Duty LXD-7131
Runs an essential service, in Lithuania
Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measuressince 4 lines
Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 14 · Read the law's page
- Adopt and keep current cybersecurity policy documents, periodically analyse and manage your cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure your supply chain, and deploy technical cybersecurity measures.
- Designate a cybersecurity manager and/or security officer who organises your risk assessment and prepares your risk-assessment reports and risk-management plans for approval, and have your management body, head and designated representative complete cybersecurity training at least once every two years.
- Follow the detailed technical and organisational measures the Government's Cybersecurity Requirements Description sets out; if you are newly registered, you have 12 months from registration to implement the requirements and 24 months to implement the technical requirements the Description names.
- Where you are a DNS service provider, top-level-domain registry, cloud service provider, data-centre service provider, content-delivery-network provider, managed service provider, managed security service provider, electronic-marketplace service provider, internet search engine or social-networking-service-platform provider, or a trust service provider, follow instead the cybersecurity risk-management measures of the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690, binding from the moment you enter the Register rather than the Government's own Requirements Description.
- This binds a cybersecurity subject (essential or important entity) that NKSC has entered in the Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law, sector lists that reach, among others, an internet search engine, an online marketplace and a social-networking-service platform provider as a "special subject"; the wider sector classes the Annexes also reach (critical-infrastructure operators, energy, transport, health, finance, public administration and others) are reached too, by declaring that you are an essential or important entity.
Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notificationsince 5 lines
Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 18 · Read the law's page
- Notify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it.
- Follow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning.
- Submit a final report within one month of the day you submitted the early warning (the notification in Article 18(4)(1)), and an interim report on NKSC's request within the deadline NKSC sets.
- If the incident is still ongoing when the final report falls due, submit a progress report, and submit the final report within one month of the day the incident was contained.
- Report to NKSC every cyber incident affecting you, not only a significant one, and every near-miss incident; if you have no statutory duty to report, you may still do so to NKSC voluntarily.
- This binds the same essential and important cybersecurity subjects, including the internet-search-engine, online-marketplace and social-networking-service-platform "special subjects", as this jurisdiction's companion risk-management row.