Runs an essential service, in Latvia

Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti · Read the law's page

• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider among the medium-or-large digital providers it reaches expressly, for the reason given on this jurisdiction's companion risk-management row; the reporting duty in Article 39 itself binds any person who discovers the vulnerability, not only a covered subject.
• Once the competent cyber incident prevention institution relays a substantiated report that a vulnerability exists in a system or network you operate, remediate it within the deadline the institution sets, no later than 90 days from when you received the information.
• Report your remediation progress to the institution as you go, and, if you cannot remediate within 90 days for objective reasons, request an extension, which the institution may grant up to a total of 180 days from the report's submission.
• Where you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential.

Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024, amended by the law of 04.06.2026, in force 18.06.2026; redakcija no 01.10.2026), 25.-28. panti · Read the law's page

• Take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems you use, and to prevent or minimise to the greatest extent possible the impact of a cyber incident on your service recipients and on other services.
• Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of 25 June 2025, 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.
• Have your head or governing body appoint a cybersecurity manager within three months of notifying your essential- or important-provider status or of the National Cybersecurity Centre's decision on it, and notify the National Cybersecurity Centre and the Constitution Protection Bureau of the appointment within five working days.
• Since 18 June 2026, do not give privileged access to your ICT systems to a staff member convicted of an intentional crime linked to terrorism, against the state, the administrative order or property, or in the economy, unless they are rehabilitated or the conviction has been cleared; if such a person is convicted and not cleared, decide individually on their employment after weighing the security risk (Article 26.1).
• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider (Article 21(1)(2)(l)-(n)) among the medium-or-large digital providers it reaches expressly; the wider sector classes both Articles also reach (energy, transport, health, finance, drinking water, a large or medium cloud-computing, data-centre, content-delivery-network, or ICT-management or cybersecurity service provider, a domain-name-system service provider of any size, and direct and indirect public administration) are reached too, by declaring that you are an essential or important entity.
• This Law applies to a financial entity covered by Regulation (EU) 2022/2554 (DORA) only insofar as that Regulation or other law sets no other requirements, and its requirements and supervision do not apply to a subject covered by a sector-specific EU regime that is at least equivalent in effect (Article 3(3)-(4)).

Nacionālās kiberdrošības likums (adopted 20.06.2024, notification clock applying from 01.07.2025), 34. pants · Read the law's page

• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider among the medium-or-large digital providers it reaches expressly, for the reason given on this jurisdiction's companion risk-management row.
• Immediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (for most private-sector and civilian public-sector subjects, the Institute of Mathematics and Computer Science of the University of Latvia), and follow its instructions.
• For a significant cyber incident, electronically submit an early warning to the competent institution without delay and no later than within 24 hours.
• Follow with an initial report without delay and no later than within 72 hours (within 24 hours instead, if you are a trust service provider).
• Within one month of the initial report, submit a final report on the incident's resolution, or, if it is still unresolved at that point, a progress report followed by a final report once you have resolved it; submit an intermediate report if the competent institution requests one.
• Where relevant, immediately inform your service recipients, including affected network or system users, of protective measures they can take, and, after coordinating with the competent institution, inform them of the significant incident or threat itself, unless disclosure would create a new significant-incident risk or conflict with national security.

Ministru kabineta noteikumi Nr. 397, Minimālās kiberdrošības prasības (2025. gada 25. jūnijs) · Read the law's page

• If you are an essential or important service provider, or an owner or lawful possessor of ICT critical infrastructure, under the National Cybersecurity Law, these minimum requirements bind the networks and information systems you own or hold, other than those that process state secret, NATO, European Union or foreign-institution classified information (points 1 and 3).
• Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).
• Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).
• Review and update the cyber-risk-management and ICT-business-continuity plan at least once a year if you are an ICT critical infrastructure owner or an essential service provider holding a class A system, at least once in two years if you are another essential service provider, and at least once in three years if you are an important service provider (point 40).
• Enter each cyber incident in the cyber incident log within 24 hours of detecting it, assess its significance at once, and report a significant incident to the competent cyber incident prevention institution on the early warning, initial report, progress report, intermediate report and final report forms within the clocks of Article 34 of the Law (points 47, 117 and 119).
• Give every employee and official who uses your ICT resources an initial cybersecurity briefing within one month of registering their user account and a routine briefing at least once a calendar year, and train your ICT staff at least once a year (point 76).
• If you are an ICT critical infrastructure owner or lawful possessor, buy technical resources for a class A information system only from a supplier and manufacturer that meet the registration, board, beneficial-owner and shareholder conditions of point 94, unless point 95 lifts them, and obtain the Constitution Protection Bureau's opinion before contracting for services to a class A system (points 93 and 94).