LatviaNacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation
Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider among the medium-or-large digital providers it reaches expressly, for the reason given on this jurisdiction's companion risk-management row; the reporting duty in Article 39 itself binds any person who discovers the vulnerability, not only a covered subject.
- Once the competent cyber incident prevention institution relays a substantiated report that a vulnerability exists in a system or network you operate, remediate it within the deadline the institution sets, no later than 90 days from when you received the information.NIST CSF 2.0ID.RA-08
- Report your remediation progress to the institution as you go, and, if you cannot remediate within 90 days for objective reasons, request an extension, which the institution may grant up to a total of 180 days from the report's submission.NIST CSF 2.0ID.RA-08
- Where you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential.NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text. Also read by: Nacionālais kiberdrošības centrs (National Cybersecurity Centre), Ministry of Defence of the Republic of Latvia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act creates no criminal offence for a missed Article 40 remediation deadline; Article 45 gives the competent authority non-monetary corrective powers (a warning, a corrective order, or, on continued non-compliance, suspension of the affected system, resource, product or service) generally, but Article 46(5)'s closed list of fine-triggering material non-compliance does not itself name a missed Article 40 deadline.
Who enforces it
Enforcement body
Nacionālais kiberdrošības centrs (National Cybersecurity Centre, NKDC, operating within the Ministry of Defence), as the Article 41(1) competent supervisory authority for an essential or important service provider other than information and communication technology (ICT) critical infrastructure; Satversmes aizsardzības birojs (Constitution Protection Bureau, SAB) for an owner or lawful possessor of ICT critical infrastructure under Article 41(2).
Settledness
- As of
- Guidance link
- https://www.cyber.gov.lv/lv/nozares-politika/nacionalas-kiberdrosibas-likums-0
- Guidance body
- Nacionālais kiberdrošības centrs (National Cybersecurity Centre), Ministry of Defence of the Republic of Latvia
- Open questions
- Does Article 46(5)'s closed list of material non-compliance, which does not name a missed Article 40 vulnerability-remediation deadline, mean a subject who misses that deadline faces only the non-monetary corrective and suspension powers of Article 45 rather than the Article 46 fine?
What this law does
Article 39 requires any person who discovers a vulnerability in a subject's information system or electronic communications network to report it to the competent cyber incident prevention institution within five working days, and lets that person report anonymously and have their identity kept confidential.
Once the institution has assessed a report as substantiated and relayed it, Article 40 requires the affected subject to take the actions necessary to remediate the vulnerability within the institution's own deadline, capped at 90 days from receiving the information and extendable to 180 days on the subject's request for objective reasons, reporting progress to the institution as it goes. This is a subject-facing remediation clock rather than only a state-run coordination function.
Article 46(5), however, defines a fine-triggering 'material non-compliance' with a closed three-item list (failing to take appropriate measures, repeatedly refusing supervisory information requests, and a late or false significant-incident notification) that does not name a missed Article 40 deadline, so whether that specific failure draws the Article 46 fine, rather than only the non-monetary corrective and suspension powers Article 45 gives generally, is not settled by the text and is recorded as an open question here rather than as a penalty figure.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .