The European Union’s NIS2 Directive (EU) 2022/2555 has been transposed into Lithuanian law through amendments to the Law on Cybersecurity. Its requirements do not automatically apply to every business: they apply to entities in the sectors and categories specified by law, generally medium-sized and large organisations in energy, transport, healthcare, digital infrastructure, ICT services, certain manufacturing activities, food production and other covered sectors; in certain circumstances, smaller entities may also be covered. Suppliers may be affected indirectly through supply-chain security requirements and contractual obligations.
What changes
- Management is personally responsible for approving and overseeing cybersecurity measures.
- Significant incidents must generally be reported to the National Cyber Security Centre: an early warning within 24 hours and an incident notification within 72 hours of becoming aware of the incident, followed by a final report within one month.
- Mandatory risk management system: access control, backups, supply chain security, multi-factor authentication, staff training.
- Essential entities face fines of up to EUR 10 million or 2% of annual turnover.
Where to start
The first step is an inventory: which devices, systems and data the company has and who is responsible for them. The second is the basic technical measures that NIS2 requires directly: centrally managed endpoint protection (EDR), vulnerability management, email protection and backups. The third is a documented incident management procedure and staff training.
The Kaspersky Next, WithSecure Elements and ImmuniWeb tools we distribute cover the technical part of NIS2. If you need help choosing – write to us, and we will help you draw up a plan that suits the size of your company.