NIS2 obligations in Lithuania

Competent authority & CSIRT Legal ref: Art. 4, 5, 7, 9, 10

• National Cyber Security Centre (as well national CSIRT). ecs-org.eu · 28 Oct 2026 · secondary source
• The cyber security policy is formulated, its implementation is organized, controlled and coordinated by the Ministry of National Defense of the Republic of Lithuania. ecs-org.eu · 28 Oct 2026 · secondary source
• It is implemented by the National Cyber Security Center, the Lithuanian Police and the State Data Protection Inspectorate. ecs-org.eu · 28 Oct 2026 · secondary source
• The Ministry of Foreign Affairs participates in the formation of the cyber security policy to the extent that it is necessary to determine the legal regulation of the application of diplomatic measures in response to cyber threats and cyber incidents. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 1, 11

• In addition to NIS2: national security, public security, defence or law enforcement entities. ecs-org.eu · 28 Oct 2026 · secondary source
• The Law on Cybersecurity, with the exception of Chapter VII (not a NIS2 regulatory domain), shall not apply to intelligence agencies. This Law shall not apply to credit unions, except credit unions that operate and/or manage network and information systems independently of central credit unions for the provision of services or activities. ecs-org.eu · 28 Oct 2026 · secondary source
• Some articles of the Law on Cybersecurity may not apply to entities if EU legislation applicable to them contains requirements to implement cyber security risk management measures, to report major cyber incidents or to appoint persons responsible for cyber security and if the impact of these requirements is at least equivalent to the impact of the requirements set out in this law. It is decided by the Government’s resolution. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 11, 13, 19

• Entities are required to submit the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of entity/name and personal identification number of a natural person. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector. ecs-org.eu · 28 Oct 2026 · secondary source
• Provided services. ecs-org.eu · 28 Oct 2026 · secondary source
• Legal address. ecs-org.eu · 28 Oct 2026 · secondary source
• Network and information systems relevant to the provision of services. ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• List of the countries where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address . ecs-org.eu · 28 Oct 2026 · secondary source
• Identification criteria are based on objective criteria, i.e. size and revenue thresholds, managing and/or maintaining state information resources, etc., and specific criteria ( i.e. assessing whether the entity is the only provider of the service, whether an incident on the entity’s systems could have a ‘cascading’ effect, etc.). ecs-org.eu · 28 Oct 2026 · secondary source
• Entities will be registered in register of Cybersecurity entities. The process of identification of essential and critical entities would involve the ministries responsible for the relevant sector of activity, as well as legal and natural persons themselves. Individuals would also have the right to voluntarily apply to be included in the register. Entities will be informed accordingly by electronic notification of their inclusion in the register. ecs-org.eu · 28 Oct 2026 · secondary source
• The Register would be regularly updated on the basis of information received from the entities. The detailed process for the identification of entities will be set out in the regulations of the register. Principle of self-declaration is applied only on a small scale. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 18

• Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours of becoming aware of the significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident notification within 72 hours . ecs-org.eu · 28 Oct 2026 · secondary source
• Intermediate report on relevant status updates at the request of the National Cyber Security Centre. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• The proposed definition of the ‘incident’ in the amendment to the Cyber Security Law: ‘incident means an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 30

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 1 percent of the budgetary institution’s budget for the current year and other gross annual income received in the previous year, but not exceeding EUR 60,000 (budgetary institution, which is an essential entity). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 0.5 percent of the budgetary institution’s budget for the current year and the amount of other gross annual income received in the previous year, but not exceeding EUR 30,000 ( budgetary institution that is an important entity). ecs-org.eu · 28 Oct 2026 · secondary source
• From 250 to 3000 EUR (repeatedly from 2000 to 6000 EUR) (for managers of legal entities or their authorized persons). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 3

• National framework similar to ISO 27001 Reference to ENISA’s Security Measures Reference Document. ecs-org.eu · 28 Oct 2026 · secondary source
• The Cyber security measures framework in Lithuania is in force since 2016. It is based on ISO 27001 and was amended several times (first time during the NIS1 transposition). ecs-org.eu · 28 Oct 2026 · secondary source
• Lithuania’s NIS2 transposition follows a classical approach to risk analysis, making small amendments to the general requirements on risk analysis established in the NIS2 Directive. There is no required or suggested methodology. The entity must designate a head of cybersecurity responsible, among other things, for developing and implementing a risk analysis methodology. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 18 Oct 2024
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source