NIS2 in Lithuania: what companies and their managers must do

Since 18 October 2024, Lithuania has applied an updated Cybersecurity Law transposing the EU NIS2 Directive. It significantly expanded the range of organisations subject to mandatory cybersecurity requirements. If you thought this only concerned banks or energy companies, it is worth checking again.

Who does the law apply to?

Entities are divided into two groups:

• Essential entities – energy, transport, banking, healthcare, water supply, digital infrastructure, ICT service management, public administration. Usually large companies (250+ employees or turnover above EUR 50 million).
• Important entities – postal services, waste management, chemical and food production, other manufacturing, digital service providers. Usually medium-sized companies (50+ employees or turnover above EUR 10 million).

The National Cyber Security Centre (NKSC) identifies entities and adds them to a register, which is updated at least once a year. Important: even if your company is not on the register, the requirements may be “passed on” to you by clients for whom you are an IT or other service provider.

Key obligations

• Appoint a person responsible for cybersecurity (CISO) and clearly assign responsibilities.
• Carry out a risk assessment and approve security policies.
• Have incident management and business continuity plans.
• Manage supplier (supply chain) risk.
• Train employees and managers regularly.
• Regularly carry out a cybersecurity audit.

A transition period applies: organisational requirements within 12 months and technical requirements within 24 months of being added to the register.

Incidents and deadlines

NIS2 sets baseline deadlines for reporting significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month. National legislation may set additional requirements, so it is worth aligning your incident management procedure with the latest NKSC guidance.

Fines and management liability

Essential entities face fines of up to EUR 10 million or 2% of global annual turnover, important entities up to EUR 7 million or 1.4%. Even more importantly, responsibility lies with management: it approves the measures, oversees their implementation and must itself understand cybersecurity risks.

Where to start?

1. Check your status – whether you are on the register or the requirements will apply through your clients.
2. Carry out a gap analysis – what already works and what is missing.
3. Draw up a plan with priorities, owners and deadlines.
4. Appoint a CISO – internal or external (CISO as a service).
5. Prepare for incidents – who reports to NKSC, when and how.

AuraGroup helps companies assess NIS2 compliance, prepare documentation and take over the CISO function. For a quick starting point – a free 7-minute IT risk self-assessment. More about our cybersecurity services or contact us – the first consultation is free.