Invosec
The CoverContact UsOur Insights
Explore
NIS2

Kibernetinio saugumo reikalavimų aprašas (KSRA)

KSRA Implementing the Cybersecurity Requirements
Title-not-shown
Chapter I (1-3) General Provisions
General requirements (1-3)
Chapter II Section One (4-6) Network and Information Systems Security Policy
Org. requirements (4-6)
Chapter II Section Two (7-15) Cybersecurity Risk Analysis
Org. requirements (7-15)
Chapter II Section Three (16-21) Duties of the Persons Responsible for Cybersecurity and of the Head of the Cybersecurity Entity or a Person Authorised by Them
Org. requirements (16-21)
Chapter II Section Four (22-26) Cyber Incident Management
Org. requirements (22-26)Tech. requirements (Table 1, 1-15)
Chapter II Section Five (27-31) Business Continuity
Org. requirements (27-31)Tech. requirements (Table 2, 16-20)
Chapter II Section Six (32-39) Supply Chain Security
Org. requirements (32-39)
Chapter II Section Seven (40-47) Security of the Acquisition, Development and Maintenance of Network and Information Systems, Including Vulnerability Management and Disclosure
Org. requirements (40-47)Tech. requirements (Table 3, 21-43)
Chapter II Section Eight (48-51) Assessing the Effectiveness of Cybersecurity Requirements
Org. requirements (48-51)
Chapter II Section Nine (52-54) Cyber Hygiene Practice and Cybersecurity Training
Org. requirements (52-54)
Chapter II Section Ten (55-57) Cryptography and Encryption Usage Policy and Procedures
Org. requirements (55-57)Tech. requirements (Table 4, 44-50)
Chapter II Section Eleven (58-60) Human Resources Security, Physical Access Policy and Asset Management
Org. requirements (58-60)Tech. requirements (Table 5, 51-52)Org. requirements (61-64)Tech. requirements (Table 6, 53-57)
Chapter II Section Twelve (65-69) Access Management and Multi-Factor Authentication Measures
Org. requirements (65-69)Tech. requirements (Table 7, 58-76)
Chapter III (70-72) Final Provisions
General requirements (70-72)

Kibernetinio saugumo reikalavimų aprašas (KSRA)

KSRA Implementing the Cybersecurity Requirements
Title-not-shown
Chapter I (1-3) General Provisions
General requirements (1-3)
Chapter II Section One (4-6) Network and Information Systems Security Policy
Org. requirements (4-6)
Chapter II Section Two (7-15) Cybersecurity Risk Analysis
Org. requirements (7-15)
Chapter II Section Three (16-21) Duties of the Persons Responsible for Cybersecurity and of the Head of the Cybersecurity Entity or a Person Authorised by Them
Org. requirements (16-21)
Chapter II Section Four (22-26) Cyber Incident Management
Org. requirements (22-26)Tech. requirements (Table 1, 1-15)
Chapter II Section Five (27-31) Business Continuity
Org. requirements (27-31)Tech. requirements (Table 2, 16-20)
Chapter II Section Six (32-39) Supply Chain Security
Org. requirements (32-39)
Chapter II Section Seven (40-47) Security of the Acquisition, Development and Maintenance of Network and Information Systems, Including Vulnerability Management and Disclosure
Org. requirements (40-47)Tech. requirements (Table 3, 21-43)
Chapter II Section Eight (48-51) Assessing the Effectiveness of Cybersecurity Requirements
Org. requirements (48-51)
Chapter II Section Nine (52-54) Cyber Hygiene Practice and Cybersecurity Training
Org. requirements (52-54)
Chapter II Section Ten (55-57) Cryptography and Encryption Usage Policy and Procedures
Org. requirements (55-57)Tech. requirements (Table 4, 44-50)
Chapter II Section Eleven (58-60) Human Resources Security, Physical Access Policy and Asset Management
Org. requirements (58-60)Tech. requirements (Table 5, 51-52)Org. requirements (61-64)Tech. requirements (Table 6, 53-57)
Chapter II Section Twelve (65-69) Access Management and Multi-Factor Authentication Measures
Org. requirements (65-69)Tech. requirements (Table 7, 58-76)
Chapter III (70-72) Final Provisions
General requirements (70-72)
KSRA

Implementing the Cybersecurity Requirements

On 6 November 2024, the Lithuanian Government approved the documents setting out how the new Cybersecurity Law (KSĮ), which entered into force in October 2024 and transposed the main provisions of the European Union Network and Information Security (NIS2) Directive into national law, will be implemented.

Key KSĮ implementation dates

By 17 April 2025, cybersecurity entities will be entered into the register. By this date, the NCSC will gradually notify all entities included in the register.

By 17 April 2026, cybersecurity entities must comply with the organisational KSRA requirements.

By 17 April 2027, cybersecurity entities must comply with the technical KSRA requirements and implement the organisational and technical requirements for critical information infrastructure (YSII) and state information resources (VII).

Thereafter, cybersecurity entities must carry out a self-audit every 3 years.

About this tool

This is an interactive tool for browsing the Description of the Requirements for Implementing the Cybersecurity Law (KSRA), as published on e-seimas.lrs.lt, Resolution No. 818 of the Government of the Republic of Lithuania “On the Implementation of the Cybersecurity Law of the Republic of Lithuania”, as amended by Resolution No. 945 of 6 November 2024. The tool was built to help Lithuanian cybersecurity professionals work through the NIS2 Directive as applied in Lithuania.

The text in this tool is provided as is and should not be relied on by itself. This English version is an unofficial translation prepared by Invosec for convenience only; it has no legal force, and in case of any discrepancy the Lithuanian original prevails. We therefore encourage you to consult the Cybersecurity Law in its official publication and the Description of the Requirements for Implementing the Cybersecurity Law (KSRA) in its official publication.

To receive notifications about new features, follow us on LinkedIn, and if you have questions or suggestions, feel free to contact us at [email protected]
Next General Provisions