NIS2 Documents

Provisions and Requirements

Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management Plan Requirements for Reporting the Results of Business Continuity Management Plan Testing Backup Recovery Parameter Requirements Network and Information Systems Data Loss Time (RPO) Requirements Backup Requirements Human Resources Security Requirements Non-Disclosure Requirements Physical Access Requirements for Network and Information Systems Provisions on Multi-Factor Authentication Solutions Administrator Access Requirements Password Creation and Change Requirements Network and Information Systems Acquisition and Deployment Requirements Provisions on Updating Permitted Software Provisions on the Use of Security Systems Security System Update Requirements Provisions on the Use of Network Filtering Equipment Provisions on the Secure Use of Email Information Classification and Handling Requirements Provisions on the Use of Cryptography and Encryption Risk Assessment Frequency Requirements Requirements for Log Management and Retention, Intrusion Detection and Prevention

Plans

Cyber Incident Management Plan Risk Management Plan Plan for Remediating Non-Conformities Found in the Compliance Assessment Network and Information Systems Business Continuity (Recovery) Management Plan Vulnerability Identification Plan Effectiveness Monitoring Plan

Policies

Network and Information Systems Cybersecurity Policy Human Resources Security and Physical Access Policy

Registers and Forms

Cyber Incident Notification Form Interim Situation Update Report Form Risk Assessment Report Form Cybersecurity Training Report Form Compliance Assessment Report Form List of Permitted Software Cyber Incident (Minor and Significant) Information Form Cyber Incident Investigation Report Form List of Suppliers List of Persons with Administrator Rights Business Continuity Management Plan Test Report Form for Network and Information Systems List of Premises Requiring Protection Network and Information Systems Asset Inventory Cyber Incident Management Plan Test Report Form Vulnerability Detection Report Form Hardware Fault Register Service Provider Risk Assessment Form

Diagrams and Processes

Network and Information Systems Diagram Network and Information Systems Infrastructure Logical Diagram Risk Assessment and Management Process Typical Cyber Incident Management Process

Procedures

Network and Information Systems Risk Assessment and Management Procedure Cryptography and Encryption Use Procedure Cyber Hygiene Practice and Cybersecurity Training Organisation and Delivery Procedure Cybersecurity Requirements Effectiveness Evaluation Procedure Network and Information Systems Acquisition, Development and Maintenance Security Procedure Supply Chain Security Procedure Access Management and Multi-Factor Authentication Measures Asset Management Procedure Patch and Vulnerability Management Procedure Network and Information Systems Change Management Procedure Log Management Procedure

Registers and Forms

Cyber Incident Notification Form

An internal template (not an NKSC form), used under the cyber incident management plan, for collecting incident data before an early warning or notification to the NKSC (National Cyber Security Centre).

KSI

KSĮ Art. 18(2)KSĮ Art. 18(4)(1)–(2)

The Law on Cybersecurity (KSĮ) sets out which reports on a significant incident the entity submits to the NKSC; the form collects the data for the first two of them.

Under KSĮ, the form records:

● an early warning within 24 hours at the latest (KSĮ Art. 18(4)(1));
● a notification of a significant incident within 72 hours at the latest (KSĮ Art. 18(4)(2)).

NKIVP

NKIVP points 9, 13.1, 14

The National Cyber Incident Management Plan (NKIVP) sets when an incident is considered significant, as well as the content of notifications (point 14) and the deadlines for minor incidents (point 13).

An incident is significant if it meets at least one of the following groups (KSĮ Art. 18(2); NKIVP point 9; applied where European Commission implementing acts do not define the criteria in more detail):

● a major service disruption plus at least one of: services disrupted across Lithuania and/or in at least one EU or NATO country (9.1.1); operation of network and information systems disrupted for ≥ 2 hours (9.1.2); ≥ 1,000 or 25% of service recipients or computerised workstations affected (9.1.3), or their personal or other protected data affected (9.1.4) — whichever is lower; the entity can no longer meet the legal requirements set for its activity (9.1.5); trade secrets or classified information lost or disclosed (9.1.6); more than one similar incident with the same root cause within 6 months, with losses reaching the point 9.2 values (9.1.7) (NKIVP point 9.1);
● financial losses of ≥ EUR 500,000 or 5% of the previous financial year's turnover — whichever is lower (NKIVP point 9.2);
● the incident affected or may affect other persons by causing significant damage: pecuniary damage of ≥ 400 basic social benefit amounts (9.3.1); non-pecuniary damage of ≥ EUR 10,000 (9.3.2); the health of at least one person impaired or at least one person killed (9.3.3) (NKIVP point 9.3).

Under NKIVP, the form also records:

● a notification of a minor incident within 72 hours at the latest (NKIVP point 13.1);
● the content of the notification (NKIVP point 14).

Notifications are submitted to the NKSC via KSIS, the national cybersecurity information system (NKIVP point 10).