Invosec
The CoverContact UsOur Insights
Explore
NIS2

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure
Policies

Network and Information Systems Cybersecurity Policy

The core internal document that sets cybersecurity objectives, the applicable legislation, the list of other security documents and the responsible persons.

KSI

KSĮ Art. 3(1)–(2)KSĮ Art. 14(1)–(3), (5)–(6), (8)KSĮ Art. 15(1)–(5)KSĮ Art. 16(4)

The Law on Cybersecurity (KSĮ) sets the duties of the entity and its head, which the policy turns into internal rules.

Under KSĮ, the policy reflects:
  • ● the cybersecurity principles (KSĮ Art. 3(1)–(2));
  • ● the duty to apply risk management measures within the set deadline and report on their implementation to the NKSC (KSĮ Art. 14(1)–(3), (5));
  • ● the duty of the head of the entity, or a person they authorise, to ensure and oversee compliance with KSĮ duties (KSĮ Art. 14(6));
  • ● a cybersecurity audit at least every 3 years (KSĮ Art. 14(8));
  • ● appointment of responsible persons (KSĮ Art. 15(1)–(5));
  • ● for essential entities — conditions for the NKSC technical measures (KSĮ Art. 16(4)).

KSRA

KSRA Chapter I (1–3)KSRA Chapter II, Section One (4–6)KSRA Chapter II, Section Three (16–21)

The policy is the foundation of the cybersecurity document set: it sets the objectives and names the documents that detail the remaining requirements. Point 3 of the Cybersecurity Requirements Description (KSRA, Lithuania's NIS2 implementing rules) allows the requirements to be set out in one or several documents, so this document set is a practical breakdown by KSRA section, not a mandatory list.

Under KSRA, the policy sets out:
  • ● cybersecurity objectives, the applicable legislation and the list of other security documents — procedures and plans (KSRA points 4.1–4.3);
  • ● obligations for employees and third parties (KSRA point 4.4);
  • ● review at least once a year and whenever circumstances change, and submission of approval details to the NKSC (the National Cyber Security Centre) via KSIS (the national cybersecurity information system) within 5 working days (KSRA points 4.5, 5);
  • ● responsible persons — appointment, qualifications and duties of the cybersecurity manager and the security officer, which cannot be combined with system administration; appointment and duties of the administrator; informing the NKSC and employees (KSRA points 16–21).