LithuaniaKibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification
Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428 as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of , in force since , and amended by Nr. XV-894 of and Nr. XV-1076 of (consolidated edition of ), Art. 18
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the same essential and important cybersecurity subjects, including the internet-search-engine, online-marketplace and social-networking-service-platform "special subjects", as this jurisdiction's companion risk-management row.
- Notify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it.
- Follow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning.
- Submit a final report within one month of the day you submitted the early warning (the notification in Article 18(4)(1)), and an interim report on NKSC's request within the deadline NKSC sets.
- If the incident is still ongoing when the final report falls due, submit a progress report, and submit the final report within one month of the day the incident was contained.
- Report to NKSC every cyber incident affecting you, not only a significant one, and every near-miss incident; if you have no statutory duty to report, you may still do so to NKSC voluntarily.
These lines are LexLint's reading of the law's text. Also read by: Krašto apsaugos ministerija (Ministry of National Defence) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
NKSC's sanctions for a violation, including a failure to report, are administrative and judicial-order measures culminating in a fine, plus a district court order temporarily removing an essential entity's head from office on NKSC's request. No description of a reporting failure treats it as a criminal offence.
Penalty structure
Article 30(2) of the Law sets the maximum fines for the violations Article 29 lists at up to EUR 10,000,000 or up to 2 percent of the legal person's total worldwide annual turnover for the preceding financial year for an essential entity, and at up to EUR 7,000,000 or up to 1.4 percent of that turnover for an important entity, whichever amount is higher in each case; this field holds the essential-entity tier.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Nacionalinis kibernetinio saugumo centras (NKSC, National Cyber Security Centre) under the Ministry of National Defence (Krašto apsaugos ministerija).
Settledness
- As of
- Guidance link
- https://kam.lt/kibernetinio-saugumo-istatymas/
- Guidance body
- Krašto apsaugos ministerija (Ministry of National Defence)
- Open questions
- What does Article 18 require as the content of an incident notification, and what are Articles 30-31's fine amounts as they apply to a reporting failure specifically?
- Does the centralised national cyber-incident reporting and management platform the Ministry's guidance describes as still under construction change the reporting channel, form or clock once it launches?
What this law does
Article 18 requires an essential or important cybersecurity subject to notify NKSC of a significant cyber incident without delay and not later than within 24 hours of becoming aware of it, then follow within 72 hours with an assessment of the incident's severity and impact and any evidence of compromise. Under Article 11(2), a cybersecurity subject takes on the duties set for cybersecurity subjects only from its registration in the Cybersecurity Information System.
A final report is due within one month of the day the 24-hour early warning was submitted, and NKSC may request an interim report. A minor incident, one that does not meet the Law's major-incident criteria, is notified to NKSC without delay and not later than 72 hours after becoming aware of it, under point 13 of the Government's National Cyber Incident Management Plan.
The Law requires an essential or important subject to notify NKSC of every cyber incident affecting it, not only a significant one. A subject with no statutory duty to report may still notify NKSC of a cyber incident, threat or near-miss voluntarily. NKSC is developing a centralised national cyber-incident reporting and management platform, not yet launched, under a single-window principle for NKSC, the Lithuanian police and the State Data Protection Inspectorate to coordinate on.
Law No. XV-894 of , published in the Register of Legal Acts on , amended only article 31 of the Law on Cyber Security No. XII-1428 and not article 18. Law No. XV-1076 of , published on , amended articles 2, 11, 12, 13, 19, 23, 28, 30, 31 and 38 and Annexes 2 and 3 of that law, none of them article 18.
Article 1(3) disapplies Article 14, Article 15 and Article 18(1)(1) and (2) to a cybersecurity subject whose applicable EU legal acts require cybersecurity risk-management measures, notification of significant cyber incidents or designation of the persons responsible for cybersecurity with at least equivalent effect.
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .