NIS2 Lithuania: Amended Law on Cyber Security 2024
See how Lithuania has implemented the NIS2 Directive through the amended Law on Cyber Security, in force since 18 October 2024, what it means for essential and important “cybersecurity entities”, and how the National Cyber Security Centre (NCSC) supervises thousands of organisations across critical sectors.
Introduction: NIS2 Directive & the Lithuanian context
Lithuania was already operating under a national Law on Cyber Security and NIS1-based requirements for certain operators of essential services. However, the NIS2 Directive required a broader, more detailed framework and a significant expansion of the entities subject to cybersecurity obligations.
With the 2024 amendments to the Law on Cyber Security, Lithuania has moved to a fully NIS2-aligned regime, combining centralised oversight, military-led coordination through the NCSC, and a structured compliance path for thousands of organisations across both public and private sectors.
NIS2 implementation in Lithuania
Lithuania has implemented NIS2 via amendments to the Law on Cyber Security of the Republic of Lithuania (LCS), adopted by the Seimas on 11 July 2024 and in force since 18 October 2024. This law transposes the core requirements of Directive (EU) 2022/2555 into Lithuanian law.
On 11 November 2024, the Government adopted an updated Resolution on the implementation of the Law on Cyber Security, which entered into force on 12 November 2024. It sets detailed cybersecurity requirements, reporting rules and criteria for identifying essential and important entities.
Lithuania uses a highly centralised model: the National Cyber Security Centre under the Ministry of National Defence (NCSC) coordinates NIS2 implementation, maintains the register of entities in scope and steers supervision and enforcement.
Status
NIS2 is fully transposed in Lithuania. The amended Law on Cyber Security and its implementing Resolution are in force, and Lithuania is considered one of the earliest NIS2 adopters in the EU.
Legal structure
The amended Law on Cyber Security (LCS) and Government Resolution on its implementation together define scope, obligations, designation of “cybersecurity entities”, supervisory powers and sanctions.
Supervisory approach
NCSC identifies and lists in-scope entities, coordinates with ministries and sector regulators, manages cyber incidents, and runs national outreach and guidance programmes.
NIS2 Lithuania: what you need to know about compliance
Lithuania closely follows the NIS2 model of essential and important entities, referred to nationally as “cybersecurity entities”. The law significantly expands the number of regulated organisations, from roughly 1,000 under the previous regime to an estimated 8,000–10,000 entities.
Who is in scope?
- Entities in NIS2 Annex I sectors (energy, transport, health, drinking water, digital infrastructure, public administration, etc.).
- Entities in NIS2 Annex II sectors (postal and courier services, waste management, food, manufacturing of critical products, research, etc.).
- Medium and large organisations meeting national size/turnover thresholds, typically:
- Essential entities: ≥ 250 employees or ≥ €50m turnover.
- Important entities: ≥ 50 employees or ≥ €10m turnover.
- Additional categories defined nationally, including certain local public administrations, research institutions and hosting service providers.
Core obligations
- Implement comprehensive cybersecurity risk-management measures aligned with NIS2 Article 21.
- Maintain governance documentation, including board-approved cybersecurity plans and policies.
- Ensure incident detection, response and reporting processes meet the 24h / 72h / 30-day notification ladder.
- Manage supply-chain cybersecurity risks and document security requirements for critical suppliers.
- Provide training and oversight at management level; directors are explicitly accountable for cybersecurity.
Identification & listing
Entities do not self-register. Instead, NCSC, together with other authorities, identifies entities in scope and enters them into a dedicated NIS2 register. Legacy NIS1 operators are automatically treated as essential entities and listed accordingly.
Once listed, entities are formally notified and their individual compliance deadlines start to run.
NIS2 timeline & key dates (Lithuania)
Sector-specific notes for Lithuania
- Energy: the scope covers a broad set of energy operators, including electricity, gas, LNG, hydrogen and district heating operators, with strong monitoring and reporting to energy regulators.
- Digital infrastructure: data centres, cloud providers, electronic communications networks and DNS/TLD operators are treated as highly critical, often essential regardless of size.
- Healthcare: the number of covered healthcare providers has increased substantially, with expectations around incident drills and alignment with standards such as ISO/IEC 27001.
- Manufacturing & industry: many manufacturing companies become important entities, particularly where they support critical supply chains or national strategic sectors.
- Public sector: ministries, central public bodies and larger municipalities are included to strengthen the resilience of public services and state digital infrastructure.
Penalties for non-compliance
The Lithuanian NIS2 regime introduces a robust sanctions framework, with high administrative fines and explicit management liability to ensure that cybersecurity is treated as a board-level priority.
- For essential entities: fines up to approximately €10 million or 2% of global annual turnover (whichever is higher) for the most serious breaches.
- For important entities: fines up to approximately €7 million or 1.4% of global annual turnover.
- Separate fines for procedural breaches (e.g. missed deadlines, incomplete reporting).
- Possibility of daily coercive penalties and enhanced supervision in case of continued non-compliance.
- Potential disqualification of directors for repeated or serious negligence, and corrective measures for public-sector bodies instead of monetary fines.
How to prepare for NIS2 in Lithuania
- Check if you are likely in scope: review your sector, size and role against NIS2 Annex I & II and national criteria; use the NCSC self-check tools where available.
- Monitor your listing status: follow NCSC communications and confirm whether your organisation has been included in the cybersecurity entities register.
- Run a gap assessment: compare your current controls against NIS2 Article 21 and Lithuanian cybersecurity requirements (governance, technical measures, documentation, reporting).
- Plan for the 12–24 month window: design a realistic roadmap to implement organisational measures within 12 months and technical controls within 24 months of listing.
- Strengthen incident readiness: create or update your incident response plan around the 24h / 72h / 30-day reporting scheme and align it with GDPR where personal data is involved.
- Review supply-chain risk: map critical suppliers and update contracts with explicit cybersecurity, audit and incident-notification clauses.
- Align with recognised frameworks: leverage ISO/IEC 27001, NIST CSF or similar frameworks to structure your ISMS and evidence NIS2 compliance.
- Engage the board: ensure that management formally approves the cybersecurity programme and receives regular updates and training on NIS2 obligations.