Lithuania

1 Introduction: NIS2 Directive & the Lithuanian context

Lithuania already had a Law on Cyber Security before NIS2. What changed in 2024 was not the existence of the law but its reach: the Kibernetinio saugumo įstatymas was restated in full by amending act No. XIV-2902, adopted by the Seimas on 11 July 2024 and in force from 18 October 2024.

Two things about the Lithuanian regime catch organisations out, and both are on this page. First, your obligations do not begin when the law comes into force - they begin when you are registered, which means every deadline on this page is personal to your entity. For the first cohort, registered in April 2025, those personal deadlines have become dated ones: the organisational requirements fell due on 17 April 2026 and the technical ones fall due on 17 April 2027. Second, the headline fines everyone quotes are ceilings on ceilings: the Act sets a maximum, and then caps what share of that maximum a given breach can attract.

2 NIS2 implementation in Lithuania

Lithuania implemented NIS2 by restating the Kibernetinio saugumo įstatymas (Law on Cyber Security, No. XII-1428) through amending act No. XIV-2902, adopted by the Seimas on 11 July 2024, published in the Register of Legal Acts on 24 July 2024 and in force from 18 October 2024.

The detail sits in Government Resolution No. 818 of 13 August 2018, restated by Resolution No. 945 of 6 November 2024 (published 11 November, in force 12 November). It now carries seven instruments, and three of them govern most of what you have to do: the Kibernetinio saugumo reikalavimų aprašas (Description of Cybersecurity Requirements), which sets the controls and the 12 and 24-month deadlines; the national cyber incident management plan, which turns "significant" into numbers and sets the reporting routes and the deadlines for minor incidents; and the procedure for applying enforcement measures. The others are the methodology for identifying entities by special criteria, the list of users of the Secure State Data Network, that network's charging criteria and - added by Resolution No. 900 of 10 December 2025 - the list of EU acts treated as equivalent to the Act's requirements.

Supervision is centralised; identification is not. The Nacionalinis kibernetinio saugumo centras prie Krašto apsaugos ministerijos - the National Cyber Security Centre under the Ministry of National Defence, known as the NKSC - is the competent authority, the CSIRT and the single point of contact, and it is the body that inspects and imposes fines. Identifying entities is shared with the ministries named in the Act's annexes (Article 13(6)).

3 Who is in scope

Lithuania follows the NIS2 split into essential (esminiai subjektai) and important (svarbūs subjektai) entities, known collectively as kibernetinio saugumo subjektai. The identification criteria are in Article 11, and they were amended as recently as 4 July 2026.

4 Registration in KSIS, and when your duties actually start

This is the provision that reorders everything else. Article 11(2): a cybersecurity entity acquires the obligations of a cybersecurity entity only from the moment it is registered in the Kibernetinio saugumo informacinė sistema - the Cybersecurity Information System, known as KSIS. Until then, the duties in Articles 14, 15 and 18 do not bite.

5 Your 12 and 24-month clocks

Lithuania's implementation deadlines are relative, not calendar: they run from the day your entity was registered in KSIS. For the first cohort - the organisations registered in April 2025 - that has produced two national dates, and the first has passed.

The Act itself sets only a floor: Article 14(2) requires the Government to allow a period of not less than 12 months from registration. The 12 and 24-month figures are the Government's, in the Description of Cybersecurity Requirements - which is why they cannot be found by reading the Law on Cyber Security alone. The digital providers that follow Regulation (EU) 2024/2690 are outside points 71 and 72 altogether (Article 14(4)).

The April 2026 date is the Government's own reading: the NKSC's account of the Prime Minister's meeting with it, published on 4 June 2026, gives 17 April 2026 for the organisational measures and 17 April 2027 for the technical ones. At that point 74 public-sector bodies had either not started or were judged to be making insufficient progress - 27 had taken no step at all - and they were given until 31 August 2026 to appoint responsible persons, join KSIS, assess risk and adopt a risk-management plan.

6 The cybersecurity manager and the security officer

Article 15 requires two appointments, not one, and it sets statutory qualification requirements for both. Breaching the appointment duties sits in the middle severity band - up to half the maximum fine.

Article 15(5) sets who may hold the role. The person must meet the impeccable reputation standard that applies to civil servants; must not have had an administrative penalty for breaches in networks and information systems or in data protection and privacy imposed less than one year ago; and must satisfy one of four alternatives -

• at least 2 years' experience in IT, cybersecurity or networks and information systems; or
• a higher-education diploma confirming qualification in those fields; or
• an internationally recognised qualification certificate; or
• completion of NKSC-set training and a pass in the cybersecurity manager examination.

The fourth route is defined by NKSC Director's Order No. 1-96 (in force 4 December 2025, amended 26 January 2026): a manager or officer who meets none of the other routes completes at least 10 academic hours on twelve set topics - from security policy and risk analysis to cryptography and supply-chain security - and then passes the cybersecurity manager examination. The NKSC offers both free on its training platform, and the certificate is uploaded to KSIS (Order No. 1-96, points 5, 6 and 10). The entity must also tell the NKSC through KSIS whom it has appointed (Description, point 17).

7 Authorities, CSIRT and who supervises you

Lithuania is centralised for supervision - one regulator inspects, handles incidents and fines - but identification is shared with the sectoral ministries, and the Act names other bodies with real roles.

8 Incident reporting: 24h / 72h / one month

Article 18 sets two duties: a four-stage chain for significant incidents, and a separate duty to report incidents that do not meet the significance threshold. Both are filed through the National Cyber Incident Management Platform in KSIS, live since spring 2025; a form on the platform, the NKSC website, the NKSC's email address or a phone call are the fallbacks (incident plan, points 10-11).

When an incident is significant

Article 18(2) speaks of serious disruption, financial loss and substantial damage to others. Unless a Commission implementing act says more - as Regulation (EU) 2024/2690 does for the digital providers it covers - point 9 of the incident plan turns that into numbers. An incident is significant where it causes or may cause serious disruption to your services and meets at least one of these:

An incident is also significant on loss alone - EUR 500,000 or 5% of the previous financial year's turnover, whichever is lower - or where others suffer or may suffer material damage of 400 basic social benefits or more, non-material damage of EUR 10,000 or more, or harm to anyone's health or life (incident plan, points 9.2-9.3).

9 NIS2 timeline & key dates (Lithuania)

10 Sector-specific notes for Lithuania

• Energy: Annex 1 covers electricity (supply, distribution, transmission, generation, nominated market operators, aggregation, storage and demand response, and electric-vehicle charging point operators), district heating and cooling, oil, gas and hydrogen. The Ministry of Energy identifies entities in all of them.
• Digital infrastructure: only qualified trust service providers, top-level domain registries and DNS providers are essential regardless of size; cloud, data centres, content delivery networks and internet exchange points follow the general size test. DNS, top-level domain, cloud, data centre and content delivery providers, managed service and managed security service providers and trust service providers follow Regulation (EU) 2024/2690 instead of the national Description (Article 14(4)) - internet exchange points and electronic communications providers do not - and the NKSC is preparing a separate compliance questionnaire for them.
• Healthcare: personal health care institutions, EU reference laboratories, pharmaceutical research and manufacture and makers of critical medical devices sit in Annex 1, with size deciding essential or important. The NKSC's 2025 national exercise, "Kibernetinis skydas - TrustEx", brought together 28 organisations from health and water.
• Water: drinking water and waste water are both Annex 1 sectors, identified by the Ministry of Environment. A sector security operations centre set up with the water association "Vandens jėga" starts by monitoring five companies (NKSC, 17 November 2025).
• Manufacturing: Annex 2 reaches medical devices and NACE divisions C26 to C30 - electronics, electrical equipment, machinery, motor vehicles and other transport equipment - each with its own identifying ministry, and the 50% revenue test applies.
• Finance: DORA-covered entities follow DORA under Resolution No. 900's list. The Bank of Lithuania joined the national incident platform in July 2025, and the NKSC sends the financial sector a weekly threat report.
• Public sector: central, regional and municipal administration bodies are essential (Article 11(3)(5)); territorial state administration bodies are caught under the special criteria where an outage could last more than 24 hours or affect more than 145,000 residents or a whole municipality. Public bodies are not exempt from fines - they are fined on a separate scale, set out under penalties. In June 2026, 74 of them were flagged as lagging. A EUR 17 million EU recovery-fund project to equip 44 security operations centres, mostly in public bodies, was due to finish in spring 2026.
• Trust services: qualified trust service providers are essential regardless of size, and are the one group with a second regulator in the loop - the Ryšių reguliavimo tarnyba, which the NKSC must inform within 24 hours of any incident notification they file.

11 Penalties and fines

Article 30 sets four maximums, not two - and then Article 30(3) caps what proportion of that maximum any given breach can attract. Quoting "up to 10 million euro" describes the worst case for one class of breach by one class of entity.

Lithuania fines public bodies. It does not exempt them, as some transpositions do - it applies a different base and a hard low cap.

The severity bands, and why they change the number

Article 30(3) allows only a share of the maximum above, according to how Article 29 classifies the breach:

How a fine is actually imposed

• The fine is imposed by the head of the NKSC or a person they authorise - no court confirmation, no separate sanctions commission.
• The default is a written procedure with no hearing. An oral hearing happens on the entity's request or the NKSC's own initiative, with at least 10 working days' notice.
• The hearing is public by default, closed only to protect state, official, professional or commercial secrets or personal data. It is held in Lithuanian, with a guaranteed right to an interpreter, and the audio recording serves as the minutes.
• Decision within 20 working days; a copy is sent within 3 working days.
• No fine is imposed where one has already been imposed for the same breach under Article 58(2)(i) of the GDPR.
• Appeal lies to the administrative courts. The fine must be paid within 3 months of service, or of the court judgment upholding it.
• A breach counts as repeated where the same breach is committed within 12 months of an enforcement decision taking effect.
• No measure can be imposed more than 2 years after the breach - or, for a continuing breach, 2 years after it came to light (Article 28(7)).
• A fine decision is an enforceable title, collected under the Law on Tax Administration and the Code of Civil Procedure (Article 31(13), as amended from 30 June 2026).

12 What the NKSC can do to you

Article 28 gives the NKSC eleven enforcement measures, and a fine can be combined with any of them. Two reach further than most readers expect.

• Warnings that the entity is in breach.
• Binding instructions to essential entities on the measures needed to prevent or contain an incident, with deadlines for implementing them and for reporting back.
• Orders to stop conduct that breaches the Act and not to repeat it.
• Orders to bring risk-management measures into line with Article 14(1), or to comply with the Article 18 reporting duty, in a specified way and within a specified period.
• Orders to inform your own customers of a significant cyber threat, its nature, and what they can do about it.
• Orders to implement the recommendations of a cybersecurity audit within a reasonable period.
• Appointment of a monitoring officer (stebėsenos pareigūnas) with defined tasks, for a defined period, to supervise an essential entity's compliance with Articles 14 and 18.
• An order to make aspects of the breach public, in a specified manner.
• A fine under Articles 30 and 31, combinable with any of the above.
• Initiation of a temporary suspension of the right to carry on part or all of an essential entity's activity, or to provide services (Article 32). A district court orders it, only for a dangerous breach, only where measures 1-4 and 6 have proved ineffective and after at least 10 working days' notice to put things right - for no more than 4 months, extendable by up to 2 months at a time.
• Initiation of the temporary removal of an essential entity's chief executive (Article 33), on the same conditions, for no more than 6 months, extendable by up to 3 months at a time. Decisions taken by a suspended chief executive are void.

In setting a measure the NKSC must weigh the circumstances, the severity band, the duration of the breach, any breaches in the previous 2 years, the material and non-material damage caused, the steps taken to prevent or reduce it, adherence to approved codes of conduct or certification schemes, cooperation with the NKSC, the scale of the breach, and whether it was intentional or negligent (Article 28(3)).

How inspections work

• Essential entities face planned inspections under an annual plan the NKSC approves in the first half of each year and does not publish, plus unplanned inspections on any ground. Important entities face unplanned inspections only, on information suggesting a breach (Article 26; Order No. 1-23, points 7-10).
• Selection weighs significant incidents and critical vulnerabilities in the past year, leaked-data findings, earlier results - and KSIS questionnaire scores showing less than 50% of the requirements in place (Order No. 1-23, points 11 and 13).
• You get 10 working days' notice of a planned inspection, 20 working days (plus up to 10 on request) to complete the questionnaire and 5 working days to produce documents; missing those deadlines is itself recorded as non-compliance (points 15-19 and 61).
• Documents submitted for an inspection must be in Lithuanian (point 59).
• The seven 24-month technical requirements can be tested hands-on - logging, network segmentation, hardening, access control, cryptography, continuity - against a test plan agreed with you, and you may see the NKSC's tools and scripts first (points 42-43 and 60).
• An inspection runs up to 4 months, extendable to 6 (Article 27). Inspectors can enter premises, take copies for up to 30 days, and order a targeted audit at your expense where risk analysis shows a high risk (Article 27(3)). You get 20 working days to answer the draft report (Order No. 1-23, point 50).

13 The three-year cybersecurity audit

Article 14(8) requires every cybersecurity entity to carry out a cybersecurity audit at least once every three years, to a methodology the NKSC approves. Omitting it is a medium severity breach - up to half the maximum fine.

14 How Lithuania differs from the Directive

Ten things in the Lithuanian regime are not obvious from reading NIS2, and each of them changes what a compliance programme has to do.

• Your duties start on registration, not on the law. Article 11(2). Every deadline is personal to your entity - though for the April 2025 cohort they have become national dates: 17 April 2026 and 17 April 2027.
• The fine ceiling is banded by severity. Article 30(3) caps a low-severity breach at 10% of the headline maximum. The headline number applies to two duties only: the risk-management measures and significant-incident reporting.
• Public bodies are fined, on their own scale. Up to 1% or 0.5% of budget, capped at EUR 60,000 and EUR 30,000. Not exempt, and not on the commercial scale either.
• Minor incidents are reportable. Article 18(1)(2) reaches incidents that do not meet the significance test: a notification within 72 hours and a final report within a month.
• Two named roles, with a statutory qualification test. A kibernetinio saugumo vadovas and a saugos įgaliotinis, each subject to Article 15(5) - including, as one route to qualifying, the NKSC's course and cybersecurity manager examination. Most transpositions name one role, or none.
• The regulator can switch services off for 48 hours. Article 7(2)(6) lets the NKSC order public electronic communications providers, online marketplaces, search engines, cloud providers and hosting providers to restrict provision for up to 48 hours to stop an incident's impact, and Article 7(2)(7) to block domains used for malware, phishing or attack coordination.
• The regulator puts its own tools in your network. Article 16: the NKSC installs and runs technical cybersecurity measures in essential entities' systems, at its own cost, and essential entities must let it; important entities can ask for them to handle an incident.
• Post-quantum cryptography is already law. Resolution No. 185 writes into the Description a cryptography inventory from 1 January 2027, post-quantum migration plans from essential entities by 1 May 2027, post-quantum or hybrid cryptography in their high quantum-risk systems from 2031, and post-quantum algorithms everywhere asymmetric cryptography is used from 2036.
• Good-faith vulnerability research is lawful. Article 25 protects searching for vulnerabilities in cybersecurity entities' systems within set limits - no disruption, no password guessing, a report to the NKSC or the entity within 24 hours of starting - with public disclosure no earlier than 90 days after reporting, unless the NKSC sets a shorter period of at least 3 days.
• Suppliers can be drawn in directly. Under the special criteria, a long-term supplier with access to an essential entity's systems can itself be identified as an essential or important entity.

15 How to prepare for NIS2 in Lithuania

1. Check if you are likely in scope: review your sector, size and role against Annexes 1 and 2 and Article 11 - including the 50% revenue test, the no-size categories and the special criteria. The NKSC's online register check is switched off, so ask its register team directly.
2. Establish your registration status in KSIS, and do it first: it determines whether you have any obligations at all and when your clocks started. If you meet the Article 11 criteria and are not registered, Article 13(4) puts the duty to submit your data on you.
3. Run a gap assessment against the right text: the Description of Cybersecurity Requirements, or Regulation (EU) 2024/2690 if you are one of the digital providers. The NKSC's compliance questionnaire in KSIS is the yardstick its inspectors use, and essential entities must file it every year.
4. Appoint your kibernetinio saugumo vadovas and saugos įgaliotinis: check the Article 15(5) test for each. The carry-over for incumbent security officers runs only to 18 October 2026; from 19 October, anyone without the experience, diploma or certificate needs the NKSC course and examination. Keep both roles separate from system administration; the functions can be bought in from a supplier.
5. Plan against your own registration date: 12 months for the requirements generally and 24 for the seven listed technical requirements. For the April 2025 cohort that means 17 April 2026 has passed and 17 April 2027 is next - and there is no extension for either.
6. Build classification into your incident plan: the incident plan's point 9 thresholds decide which chain applies. Every stage of the significant-incident chain is a dangerous-band duty; minor incidents need a 72-hour notification and a final report within a month. File through the national platform, and set up automatic registration within 12 months of registration.
7. Review supply-chain risk: map critical suppliers and update contracts with explicit cybersecurity, audit and incident-notification clauses - and, if you supply an essential entity yourself on a long contract with access to its systems, check whether the special criteria reach you.
8. Use frameworks, but test against the Description: the Description draws some of its definitions from LST EN ISO/IEC 27002, and the NKSC's December 2025 risk-assessment methodology builds on ISO/IEC 27005, NIST and BSI practice. ISO/IEC 27001 is a sound structure, but the Description's controls are what an inspection checks.
9. Train the board: management body members, the head and any authorised person need at least 2 academic hours of training on ten set topics every two years, with the certificate uploaded to KSIS (Order No. 1-96).
10. Start the cryptography inventory now: it becomes a requirement on 1 January 2027, and essential entities owe a post-quantum migration plan by 1 May 2027.

16 Official links & resources

17 FAQ: NIS2 in Lithuania