Law / Latvia

Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements

Ministru kabineta noteikumi Nr. 397, Minimālās kiberdrošības prasības (2025. gada 25. jūnijs)

In force since 2 Jul 2025.

A sector security regimes rule binding public and private bodies.

Obligation class

Security, Governance, Reporting

As of 12 October 2026.

What it requires

• If you are an essential or important service provider, or an owner or lawful possessor of ICT critical infrastructure, under the National Cybersecurity Law, these minimum requirements bind the networks and information systems you own or hold, other than those that process state secret, NATO, European Union or foreign-institution classified information (points 1 and 3).
• Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).NIST CSF 2.0GV.PO-01NIST CSF 2.0ID.AM-02NIST CSF 2.0ID.IM-04
• Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).NIST CSF 2.0ID.AM-02NIST CSF 2.0ID.AM-05
• Review and update the cyber-risk-management and ICT-business-continuity plan at least once a year if you are an ICT critical infrastructure owner or an essential service provider holding a class A system, at least once in two years if you are another essential service provider, and at least once in three years if you are an important service provider (point 40).NIST CSF 2.0ID.IM-04
• Enter each cyber incident in the cyber incident log within 24 hours of detecting it, assess its significance at once, and report a significant incident to the competent cyber incident prevention institution on the early warning, initial report, progress report, intermediate report and final report forms within the clocks of Article 34 of the Law (points 47, 117 and 119).NIST CSF 2.0RS.AN-06NIST CSF 2.0RS.MA-03NIST CSF 2.0RS.CO-02
• Give every employee and official who uses your ICT resources an initial cybersecurity briefing within one month of registering their user account and a routine briefing at least once a calendar year, and train your ICT staff at least once a year (point 76).NIST CSF 2.0PR.AT-01NIST CSF 2.0PR.AT-02
• If you are an ICT critical infrastructure owner or lawful possessor, buy technical resources for a class A information system only from a supplier and manufacturer that meet the registration, board, beneficial-owner and shareholder conditions of point 94, unless point 95 lifts them, and obtain the Constitution Protection Bureau's opinion before contracting for services to a class A system (points 93 and 94).NIST CSF 2.0GV.SC-06

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• ID.IM-P1Systems/products/services that process data are inventoried.
• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.

NIST CSF 2.0

• GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
• GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
• ID.AM-02Inventories of software, services, and systems managed by the organization are maintained
• ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
• ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
• PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

4 more

• PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
• RS.MA-03Incidents are categorized and prioritized
• RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
• RS.CO-02Internal and external stakeholders are notified of incidents

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.
• 8.2Turning on and gathering logs from the enterprise's systems.

1 more

• 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest

7 more

• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.1Risk management framework
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging

11 more

• 3.4Event assessment and classification
• 3.5Incident response
• 3.6Post-incident reviews
• 4.1Business continuity and disaster recovery plan
• 4.3Crisis management
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure
• 9.1Cryptography
• 11.2Management of access rights
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.

Back to the example  ·  Lint your app