Cybersecurity law in Lithuania: NIS2 compliance (2026)

Lithuania's National Cybersecurity Centre completed the first round of entity identification under the new Cybersecurity Act and formally notified essential and important entities of their register status. From the notification date, entities have 12 months to appoint cybersecurity officers and 24 months to implement required technical measures; the regulated population is expected to grow to 8,000-10,000 entities once identification is complete.

Lithuania's NCSC annual cybersecurity status report recorded 3,874 incidents in 2024, up 63% from 2,378 in 2023; three were classified as major incidents attributed to foreign state-sponsored groups conducting espionage. Social engineering accounted for 59% of all incidents, up from 38% the prior year, indicating a shift in attack vectors against Lithuanian organisations.

The Lithuanian Government's secondary legislation specifying detailed technical and organisational requirements for entities covered by the new Cybersecurity Act took effect, completing the NIS2 implementation package. It mandates risk assessments, supply chain security, business continuity plans, and incident-handling procedures calibrated to entity classification.

Russia-linked hacktivist group Killnet targeted Lithuanian government, transport, energy, and financial sector websites with sustained DDoS attacks in direct retaliation for Vilnius blocking EU-sanctioned goods transit to the Russian exclave of Kaliningrad. The incident highlighted Lithuania's acute geopolitical cyber exposure and accelerated domestic investment in DDoS resilience and incident-response capacity.

Lithuania's parliament approved an updated National Security Strategy that formally elevated cyber resilience to a core pillar alongside conventional defence and NATO interoperability, guiding budget allocations and legislative reforms, including the subsequent NIS2 transposition drive, through the mid-2020s.

The Lithuanian Government adopted the National Cyber Security Strategy by Resolution No. 818, establishing strategic objectives on critical information infrastructure protection, adoption of ISO 27001-based security standards, public-private partnership, cyber exercises, R&D, and international cooperation aligned with EU and NATO frameworks.

Amendments adopted by the Seimas on 19 December 2017 entered into force, transposing EU NIS1 Directive 2016/1148 into Lithuanian law. Incident investigation and electronic-network security functions were transferred from the Communications Regulatory Authority to NKSC, consolidating the entire cybersecurity supervisory apparatus under the Ministry of National Defence.

Lithuania's government banned Kaspersky Lab antivirus products on computers managing critical energy, finance, and transport systems in both public and private sectors, citing national security risk from the Russian-linked vendor. The decision, the first of its kind globally, preceded similar bans by the US FCC and EU institutions by several years and set a precedent for supply-chain security decisions in the Baltic region.

Lithuania's parliament adopted the foundational Law on Cyber Security (No. XII-1428), which entered into force on 1 January 2015. The law established the national cybersecurity architecture, designated the authorities responsible for policy development, set mandatory security measures for state information-resource managers and critical infrastructure operators, and created the legal basis for establishing the National Cyber Security Centre (NKSC) in 2015.