (DORA), which requires financial entities to have a sound, comprehensive and well-documented ICT risk management framework and applies from 17 January 2025. | ISO/IEC 27001, ISO 22301, PCI DSS |
| Cyprus Securities and Exchange Commission (CySEC) — its website carries separate Digital Resilience (DORA) and Physical Resilience sections Investment firms, fund managers and other firms regulated for securities and markets | Regulation (EU) 2022/2554 (DORA) for the ICT risk management and third-party risk duties of regulated financial entities. | ISO/IEC 27001, ISO 22301 |
| The Cypriot authorities responsible for official food controls under EU hygiene law Food businesses | Regulation (EC) No 852/2004 requires food business operators to put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. | HACCP, ISO 22000 |
| Pharmaceutical Services of the Ministry of Health — the European Medicines Agency lists it as the Cypriot national competent authority for human medicines Pharmaceutical and medical device manufacturers and distributors | Regulation (EU) 2017/745 (Medical Devices Regulation), under which manufacturers of devices must establish, document, implement, maintain, keep up to date and continually improve a quality management system proportionate to risk class and device type. | ISO 13485 |
| The authorities Cyprus designates under the EU Artificial Intelligence Act Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act), under which providers of high-risk AI systems must put a documented quality management system in place. | ISO/IEC 42001 |
| The Cypriot authorities responsible for national measures that implement the Energy Efficiency Directive Large energy users | Directive (EU) 2023/1791, Article 11: Member States are to ensure that enterprises with an average annual energy consumption above 85 TJ implement an energy management system certified by an independent body against relevant European or international standards, in place by 11 October 2027 at the latest. | ISO 50001 |
| Cypriot labour authorities under national law Employers in all sectors (occupational health and safety) | Council Directive 89/391/EEC, Article 9: the employer must hold an assessment of the risks to safety and health at work and decide on the protective measures to be taken. | ISO 45001 |
| Independent Authority Against Corruption (Ανεξάρτητη Αρχή κατά της Διαφθοράς) — its website carries a code of ethics, a lobbying register and a channel for complaints and information Organisations setting up integrity and reporting controls | Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, which requires private-sector legal entities with 50 or more workers to establish internal reporting channels. | ISO 37001, ISO 37301 |
Accreditation and recognition
- CYS-CYSAB (Cyprus Organization for the Promotion of Quality — Cyprus Accreditation Body): National accreditation body — the EA directory lists it under the Ministry of Energy, Commerce and Industry in Nicosia.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Directive 2014/24/EU (Contracting authorities): Each contracting authority sets its own conditions. Where it asks for certificates on quality assurance standards, the Directive directs it to quality assurance systems based on the relevant European standards series certified by accredited bodies; for environmental management it refers to EMAS, other recognised systems or standards based on European or international standards, certified by accredited bodies. Equivalent certificates from bodies in other Member States must be recognised.
Economic zones
- Shipping and maritime services: ship management, shipping-related services
- Tourism and hospitality: hotels and resorts, tourism services
- ICT and business services: software development, systems integration, testing services, research and development, back offices
- Financial centre: investment funds, asset management, insurance, electronic money institutions
- Energy: renewable energy, power generation
Sterling in Cyprus
Sterling delivers in Cyprus from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Cyprus clients ask
Are certification audits in Cyprus conducted in Greek or English?
Either, and often both. Cypriot legislation and regulator guidance appear in Greek, while English is widely used in business, so the working language is settled with the certification body when you apply. Say early which language your procedures and records use, and check whether a customer contract or regulator imposes one.
Which authority supervises the GDPR in Cyprus?
The Office of the Commissioner for Personal Data Protection, which the European Data Protection Board lists as the Cypriot Data Protection Authority. National law 125(I)/2018 sits beside the Regulation. The network security Law also asks the Digital Security Authority to cooperate closely with the Commissioner on personal data breaches. For a specific activity, ask the Commissioner or your counsel.
Which Cypriot authority handles cybersecurity and NIS2 guidance?
The Digital Security Authority, an independent agency under the Commissioner of Communications. It is the national single point of contact and supervises the national CSIRT. It publishes a short guide to the NIS2 Directive and an online self-assessment tool that indicates whether an organisation falls into the Directive's sectors. Treat the tool as a first indication and confirm scope with the Authority or counsel.
Which body accredits certification bodies in Cyprus?
The Cyprus Accreditation Body, CYSAB, is the national accreditation body. The EA directory shows it as a mutual recognition signatory for calibration, testing, medical examination, product certification and inspection, but not for management system certification. ISO management-system certificates for Cypriot organisations therefore often carry accreditation from a body elsewhere. Ask for the accreditation certificate and scope.
Who supervises DORA for Cypriot banks and payment firms?
The Central Bank of Cyprus supervises banks, payment institutions and electronic money institutions, and CySEC regulates securities firms and has a Digital Resilience (DORA) section on its website. DORA itself is an EU Regulation requiring a sound, documented ICT risk management framework. Which supervisor covers a given entity depends on its licence, so confirm with the supervisor or counsel.
Can Cypriot public buyers ask for ISO certificates?
Yes, though the buyer decides. The EU procurement Directive lets each contracting authority write its own selection conditions; when one wants proof of a quality or environmental management system, it points to certificates from accredited bodies and has to accept equivalent ones issued in another Member State. The tender documents set the real requirement, and counsel can advise on a live bid.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Cypriot Law 125(I)/2018 — edpb.europa.eu; dsa.cy; eur-lex.europa.eu (accessed 18 Oct 2026)
- Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2020 (Law 89(I)/2020, Official Gazette 4770, 12 August 2020), which the DSA publishes in a consolidated version as amended by Law 60(I)/2025. The Law lists the factors that security measures must take into account: security of systems and facilities, incident handling, business continuity management, monitoring, audits and tests, and compliance with international standards. It also directs the DSA to encourage European or internationally accepted standards and specifications. The DSA publishes a summary guide to the NIS2 Directive and an online self-assessment tool that gives an indication of whether an organisation falls into the Directive's sectors. — dsa.cy (accessed 18 Oct 2026)
- Regulation (EU) 2019/881 (Cybersecurity Act); the DSA says the authority supervises conformity assessment bodies and the technical laboratories involved, and handles complaints about them and about certified products and services — dsa.cy; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which requires financial entities to have a sound, comprehensive and well-documented ICT risk management framework and applies from 17 January 2025 — centralbank.cy; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA) for the ICT risk management and third-party risk duties of regulated financial entities — cysec.gov.cy; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 requires food business operators to put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles — eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2017/745 (Medical Devices Regulation), under which manufacturers of devices must establish, document, implement, maintain, keep up to date and continually improve a quality management system proportionate to risk class and device type — ema.europa.eu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), under which providers of high-risk AI systems must put a documented quality management system in place — eur-lex.europa.eu (accessed 18 Oct 2026)
- Directive (EU) 2023/1791, Article 11: Member States are to ensure that enterprises with an average annual energy consumption above 85 TJ implement an energy management system certified by an independent body against relevant European or international standards, in place by 11 October 2027 at the latest — eur-lex.europa.eu (accessed 18 Oct 2026)
- Council Directive 89/391/EEC, Article 9: the employer must hold an assessment of the risks to safety and health at work and decide on the protective measures to be taken — eur-lex.europa.eu (accessed 18 Oct 2026)
- Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, which requires private-sector legal entities with 50 or more workers to establish internal reporting channels — iaac.org.cy; eur-lex.europa.eu (accessed 18 Oct 2026)
- CYS-CYSAB (Cyprus Organization for the Promotion of Quality — Cyprus Accreditation Body) — european-accreditation.org; ilac.org (accessed 18 Oct 2026)
- Public procurement under Directive 2014/24/EU — eur-lex.europa.eu (accessed 18 Oct 2026)
- Shipping and maritime services — investcyprus.org.cy (accessed 18 Oct 2026)
- Tourism and hospitality — investcyprus.org.cy (accessed 18 Oct 2026)
- ICT and business services — investcyprus.org.cy (accessed 18 Oct 2026)
- Financial centre — investcyprus.org.cy (accessed 18 Oct 2026)
- Energy — investcyprus.org.cy (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice