Law / Latvia

Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA

Latvijas Bankas noteikumi Nr. 409 Prasības digitālās darbības nepārtrauktības un noturības jomā finanšu tirgus dalībniekiem, kuriem nepiemēro Regulu (ES) 2022/2554 (2026. gada 5. janvāris)

In force since 15 Jan 2026.

A sector security regimes rule binding private bodies.

Criminal exposure

No

Private right of action

No

Criminal exposure note

The regulations create no offence and set no penalty of their own.

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you are an alternative investment fund manager, insurer, reinsurer, insurance intermediary, savings and loan association, small private pension fund or giro settlement institution that Article 6(1) of the Financial Market Digital Operational Resilience Law takes out of DORA, these rules apply to you; a small intermediary, a point 2.4 person or a small pension fund is bound only by points 12.1, 13, 18.3, 18.4, 26.7, 26.8 and 28 (points 2 and 4).
• Introduce and document an ICT risk-management and control framework for which your management bears overall responsibility, and apply it in proportion to your scope, staff, services and use of ICT (points 3, 5 and 6).NIST CSF 2.0GV.PO-01NIST CSF 2.0GV.RR-01
• Draw up, document and implement an information security policy and set the ICT security measures that follow from it, including those your ICT service providers must apply (points 8 and 9).NIST CSF 2.0GV.PO-01NIST CSF 2.0GV.SC-05
• Identify, classify and document your critical and important functions, the information and ICT assets that support them and their dependencies (points 10 and 11), and carry out and document an ICT risk assessment at least once a year (point 13).NIST CSF 2.0ID.AM-05NIST CSF 2.0ID.RA-05

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• ID.BE-P3Systems/products/services that support organizational priorities are identified and key requirements communicated.

NIST CSF 2.0

• GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
• GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
• GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
• ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
• ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.2Compliance monitoring
• 3.2Monitoring and logging
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app is a bank, is an insurer, is a securities firm or is a payment provider.

Back to the example  ·  Lint your app