NIS2 Latvia: National Cybersecurity Law 2024
See how Latvia has implemented the NIS2 Directive through the National Cybersecurity Law, which entered into force on 1 September 2024, what it means for essential and important entities, and how the National Cyber Security Centre and CERT-LV oversee compliance, registration and minimum cybersecurity requirements.
Introduction: NIS2 Directive & the Latvian context
Latvia was already operating a cybersecurity regime under the Law on the Security of Information Technologies. With NIS2, Latvia has moved to a new National Cybersecurity Law that significantly updates the legal framework and expands the number of organisations subject to cybersecurity obligations.
The new law strengthens risk management, incident reporting and supervision across both public and private sectors, and is complemented by detailed minimum cybersecurity requirements adopted in 2025.
NIS2 implementation in Latvia
Latvia has implemented NIS2 through the National Cybersecurity Law (Nacionālās kiberdrošības likums), adopted by Parliament on 20 June 2024 and replacing the former Law on the Security of Information Technologies.
The law entered into force on 1 September 2024 and explicitly aims to implement the requirements of Directive (EU) 2022/2555 (NIS2) and strengthen national cybersecurity measures.
In 2025, Latvia introduced minimum cybersecurity requirements through Cabinet Regulation No. 397 and related secondary legislation, further detailing technical and organisational measures for entities in scope.
Status
NIS2 is fully transposed in Latvia. The National Cybersecurity Law is in force and supported by minimum cybersecurity requirements and other implementing regulations.
Legal structure
The National Cybersecurity Law sets out obligations for essential and important entities, defines supervisory powers, and is complemented by Cabinet regulations on minimum cybersecurity requirements and incident reporting.
Supervisory approach
The National Cyber Security Centre and CERT-LV coordinate supervision, registration and incident handling, working with sectoral regulators where necessary.
NIS2 Latvia: what you need to know about compliance
Latvia closely follows the NIS2 model of essential and important entities. The new law significantly expands the number of regulated organisations, with estimates ranging from several thousand to nearly eight thousand entities in scope by 2025.
Who is in scope?
- Entities operating in NIS2 Annex I sectors (energy, transport, health, drinking water, digital infrastructure, public administration, etc.).
- Entities operating in NIS2 Annex II sectors (postal and courier services, waste management, food, manufacturing of critical products, research, etc.).
- Medium-sized and larger organisations meeting NIS2 staff or turnover thresholds.
- Entities covered regardless of size, such as DNS and TLD service providers, trust services, and major cloud or data-centre operators.
Core obligations
- Implement risk-management measures aligned with NIS2, including governance, policies and technical controls.
- Maintain inventories of critical systems, networks and information assets.
- Detect, manage and report significant incidents within defined timeframes (early warning, incident notification, final report).
- Manage supply-chain cybersecurity risk and include security and notification clauses in key contracts.
- Ensure management bodies approve cybersecurity risk-management measures and exercise ongoing oversight.
Registration & categorisation
Entities must self-assess and register with the competent authority when they provide essential or important services. The Latvian law categorises entities into groups based on criticality and service type, which determines the intensity of supervision and reporting.
NIS2 timeline & key dates (Latvia)
Sector-specific notes for Latvia
- Energy: electricity and gas infrastructure operators are treated as essential entities, with strict continuity and reporting requirements.
- Transport: key road, rail, air and port operators are covered as essential or important entities.
- Digital infrastructure: data centres, cloud providers, electronic communications networks and DNS/TLD operators are a major focus of the Latvian regime.
- Public administration: central and selected local public authorities are brought into scope to protect critical public services and e-government systems.
- Manufacturing and services: certain manufacturers and service providers critical to national security or economic stability are included based on NIS2 and national criteria.
Penalties for non-compliance
The National Cybersecurity Law introduces an enforcement and sanctions regime aligned with NIS2, allowing for substantial administrative fines, corrective measures and strengthened supervision where entities do not meet their obligations.
- High administrative fines, including turnover-based penalties for serious or repeated breaches.
- Binding orders and mandatory remediation plans issued by the competent authority.
- Enhanced supervision and follow-up audits for entities with systemic deficiencies.
- Potential management liability where governance and oversight obligations are not met.
How to prepare for NIS2 in Latvia
- Assess if you are in scope: map your services and size against NIS2 Annex I & II sectors and the categories defined in the National Cybersecurity Law.
- Confirm registration obligations: check registration deadlines and required data for essential and important entities with CERT-LV / National Cyber Security Centre.
- Run a NIS2 gap assessment: compare your existing cybersecurity posture against legal requirements and minimum cybersecurity regulations.
- Strengthen incident detection & reporting: implement monitoring, escalation and reporting processes that meet Latvian timelines and formats.
- Review supply-chain risk: identify critical ICT and service providers and update contracts to include cybersecurity and incident-notification obligations.
- Align with recognised frameworks: use ISO/IEC 27001, NIST CSF or similar frameworks to structure governance, risk management and documentation.
- Train leadership and staff: ensure management and key teams understand their responsibilities under the National Cybersecurity Law and NIS2.