NIS2 in Lithuania

Kibernetinio saugumo įstatymas Nr. XII-1428

Law in force since 2024-10-18

Law: KSĮ
Authority: National Cyber Security Centre (NKSC)
Classes: esminiai subjektai (essential), svarbūs subjektai (important)
Register: KSIS (Cybersecurity Information System) of the NKSC
ISO 27001: Helps, not enough alone

Know when Lithuania changes its NIS2 rules

One email when the law, the deadlines or the portal change.

The law

Law XIV-2902 of 2024-07-11 put the NIS2 rules into the Law on Cybersecurity. It was published on 2024-07-24 and has applied since 2024-10-18. Amendment XV-1076 of 2026-06-25 was published on 2026-07-03. The current consolidated edition applies from 2026-07-04.

Name: Kibernetinio saugumo įstatymas Nr. XII-1428Law on Cybersecurity
Published: 2024-07-24
In force: 2024-10-18
Text: Read the KSĮ

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Lithuania differs

Art. 11(4) point 1 KSĮ An entity in an Annex II sector is important only if the income from those activities is above 50% of its total income. The Directive has no such test.
Art. 11(4) point 7 KSĮ Providers of electronic information hosting services are important entities at any size.
Art. 11(3) point 5 KSĮ Central, regional and municipal public administration bodies are essential entities.

Also note

The law gives entities at least 12 months from registration to meet the security requirements. The NKSC says the technical requirements take 24 months from registration.
The NKSC counts staff from social insurance data. The entity can give its own figures when they differ.
The security requirements sit in the Government description of cybersecurity requirements (resolution 818 of 2018-08-13, new edition). Trust service providers and special entities follow Implementing Regulation (EU) 2024/2690.

Registration

The NKSC identifies the entities and enters them in the register. It had to do this by 2025-04-17. An entity gets its duties only from the day it is registered. After the NKSC confirms the registration, the entity logs in to KSIS and files its data. An entity can also ask the NKSC to register it.

Portal: KSIS (Cybersecurity Information System) of the NKSC
Rule: Fixed deadline
Deadline: 2025-04-17
You need: A KSIS account. Only the head of the company can fill in the account form. Then the entity files its data (activity, services, sector, size, revenue, IP addresses) in KSIS.

Incident reporting

24 hEarly warning
72 hIncident notification
1 monthFinal reportafter the incident notification.

Send the reports to the NKSC, through KSIS (the national incident management system).

Final report: If the incident is still open, send a progress report first. Send the final report 1 month after the incident ends.

Incidents below the significant threshold also go to the NKSC. The national incident management plan sets the deadlines for them.

Measures and proof

Essential: The NKSC can inspect an essential entity on its own initiative, after a complaint, or from other sources. Every entity must pass a cybersecurity audit at least every 3 years. A certified independent auditor does the audit under the NKSC method. The NKSC also installs technical security tools in the networks of essential entities.
Important: The NKSC inspects an important entity only when it has data or information that the entity may have broken the law. The 3-year audit duty is the same as for essential entities.

The dates, in order

2024-10-18 Law with the NIS2 rules in force
2025-04-17 NKSC deadline to identify entities and enter them in the register
2026-07-04 Current edition (amendment XV-1076) in force

Duties of management

The head of the entity makes sure that the entity follows the law, and supervises this. The head attends cybersecurity training at least every 2 years. The head or an authorised person names a cybersecurity manager who reports directly to the head. A court can suspend the head of an essential entity for a time.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Art. 30 KSĮ. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class	Ceiling	At EUR 20m	At EUR 500m	At EUR 2bn
Essential	EUR 10m or 2%	EUR 10m	EUR 10m	EUR 40m
Important	EUR 7m or 1.4%	EUR 7m	EUR 7m	EUR 28m

The law applies the percentage to the total worldwide annual turnover of the legal person. The higher amount applies. The fine depends on the violation. A dangerous violation can reach 100% of the maximum, a medium one 50%, a minor one 10%. A budgetary body pays at most EUR 60,000 (essential) or EUR 30,000 (important). The head of the NKSC sets the fine.