Lithuania NIS2 Transposition

Law on Cybersecurity 2024 amendments. Supervised by the National Cyber Security Centre. Extended to defence-adjacent infrastructure reflecting NATO eastern flank obligations.

JurisdictionLithuania
CategoryCybersecurity
StatusActive
Latest development

Analysis

Lithuania has transposed the NIS2 Directive through amendments to the Law on Cyber Security, in force since 18 October 2024, with detailed technical and organizational requirements in a Government Resolution effective 12 November 2024, supervised by the National Cyber Security Centre (NCSC) under the Ministry of National Defence.158

Key Requirements

  • Transposition basis and scope
  • Lithuania implemented NIS2 primarily by amending the Republic of Lithuania Law on Cyber Security (Lietuvos Respublikos kibernetinio saugumo įstatymas), adopted on 11 July 2024 and in force from 18 October 2024.156
  • The amended law replaces the prior NIS1-based framework and fully transposes Directive (EU) 2022/2555 (NIS2).349
  • Scope expanded from roughly 1,000 to 8,000–10,000 entities, including private and public-sector operators across essential and important sectors.361
  • Entity classification (essential vs important)
  • Lithuania follows NIS2’s risk-based classification, with essential entities generally having ≥250 employees or €50M turnover, and important entities generally ≥50 employees or €10M turnover.354
  • The NCSC and other government institutions identify entities falling under NIS2 scope and include them in an official list by 17 April 2025, rather than requiring self‑registration.648
  • Governance and risk-management obligations
  • The amended law and the 2024 Government Resolution set extensive mandatory technical and organizational measures, including risk management, incident handling, continuity, supply-chain security, and crisis management, aligned to NIS2 Articles 21–23.169
  • Management bodies must approve and oversee cybersecurity measures and may be held personally liable for compliance failures under the national transposition of NIS2 governance provisions.341
  • Entities must apply risk-based security measures proportionate to their size, threat exposure, and sector importance.456
  • Incident reporting requirements
  • Lithuania follows NIS2’s structured reporting timeline: initial alert within 24 hours, further update within 72 hours, and final report within 30 days after becoming aware of a significant incident.361
  • Reporting must be made to the National Cyber Security Centre (NCSC) and, where applicable, to sectoral regulators according to detailed mechanisms in the Government Resolution adopted 6 November 2024 and effective 12 November 2024.189
  • Requirements cover both significant incidents and near-miss events where applicable, consistent with NIS2 guidance.431
  • Supervisory authority and defence‑adjacent context
  • The National Cyber Security Centre (Nacionalinis kibernetinio saugumo centras, NKSC) under the Ministry of National Defence is designated as the competent authority for NIS2 supervision in Lithuania.385
  • Lithuania’s NIS2 implementation explicitly extends to defence‑adjacent infrastructure and critical research activities, reflecting the security context of the NATO eastern flank by including entities performing critical research and experimental development activities and local public administration.631
  • Sanctions and enforcement
  • Lithuania has introduced administrative fines aligned to NIS2 levels, including up to €10 million or 2% of global turnover for essential entities, and proportionate fines for important entities.345
  • Public sector entities are subject mainly to corrective orders instead of fines, but must still meet the security and reporting obligations.361
  • The Government Resolution and implementing acts detail inspection powers, audits, and enforcement measures for NCSC and sectoral authorities.619
  • Compliance timelines and transitional periods
  • The law entered into force on 18 October 2024, in line with NIS2 Article 41 application deadline.148
  • NCSC has until 17 April 2025 to identify entities and compile the official NIS2 entity list.463
  • Newly listed entities typically have 12 months for organisational measures and up to 24 months for full technical implementation following notification, per Lithuanian law and implementing regulations.546

Compliance Challenges

  • Identification and scoping of in‑scope entities
  • Organizations often struggle to confirm whether they qualify as essential or important entities, because Lithuania uses a central listing process by NCSC rather than self‑registration.643
  • The expanded scope to local public administration, universities, hosting providers, and defence‑adjacent infrastructure increases complexity for entities that previously had limited regulatory exposure.631
  • Meeting extensive technical and organizational measures
  • The Government’s detailed list of mandatory controls (e.g., network security, access management, backups, logging, incident handling, crisis plans) is broad and often exceeds the maturity of smaller “important” entities.619
  • Industry commentary notes that Lithuanian entities face a “seismic shift” from NIS1 to NIS2‑level requirements, particularly in governance, supply‑chain risk management, and incident reporting disciplines.342
  • Resource and skills constraints
  • Reports on NIS2 implementation highlight lack of sufficient cybersecurity staff, expertise in risk assessment, and incident response capabilities in many EU SMEs and public bodies, which applies across Lithuanian NIS2 sectors.341
  • Defence‑adjacent and research entities face specific challenges in balancing national security constraints, classified information handling, and open research collaboration, making NIS2-aligned security governance more complex.634
  • Real examples and case insights
  • Legal and consulting analyses of Lithuania’s Act (e.g., Eversheds Sutherland and Advisera) describe organizations under the former NIS regime needing substantial upgrades in incident reporting processes, board‑level oversight, and supply‑chain security, illustrating concrete compliance gaps.243
  • Implementation trackers and advisory reports show that entities newly brought into scope (e.g., universities, hosting providers) are often late in establishing formal risk management frameworks and audited security controls.619

Implementation Best Practices

  • Map obligations to existing frameworks
  • Align internal controls to NIS2 core security requirements in the Lithuanian law and Resolution by mapping them to established frameworks such as ISO/IEC 27001, ISO/IEC 27002, and NIST CSF, which are widely recommended for NIS2 compliance.431
  • Use the NIS2 Directive text as a baseline to ensure measures correspond to Articles 21–24 (risk management, reporting, governance).145
  • Establish strong governance and accountability
  • Form a cybersecurity steering committee or assign a CISO responsible for NIS2 implementation, ensuring management body oversight as required by Lithuanian law.346
  • Implement regular board‑level reporting on cybersecurity risks, incidents, and compliance status, reflecting NIS2’s emphasis on management responsibility.431
  • Build incident detection and reporting capability
  • Set up 24/7 monitoring and logging, an incident classification scheme, and procedures to meet the 24‑hour / 72‑hour / 30‑day reporting timelines specified for Lithuania.[3](https://copla.com/blog

Recent developments

  • — NIS2 enforcement tracking reports Lithuania among the Member States with **first NIS2-related fines**, including a €52,000 sanction, signalling that Lithuanian authorities have moved from transposition to active enforcement and audits of essential entities under the new Cybersecurity Law.[6] (source)
  • — Lithuanian cybersecurity authorities reached the **deadline to compile the initial list of essential and important entities** under the amended Cybersecurity Law, triggering 12‑month and 24‑month compliance windows for organisational and technical measures required by NIS2.[7] (source)
  • — Industry analysis highlights that by 17 April 2025 Lithuanian authorities must list all in‑scope entities (estimated 8,000–10,000), after which organisations face structured incident‑reporting obligations (24‑hour alert, 72‑hour update, 30‑day final report) and significant fines up to €10M or 2% of global turnover for essential entities.[1] (source)
  • — Implementing legislation establishing **technical and organisational cybersecurity requirements** for essential and important entities entered into force on 12 November 2024, detailing how NIS2 obligations on risk management, incident reporting, and governance are applied in Lithuania.[2] (source)
  • — The amended and recast **Resolution on the Implementation of the Law on Cybersecurity** took effect on 12 November 2024, describing concrete cybersecurity requirements for NIS2‑classified entities and clarifying procedures for incident handling and compliance in Lithuania.[3] (source)
  • — Further Lithuanian implementing acts that detail reporting mechanisms, mandatory technical and organisational measures, and enforcement tools under NIS2 came into force on 12 November 2024, giving companies a 12–24 month transitional period to adopt the new controls.[8] (source)
  • — On 6 November 2024 the Lithuanian government adopted implementing legislation under the Cybersecurity Law, specifying risk management practices, incident response mechanisms, and reporting timelines to the National Cyber Security Centre for entities deemed essential or important.[7] (source)
  • — The amended **Law on Cybersecurity of the Republic of Lithuania** entered into force on 18 October 2024, formally transposing the NIS2 Directive and introducing stricter requirements such as incident response planning, supply chain security controls, and risk assessments for in‑scope organisations.[3] (source)
  • — Lithuania’s new Cyber Security Law became effective on 18 October 2024, expanding the scope from roughly 1,000 to 8,000–10,000 entities and assigning supervisory and enforcement powers, including significant sanctions, to the National Cyber Security Centre under the Ministry of Defence.[1] (source)
  • — Legal commentary notes that the revised Law on Cyber Security, in force since 18 October 2024, extends NIS2 obligations to local public administration, certain research institutions, and hosting service providers, with authorities responsible for identifying and directly notifying in‑scope entities rather than relying on self‑registration.[8] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates