The EU NIS2 directive (2022/2555) has been transposed into Lithuanian law by the updated Law on Cybersecurity. The requirements apply not only to large corporations: the list includes medium-sized and even small companies operating in energy, transport, health, digital infrastructure, manufacturing, food and other sectors, as well as their suppliers.
What changes
- Management is personally responsible for approving and overseeing cybersecurity measures.
- Significant incidents must be reported to the National Cyber Security Centre within 24 hours (early warning) and within 72 hours (full notification).
- A mandatory risk management framework: access control, backups, supply chain security, multi-factor authentication, staff training.
- Fines of up to EUR 10 million or 2 % of annual turnover for essential entities.
Where to start
The first step is an inventory: which devices, systems and data the company has and who is responsible for them. The second is the basic technical measures that NIS2 requires directly: centrally managed endpoint protection (EDR), vulnerability management, email protection and backups. The third is a documented incident management procedure and staff training.
The Kaspersky Next, WithSecure Elements and ImmuniWeb tools we distribute cover the technical part of NIS2. If you need help choosing – write to usand we will help draw up a plan according to the size of your company.