LatviaNacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures
Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024, amended by the law of 04.06.2026, in force 18.06.2026; redakcija… no 01.10.2026), 25.-28. panti
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider (Article 21(1)(2)(l)-(n)) among the medium-or-large digital providers it reaches expressly; the wider sector classes both Articles also reach (energy, transport, health, finance, drinking water, a large or medium cloud-computing, data-centre, content-delivery-network, or ICT-management or cybersecurity service provider, a domain-name-system service provider of any size, and direct and indirect public administration) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems you use, and to prevent or minimise to the greatest extent possible the impact of a cyber incident on your service recipients and on other services.NIST CSF 2.0ID.RA-06
- Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of , 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.NIST CSF 2.0ID.IM-04NIST CSF 2.0PR.AT-01
- Have your head or governing body appoint a cybersecurity manager within three months of notifying your essential- or important-provider status or of the National Cybersecurity Centre's decision on it, and notify the National Cybersecurity Centre and the Constitution Protection Bureau of the appointment within five working days.NIST CSF 2.0GV.RR-02
- Since , do not give privileged access to your ICT systems to a staff member convicted of an intentional crime linked to terrorism, against the state, the administrative order or property, or in the economy, unless they are rehabilitated or the conviction has been cleared; if such a person is convicted and not cleared, decide individually on their employment after weighing the security risk (Article 26.1).NIST CSF 2.0GV.RR-04
- This Law applies to a financial entity covered by Regulation (EU) 2022/2554 (DORA) only insofar as that Regulation or other law sets no other requirements, and its requirements and supervision do not apply to a subject covered by a sector-specific EU regime that is at least equivalent in effect (Article 3(3)-(4)).
These lines are LexLint's reading of the law's text. Also read by: Nacionālais kiberdrošības centrs (National Cybersecurity Centre), Ministry of Defence of the Republic of Latvia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.RR-04Cybersecurity is included in human resources practices
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 46's penalty for a material non-compliance with Article 27 or 28 is an administrative fine (soda nauda) the National Cybersecurity Centre or the Constitution Protection Bureau imposes directly; the Act creates no criminal offence for the non-compliance.
Penalty structure
Article 46(1) sets the essential-entity ceiling at EUR 10,000,000 or, where the entity's total net turnover for the last financial year exceeds EUR 500,000,000, up to 2 percent of that turnover, mirroring NIS2 Article 34(4). Article 46(2) sets the important-entity ceiling at EUR 7,000,000 or, above the same EUR 500,000,000 turnover gate, up to 1.4 percent, mirroring NIS2 Article 34(5). Article 46(3) applies the essential-entity tier to an owner or lawful possessor of ICT critical infrastructure through the Constitution Protection Bureau. The fine reaches only a 'material non-compliance' as Article 46(5) defines it, which includes a subject's failure to take the appropriate and proportionate measures this row's own Article 27 duty requires.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Nacionālais kiberdrošības centrs (National Cybersecurity Centre, NKDC, operating within the Ministry of Defence), as the Article 41(1) competent supervisory authority for an essential or important service provider other than information and communication technology (ICT) critical infrastructure; Satversmes aizsardzības birojs (Constitution Protection Bureau, SAB) for an owner or lawful possessor of ICT critical infrastructure under Article 41(2).
Settledness
- As of
- Guidance link
- https://www.cyber.gov.lv/lv/nozares-politika/nacionalas-kiberdrosibas-likums-0
- Guidance body
- Nacionālais kiberdrošības centrs (National Cybersecurity Centre), Ministry of Defence of the Republic of Latvia
- Open questions
- Does Cabinet Regulation No. 397 of , which sets the Article 26 minimum cybersecurity requirements, narrow the Article 27 measures duty specifically as it reaches an online marketplace, online search engine or social media platform provider?
What this law does
Article 27 requires a subject (an essential service provider under Article 20, an important service provider under Article 21, or an owner or lawful possessor of ICT critical infrastructure) to take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems it uses, and to prevent or minimise the impact of a cyber incident on its service recipients and on other services.
Article 21(1)(2)(l)-(n) names an online marketplace, an online search engine and a social media platform provider expressly among the medium-or-large digital providers this duty reaches as important entities.
Article 28 additionally requires the subject to draft a cyber-risk-management and ICT-business-continuity plan and to train staff on it, with the plan's required content set by the Cabinet under Article 28(2) and the minimum cybersecurity requirements the subject's systems must meet set by Cabinet Regulation No. 397 of ; Article 25 requires the subject's head to appoint a cybersecurity manager (kiberdrošības pārvaldnieks) within three months of the subject's status notification or of the National Cybersecurity Centre's decision on its status under Article 22(5), and Article 26.1, inserted by the law of , bars a person convicted of a listed intentional crime from holding privileged access to the subject's ICT systems unless rehabilitated or cleared, and requires the subject to decide individually on employing such a person.
Article 3(3) applies the Law to a financial entity covered by Regulation (EU) 2022/2554 (DORA) that is an essential service provider only insofar as that Regulation or other law sets no other requirements on cybersecurity, risk management, incident reporting and supervision. Article 3(4) disapplies the Law's requirements, including supervision, for a subject covered by an equivalent sector-specific EU regime, to the extent that regime's requirements are at least equivalent in effect.
The law of amending the National Cybersecurity Law was adopted by the Saeima on , promulgated on and took effect the day after promulgation, . Transitional provision 15 sets as the day its amendment of Article 20(11), which adds a company, foundation or association significant to national security, takes effect.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .