Latvia NIS2 (National Cybersecurity Law): cybersecurity self-assessment report to NKDC
24 days ago (Confirmed)
Date note: Corrected: the cybersecurity-manager notification and the FIRST self-assessment report were both due 2025-10-01 (confirmed on cyber.gov.lv). Recurrence is NOT uniformly annual: under MK noteikumi Nr. 397 'Minimālās kiberdrošības prasības' (in force 2025-07-02, published Latvijas Vēstnesis 2025/123.1, point 8.3), only ICT critical-infrastructure owners/operators must resubmit the self-assessment report at least once a year (next due ~2026-10-01); other essential/important entities ('svarīgie pakalpojumu sniedzēji') must resubmit at least once every 3 years (next due ~2028). The exact per-subject deadline and form are set by Cabinet regulation, not the law itself (Nacionālās kiberdrošības likums, 43. pants).
We email you if this date moves, is postponed, or its status changes — nothing else. Free, and independent of your company profile.
One rule, one address. Unsubscribe with one click from any email.
What changes
Latvia transposed NIS2 through the Nacionālās kiberdrošības likums. Essential and important service providers had to register, appoint a cybersecurity manager and submit a first self-assessment by 1 October 2025; ICT critical-infrastructure owners must repeat the self-assessment annually, while other in-scope entities must repeat it at least once every 3 years. All in-scope entities must maintain minimum security measures and report significant incidents to CERT.LV.
Who is affected
Medium and large companies registered in Latvia in NIS2 sectors (energy, transport, banking, health, water, digital infrastructure, ICT services, manufacturing of critical goods, food, chemicals, postal, waste, research), plus smaller firms designated as ICT critical infrastructure or sole provider of a service.
Sizes: medium, large · Sectors: Energy, Transport / logistics, Finance / insurance, Health, Software / SaaS, Manufacturing, Agriculture / food, Professional services · Applies if: We operate in a critical sector (NIS2); We rely on cloud services
What to do
Confirm your registration status (essential/important entity) with the National Cybersecurity Centre (NKDC). If you own/operate designated ICT critical infrastructure, resubmit the self-assessment annually by 1 October; other in-scope entities must resubmit at least once every 3 years per MK noteikumi Nr. 397 — check your specific deadline with NKDC rather than assuming an annual cycle. Maintain minimum security measures (access control, backups, incident response, supplier security) and keep 24h/72h CERT.LV incident-reporting procedures current.
Penalty
Essential entities up to €10M or 2% of turnover; important entities up to €7M or 1.4% (NIS2 levels)
The Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (transposing NIS2) was passed by the Riigikogu on 10 December 2025, proclaimed by the President on 18 December 2025, published in Riigi Teataja on 30 December 2025, and entered into force on 1 January 2026, expanding scope from roughly 3,000 to about 6,500 regulated entities.
Medium and large Estonian companies in NIS2 sectors (energy, transport, banking, health, water, digital infrastructure and ICT services, manufacturing of critical goods, food, chemicals, postal, waste, research), plus certain smaller providers designated by RIA.
Entities that already met the essential/important-entity criteria when the amended Küberturvalisuse seadus took effect on 2026-01-01 had to submit registration data (name, registry code, address, contacts, IP ranges, sector) to RIA within 3 months, i.e. by 2026-03-31 (RIA's own notice flagged issues with its automated notification tooling around that date). Entities that become in-scope later must still self-register with RIA within 3 months of first meeting the criteria — an ongoing rule, not a one-off deadline.
Medium and large companies in NIS2 sectors that are or become in scope of Estonia's Cybersecurity Act, plus smaller entities RIA designates as critical or as sole providers of a service.
Re-verified 2026-09-09: nksc.lt and kam.lt subpages still hang/block under browser automation (Cloudflare-style challenge), but a Google-cached snippet of the Ministry of National Defence's own kam.lt DUK guidance confirms: "Kibernetinio saugumo subjektas nuo patekimo į Kibernetinio saugumo subjektų registrą momento kibernetinio saugumo reikalavimus turi įgyvendinti per 12 mėn., o [techniniams reikalavimams] – 24 mėn." — i.e. the 12/24-month clocks run from each entity's own registration into the Kibernetinio saugumo subjektų registras, not from the law's 2024-10-18 effective date. Corroborated by independent secondary sources (PwC Lietuva, ECOVIS ProventusLaw) citing the same figures. The date shown above is an illustrative placeholder only — confirm your own entity's registration date and deadline directly with NKSC.
Medium and large entities (plus some smaller entities NKSC designates as critical or as a sole service provider) in NIS2 sectors: energy, transport, banking/finance, health, digital infrastructure/software, manufacturing, agri-food, public administration and more.