LexLint.ioBeta

Know the law your code answers to.

Law / Lithuania

Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures

Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428 as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 14

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This binds a cybersecurity subject (essential or important entity) that NKSC has entered in the Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law, sector lists that reach, among others, an internet search engine, an online marketplace and a social-networking-service platform provider as a "special subject"; the wider sector classes the Annexes also reach (critical-infrastructure operators, energy, transport, health, finance, public administration and others) are reached too, by declaring that you are an essential or important entity.
  • Adopt and keep current cybersecurity policy documents, periodically analyse and manage your cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure your supply chain, and deploy technical cybersecurity measures.NIST CSF 2.0GV.PO-01
  • Designate a cybersecurity manager and/or security officer who organises your risk assessment and prepares your risk-assessment reports and risk-management plans for approval, and have your management body, head and designated representative complete cybersecurity training at least once every two years.NIST CSF 2.0GV.RR-02NIST CSF 2.0PR.AT-02
  • Follow the detailed technical and organisational measures the Government's Cybersecurity Requirements Description sets out; if you are newly registered, you have 12 months from registration to implement the requirements and 24 months to implement the technical requirements the Description names.NIST CSF 2.0GV.OC-03
  • Where you are a DNS service provider, top-level-domain registry, cloud service provider, data-centre service provider, content-delivery-network provider, managed service provider, managed security service provider, electronic-marketplace service provider, internet search engine or social-networking-service-platform provider, or a trust service provider, follow instead the cybersecurity risk-management measures of the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690, binding from the moment you enter the Register rather than the Government's own Requirements Description.

These lines are LexLint's reading of the law's text. Also read by: Krašto apsaugos ministerija (Ministry of National Defence) (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

NKSC's sanctions for a violation are administrative and judicial-order measures, a graduated ladder of enforcement measures culminating in a fine, plus a district court order temporarily removing an essential entity's head from office on NKSC's request. No description of Article 14 treats its violation as a criminal offence.

Penalty structure

Article 30(2) of the Law sets the maximum fines for the violations Article 29 lists at up to EUR 10,000,000 or up to 2 percent of the legal person's total worldwide annual turnover for the preceding financial year for an essential entity, and at up to EUR 7,000,000 or up to 1.4 percent of that turnover for an important entity, whichever amount is higher in each case; this field holds the essential-entity tier.

Rule
Higher of
As of
Currency
EUR
Fixed cap
10,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Nacionalinis kibernetinio saugumo centras (NKSC, National Cyber Security Centre) under the Ministry of National Defence (Krašto apsaugos ministerija), transposing the NIS2 Directive's competent-authority, single-point-of-contact and CSIRT designations.

Settledness

As of
Guidance link
https://kam.lt/kibernetinio-saugumo-istatymas/
Guidance body
Krašto apsaugos ministerija (Ministry of National Defence)
Open questions
  • The Ministry's guidance states that the fines NKSC may impose differ by entity type without giving the lower figure: what are Articles 30 (Baudos) and 31's (Baudų skyrimo tvarka) fine amounts for an important entity specifically?
  • Does the centralised national cyber-incident reporting and management platform the Ministry's guidance describes as still under construction change the reporting channel or clock once it launches?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 14 requires a cybersecurity subject entered in NKSC's Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law to adopt and keep current cybersecurity policy documents, periodically analyse and manage its cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure its supply chain, and deploy technical cybersecurity measures.

Under Article 11(2), a cybersecurity subject takes on the duties set for cybersecurity subjects only from its registration in the Cybersecurity Information System. The Government's Cybersecurity Requirements Description sets out the detailed technical and organisational measures Article 14 requires, with 12 months from registration to implement the requirements and 24 months for the technical requirements it names.

Article 14(7) separately requires the subject's management-body members, head and designated representative to complete cybersecurity training at least once every two years.

A named subset of digital-service "special subjects" includes a DNS service provider, a top-level-domain registry, a cloud or data-centre service provider, a content-delivery-network, managed-service or managed-cybersecurity-service provider, an electronic-marketplace provider, and an internet-search-engine or social-networking-service-platform provider.

A special subject or trust service provider must comply only with the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690 risk-management measures from the moment of its own entry into the Register, under Article 14(4) of the Law. Only an essential entity's activity or services may be temporarily suspended, and only an essential entity's head may be temporarily removed from office by a district court order on NKSC's request.

Law No. XV-894 of , published in the Register of Legal Acts on , amended only article 31 of the Law on Cyber Security No. XII-1428 and not article 14. Law No. XV-1076 of , published on , amended articles 2, 11, 12, 13, 19, 23, 28, 30, 31 and 38 and Annexes 2 and 3 of that law, none of them article 14.

Article 1(3) disapplies Article 14, Article 15 and Article 18(1)(1) and (2) to a cybersecurity subject whose applicable EU legal acts require cybersecurity risk-management measures, notification of significant cyber incidents or designation of the persons responsible for cybersecurity with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service or operates a social platform.

Back to the example  ·  Lint your app

Page updated .