Latvia NIS2 Transposition
Information Technology Security Law 2024 amendments. Supervised by the Latvian CERT and Ministry of Defence. Includes cross-border infrastructure provisions shared with Estonia and Lithuania.
| Jurisdiction | Latvia |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Latvia has transposed NIS2 through the new National Cybersecurity Law (Nacionālās kiberdrošības likums) adopted on 20 June 2024 and effective from 1 September 2024, which replaces the former Law on the Security of Information Technologies and significantly expands cybersecurity obligations for essential and important entities.National Cybersecurity Law – official text NIS2 Latvia – NIS Solutions COBALT summary of National Cyber Security Law (PDF)
Key Requirements
Scope and entity classification
- Transposition instrument – National Cybersecurity Law (NCL)
- Latvia implements NIS2 via the National Cybersecurity Law (Nacionālās kiberdrošības likums), expressly stating that it contains norms deriving from Directive (EU) 2022/2555 (NIS2) and replacing the Law on the Security of Information Technologies.National Cybersecurity Law – official text Transposition in Latvia – NIS2Directive.com COBALT summary of National Cyber Security Law (PDF)
- Essential and important entities; ICT critical infrastructure
- The NCL applies to essential service providers, important service providers, and ICT critical infrastructure owners/operators, mirroring and extending NIS2 sectors.National Cybersecurity Law – official text NIS2 Latvia – NIS Solutions COBALT summary of National Cyber Security Law (PDF)
- Latvia expands scope from approx. 1,000 NIS1 entities to 6,000–8,000 NIS2 entities, including municipalities over 50,000 inhabitants, manufacturing firms, and cloud service providers.NIS2 regulations and implementation in Latvia – Copla Latvia Cybersecurity Law vs NIS2 – Advisera
Governance and cybersecurity risk management
- Comprehensive risk management and continuity planning
- Entities must identify cybersecurity risks, ensure availability, integrity, confidentiality of network and information systems, and develop cyber risk management and ICT business continuity plans.National Cybersecurity Law – official text COBALT summary of National Cyber Security Law (PDF) NIS2 Latvia – NIS Solutions
- 2025 Cabinet Regulation No. 397 sets minimum cybersecurity requirements, detailing technical and organisational measures aligned with NIS2 risk-management obligations.NIS2 Latvia – NIS Solutions Eversheds Sutherland – Latvia NCL summary
- Cybersecurity manager and self-assessment obligations
- Entities must designate a cybersecurity manager, notify the authority, and perform regular self-assessment of compliance.National Cybersecurity Law – official text Transposition in Latvia – NIS2Directive.com Latvia Cybersecurity Law vs NIS2 – Advisera
Registration and supervisory obligations
- Mandatory registration of entities in scope
- Essential and important entities, and ICT critical infrastructure, must register with competent authorities by 1 April 2025 and provide specified information on their services and ICT assets.COBALT summary of National Cyber Security Law (PDF) NIS2 Latvia – NIS Solutions
- The list of essential/important entities must be approved by 17 April 2025.NIS2 Latvia – NIS Solutions Transposition in Latvia – NIS2Directive.com
- Competent authorities and supervision
- Primary authority: National Cybersecurity Centre (NCC) under the Ministry of Defence, acting as central contact point and supervising essential/important service providers.NIS2 Latvia – NIS Solutions Eversheds Sutherland – Latvia NCL summary NIS2 Directive implementation in Latvia – European Commission
- Latvia’s implementation identifies CERT-LV and sector regulators as lead authorities, and creates a Digital Security Oversight Committee.NIS2 regulations and implementation in Latvia – Copla Latvia Cybersecurity Law vs NIS2 – Advisera
Incident reporting and ICT resource catalogues
- Incident notification obligations
- Entities must detect, classify, and report cybersecurity incidents to CERT/NCC according to defined thresholds and timelines, in line with NIS2.National Cybersecurity Law – official text Eversheds Sutherland – Latvia NCL summary NIS2 Latvia – NIS Solutions
- ICT resource catalogues and system classification
- The NCL and implementing regulations require entities to maintain an ICT resource catalogue and classify information systems into security categories, with criteria set by Cabinet regulations.Eversheds Sutherland – Latvia NCL summary NIS2 Latvia – NIS Solutions National Cybersecurity Law – official text
Enforcement, sanctions, and management liability
- Administrative fines and sectoral sanctions
- Essential service providers: up to €10 million or 2% of global net turnover if above €500 million.COBALT summary of National Cyber Security Law (PDF) NIS2 regulations and implementation in Latvia – Copla
- Important service providers: up to €7 million or 1.4% of global net turnover above €500 million.COBALT summary of National Cyber Security Law (PDF) NIS2 regulations and implementation in Latvia – Copla
- ICT critical infrastructure owners may face similar maximum sanctions of €10 million / 2% turnover.COBALT summary of National Cyber Security Law (PDF) National Cybersecurity Law – official text
- Director liability and bans
- Repeated negligent breaches can lead to management bans for directors up to three years, reflecting strengthened personal accountability in NIS2 transposition.NIS2 regulations and implementation in Latvia – Copla Latvia Cybersecurity Law vs NIS2 – Advisera National Cybersecurity Law – official text
Compliance Challenges
Scope identification and classification
- Complexity in determining “essential” vs “important” status
- Latvia’s thresholds on employee count and turnover (e.g. ≥250 FTE / €50M for essential; ≥50 FTE / €10M for important) create classification challenges for multi-entity groups and cross‑border operators.NIS2 regulations and implementation in Latvia – Copla Latvia Cybersecurity Law vs NIS2 – Advisera NIS2 Latvia – NIS Solutions
- Rapid scope expansion to 6,000–8,000 entities
- Many newly in‑scope municipalities, manufacturing firms, and cloud providers lack mature cybersecurity governance, making initial compliance challenging.NIS2 regulations and implementation in Latvia – Copla COBALT summary of National Cyber Security Law (PDF) NIS2 Latvia – NIS Solutions
Governance, resourcing, and expertise
- Short timelines to appoint cybersecurity managers and perform self-assessments
- Requirements to notify designation of a cybersecurity manager and submit self‑assessment reports by 1 October 2025 compress implementation into a short window.Transposition in Latvia – NIS2Directive.com Eversheds Sutherland – Latvia NCL summary National Cybersecurity Law – official text
- Skills gap and cross‑border coordination
- Industry analyses note a shortage of NIS2-experienced personnel and challenges coordinating cybersecurity for cross‑border infrastructure in the Baltic region, especially where systems are shared with Estonia and Lithuania.NIS2 Latvia – NIS Solutions Latvia Cybersecurity Law vs NIS2 – Advisera NIS2 – European Commission overview
Documentation, ICT catalogues, and incident processes
- Establishing ICT resource catalogues and system classification
- Entities must build detailed ICT catalogues and classify systems per Cabinet methodologies, which is burdensome for large legacy environments.Eversheds Sutherland – Latvia NCL summary NIS2 Latvia – NIS Solutions National Cybersecurity Law – official text
- Aligning incident reporting with operational realities
- Industry guidance highlights difficulties in aligning strict NIS2 incident timelines with real‑time operations, especially in critical infrastructure and cross‑border networks.Latvia Cybersecurity Law vs NIS2 – Advisera NIS2 Latvia – NIS Solutions NIS2 – European Commission incident reporting factsheet
Real‑world examples and case insights
- Auto‑conversion and transitional compliance
- Existing NIS1 entities in Latvia are automatically converted into NIS2 scope with 3/12/24‑month compliance timelines, creating staggered but demanding programs.NIS2 regulations and implementation in Latvia – Copla Transposition in Latvia – NIS2Directive.com Latvia Cybersecurity Law vs NIS2 – Advisera
- Municipal and public sector challenges
- Public sector entities (ministries and large municipalities) are in scope but exempt from fines, yet analyses show they still face challenges in governance, resourcing, and incident handling.NIS2 regulations and implementation in Latvia – Copla COBALT summary of National Cyber Security Law (PDF) NIS2 Latvia – NIS Solutions
Implementation Best Practices
Governance and scoping
- Conduct a structured NIS2 gap assessment
- Recommended steps include: assess if you are in scope; confirm registration obligations; run a NIS2 gap assessment against legal and minimum cybersecurity requirements.NIS2 Latvia – NIS Solutions Latvia Cybersecurity Law vs NIS2 – Advisera NIS2 – ENISA guidance
- Establish clear roles and a cybersecurity manager function
- Implement a formal role for the cybersecurity manager, with defined responsibilities for risk management, incident coordination, and compliance reporting to NCC/CERT‑LV.National Cybersecurity Law – official text Transposition in Latvia – NIS2Directive.com Eversheds Sutherland – Latvia NCL summary
Technical and organisational measures
- Implement controls aligned with minimum cybersecurity requirements
- Follow Cabinet Regulation No. 397 and associated secondary legislation for detailed measures (e.g., access control, logging, network security, backup, continuity) and integrate them with NIS2 risk‑management principles.NIS2 Latvia – NIS Solutions National Cybersecurity Law – official text Eversheds Sutherland – Latvia NCL summary
- Use recognized frameworks for structure
- Map NCL obligations to ISO/IEC 27001, ISO/IEC 27002, and ENISA NIS2 guidance, which provide structured controls and implementation guidance widely referenced for NIS2 compliance.ENISA – NIS2 Directive overview [ISO/IEC 27001 – ISO overview](https://www.iso.org/standard/27001
Recent developments
- — European Commission issues a reasoned opinion to 19 Member States, including Latvia, for failing to notify **full transposition** of NIS2, despite Latvia having a national framework in place; the opinion warns that cases may be referred to the Court of Justice if compliance is not demonstrated within two months.[6] (source)
- — Update notes that Latvia has adopted a **National Cybersecurity Law (Nacionālās kiberdrošības likums)** implementing substantial NIS2 norms, while the Commission’s Latvia page still lists the country under infringement for non‑notification of full transposition.[2] (source)
- — The same update highlights **key transitional deadlines** for in‑scope entities: cybersecurity manager designation and first self‑assessment reports due by 2025‑10‑01, certain Article 34 obligations applying from 2025‑07‑01, and alignment for DORA‑covered financial entities by 2025‑01‑17.[2] (source)
- — IDC reports that by July 2025 Latvia is among 14 Member States that have **enacted NIS2 implementation laws**, yet remains on the Commission’s “naughty list” because national adoption has not translated into full EU‑level transposition notification.[5] (source)
- — Commission communication stresses that entities in sectors such as **digital services, transport, manufacturing of critical products, health, and public administration** must be covered under NIS2, signaling ongoing pressure on Latvia to ensure its National Cybersecurity Law fully matches Directive (EU) 2022/2555.[6] (source)
- — European Commission issues a reasoned opinion to Latvia and 18 other Member States for failing to notify full transposition of NIS2 by the 17 October 2024 deadline, giving two months to respond or risk referral to the Court of Justice of the EU.[6][4] (source)
- — European Commission’s Latvia NIS2 page confirms the reasoned opinion of 7 May 2025 for failure to notify full transposition, despite Latvia having already adopted substantial national NIS2-implementing legislation, highlighting a gap between national implementation and EU-level notification.[4][1] (source)
- — Analysis of Latvia’s National Cybersecurity Law explains that entities covered by NIS2 must determine their status and register by 1 April 2025, marking a key compliance milestone for essential and important entities under Latvia’s NIS2 transposition framework.[5] (source)
- — Latvia’s National Cybersecurity Law sets 17 January 2025 as the deadline for certain financial-sector essential service providers subject to DORA to comply with sectoral requirements on risk management and incident reporting, aligning NIS2 obligations with EU financial digital resilience rules.[1] (source)
- — Latvia’s Cybersecurity Law requires the government to adopt multiple implementing regulations by 17 October 2024, covering areas such as detailed cybersecurity measures and incident reporting, which shape the practical application of NIS2 obligations in Latvia.[5] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIS2 policy generator (generatepolicy.com)
- Buy the policy pack: NIS2 Compliance Policy (cyberpolicy.shop)
- Build it yourself: DORA + NIS2 EU Compliance Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates