Cyber rules tighten as Cyprus SMEs race to comply

Cypriot manufacturers and software developers are entering the most demanding phase of Europe’s new cybersecurity regime, Research Deputy Minister Nicodemos Damianou said this week, as new obligations begin to take effect and smaller firms face the practical challenge of meeting them. Speaking at the ‘Building CRA Compliance through Horizontal Cybersecurity Standards’ conference in Nicosia, Damianou turned to an unlikely example to explain why Europe’s Cyber Resilience Act (CRA) reaches well beyond the traditional technology sector: a fish tank. A few years ago, he said, attackers gained access to a casino’s network through a smart thermometer installed in its lobby aquarium, before moving through the system and reaching its high-roller database. “Nobody who bought that thermometer thought they were making a decision that affected cybersecurity,” Damianou said, adding that this was “precisely the point” of the CRA. For the first time, he said, security becomes a property of the product itself, designed in from the outset, maintained throughout its support period and made the responsibility of the manufacturer rather than the customer. The casino example dates back several years, but the problem it illustrates has become harder to ignore as everything from household appliances and industrial equipment to software increasingly comes with digital components. Damianou also pointed to newer risks posed by autonomous artificial intelligence agents, referring to recent incidents involving OpenAI and Hugging Face, as well as Anthropic. OpenAI confirmed in August that, during cybersecurity evaluations in July, internal research models circumvented controls intended to isolate them from the internet, exploited vulnerabilities and accessed parts of Hugging Face’s systems. Anthropic has separately reported cases in which Claude models reached the internet during security evaluations and gained unauthorised access to real-world systems. For Cyprus, Damianou said, such risks carried particular weight because of the island’s reliance on connected infrastructure and international supply chains. “As an island member state, Cyprus is fully cognizant of the consequences,” he said. His comments come as the CRA begins to move from legislation into day-to-day compliance. Since September 11, manufacturers have been required to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements through the EU’s reporting arrangements under cybersecurity agency ENISA. The full set of essential requirements will apply from December 11, 2027. For Damianou, however, the harder question is how companies are expected to meet those obligations in practice. “A regulation tells you what must be achieved. It does not tell a twelve-person company in Lemesos how to achieve it. That is the job of standards,” he said. European standardisation bodies CEN, CENELEC and ETSI are developing harmonised standards intended to help companies meet the requirements of the CRA. The horizontal standards discussed in Nicosia are intended to apply across different categories of digital products, covering areas such as secure product design, risk management, vulnerability handling, access management, encryption and security throughout a product’s lifecycle. Instead of manufacturers having to interpret the legislation separately in each EU country, Damianou said the standards should provide “one clear, recognised route to compliance, instead of twenty-seven interpretations of the same article”. That, he said, made their development far more than a technical exercise, placing the work “on the critical path of the end-to-end cybersecurity value chain”. For Cyprus, however, Damianou said his main concern was smaller businesses. “Most Cypriot manufacturers and software developers do not have a compliance department,” he said, arguing that for such firms “a practical, accessible standard is the difference between compliance as a burden and compliance as a competitive advantage”. The CRA, he added, should therefore be seen not only as cybersecurity legislation, but also as a Single Market measure, allowing a company that develops a secure and compliant product to place it across the European market without having to follow a different approach in every member state. That argument fed into a broader point about Europe’s technological position. Damianou said Cyprus had made cyber resilience one of the three digital priorities of its six-month Presidency of the Council of the EU, which ended in June, alongside efforts to strengthen Europe’s ability to develop and secure its own technologies. During the presidency, Cyprus advanced work on the revision of the Cybersecurity Act, including proposals for a stronger ENISA and simpler certification procedures, and brought the file before the Telecom Council in June. It also hosted Europe’s cybersecurity certification community, while work on the Digital Omnibus, including plans for a single entry point for incident reporting, has since passed to the Irish Presidency. Not every file was completed during Cyprus’ six months at the helm, Damianou acknowledged, but he said one message had not changed. “Europe cannot afford to be merely a regulator of technologies developed elsewhere,” he said. Cyprus, meanwhile, is also trying to put its own arrangements in order before the CRA applies in full. Damianou said the Digital Security Authority was at the centre of the country’s preparations, while the Council of Ministers this summer approved, for the first time, a unified cybersecurity policy framework covering the government and wider public sector. “We cannot ask manufacturers to lock their products while leaving our own doors open,” he said. For Damianou, the larger objective behind the rules, reporting requirements and standards is rather simpler than the legislation surrounding them may suggest. “The huge task at hand is at the end of the day to build products people can trust from a cybersecurity perspective,” he said. That applies, he added, “right down to the thermometer in the fish tank”.