Invosec
The CoverContact UsOur Insights
Explore
NIS2

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure
Plans

Cyber Incident Management Plan

Sets out how the organisation detects, assesses and manages cyber incidents, and how and how quickly it reports them to the NKSC.

KSRA

KSRA Chapter II, Section Four (22–24)

The Cybersecurity Requirements Description (KSRA, Lithuania's NIS2 implementing rules) requires an incident management plan describing how the organisation detects, assesses and manages cyber incidents, and requires the plan to comply with the National Cyber Incident Management Plan (NKIVP).

Under KSRA, the plan sets out:
  • ● compliance of the plan with the NKIVP (KSRA point 22);
  • ● the role of service providers where a supplier manages incidents or provides a security operations centre (SOC) service (KSRA point 23);
  • ● how incidents are detected and assessed, including the criteria for a significant incident (KSRA points 24.1–24.2);
  • ● organisation of incident management and the responsibilities of the staff in charge (KSRA points 24.3, 24.5);
  • ● communication with stakeholders (KSRA point 24.4);
  • ● collection and preservation of evidence, and lessons learned (KSRA points 24.6–24.7);
  • ● testing of the plan and test reports (KSRA point 24.8).

Logging requirements (KSRA point 25 and Table 1) are covered in the log management procedure.

KSI

KSĮ Art. 14(5)(3)KSĮ Art. 18(1)–(5)

The Law on Cybersecurity (KSĮ) names incident management as one of the elements of the cybersecurity requirements (KSĮ Art. 14(5)(3)) and sets the deadlines for reporting significant incidents to the NKSC (the National Cyber Security Centre).

Under KSĮ, the plan reflects:
  • ● an early warning within 24 hours and an incident notification within 72 hours (KSĮ Art. 18(4)(1)–(2));
  • ● an intermediate report at the request of the NKSC, by the deadline the NKSC sets (KSĮ Art. 18(4)(3));
  • ● a final report within 1 month of submitting the incident notification (KSĮ Art. 18(4)(4));
  • ● content of the final report — a description of the incident with its severity and impact, the threat or root cause, the mitigation measures, and any cross-border impact (KSĮ Art. 18(4)(4)(a)–(d));
  • ● a progress report if the incident is still ongoing when the final report is due (KSĮ Art. 18(4)(5)).

The Lithuanian text of the law links the final report deadline to the early warning (KSĮ Art. 18(4)(1)), so the safest approach is to count from it.

NKIVP

NKIVP points 3–5, 9–18

The NKIVP is the National Cyber Incident Management Plan, approved by the same Government Resolution No. 818 as KSRA (as worded by Resolution No. 945 of 6 November 2024), as a separate annex. The organisation's plan must comply with it (KSRA point 22), and NKIVP point 4 goes further than the KSRA point 24 list: the plan must contain the incident management process set out in the diagram in Annex 1 and the description in Annex 2 to the NKIVP.

Under the NKIVP, the plan sets out:
  • ● the organisation itself organises incident management — it appoints the persons who perform the functions under KSRA points 24–25 (SOC); SOC functions cannot be assigned to an employee responsible for the operation of the same network and information systems (NKIVP point 3);
  • ● the participants, stages, actions, deadlines and outputs set out in the Annex 1 diagram and the Annex 2 description (NKIVP point 4);
  • ● an incident is considered contained once the services provided by the network and information systems are restored (NKIVP point 5);
  • ● reports to the NKSC via KSIS, the national cybersecurity information system — for a significant incident by the deadlines set in KSĮ, for a non-significant one a notification within 72 hours and a final report within 1 month (NKIVP points 10–13, 15–16);
  • ● the content of the notification and the classification of cyber threats (NKIVP points 14, 18).
An incident is significant if it meets at least one of these groups (KSĮ Art. 18(2); NKIVP point 9); the criteria apply where European Commission implementing acts do not define them in more detail:
  • ● 9.1 — major service disruptions with at least one condition: services disrupted across Lithuania and/or in at least one EU or NATO country; operation of network and information systems disrupted for 2 hours or more; at least 1,000 or 25% (whichever is lower) of service recipients or computerised workstations, or of service recipients' personal or other protected data, affected; the organisation can no longer meet the requirements set for its activities by law; trade secrets or classified information lost or disclosed; more than one similar incident with the same root cause within 6 months, with losses reaching the point 9.2 values (NKIVP points 9.1.1–9.1.7);
  • ● 9.2 — financial losses of at least EUR 500,000 or 5% of the previous financial year's turnover, whichever is lower (NKIVP point 9.2);
  • ● 9.3 — the incident has affected or may affect other persons by causing serious damage, with at least one condition: pecuniary damage of at least 400 basic social benefits; non-pecuniary damage of at least EUR 10,000; the health of at least one person harmed or at least one person died (NKIVP points 9.3.1–9.3.3).

The plan's forms — notification, intermediate report, investigation report — are internal templates for collecting data, not NKSC forms: reports are submitted via KSIS (NKIVP point 10).