NIS2 obligations in Armenia

Competent authority & CSIRT Legal ref: Art. 5-7,13

• Legally prescribed powers in the field of cybersecurity are exercised by the Authorized Body, the Self-Governing Body, and the authorized body coordinating the implementation of information security activities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 16

• Sectors of vital significance: ecs-org.eu · 28 Oct 2026 · secondary source
• Energy. ecs-org.eu · 28 Oct 2026 · secondary source
• Manufacturing (chemical, food, weapons and ammunition, medical, electrical, computer, electronic, and optical devices). ecs-org.eu · 28 Oct 2026 · secondary source
• Transport sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Water supply and wastewater disposal sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Communications, including telecommunications. ecs-org.eu · 28 Oct 2026 · secondary source
• Postal communication. ecs-org.eu · 28 Oct 2026 · secondary source
• Financial services. ecs-org.eu · 28 Oct 2026 · secondary source
• Healthcare. ecs-org.eu · 28 Oct 2026 · secondary source
• Information technology sector, including digital infrastructure. ecs-org.eu · 28 Oct 2026 · secondary source
• Radioactive, subsoil use and hazardous waste management. ecs-org.eu · 28 Oct 2026 · secondary source
• Space activities ecs-org.eu · 28 Oct 2026 · secondary source
• Management and use of databases. ecs-org.eu · 28 Oct 2026 · secondary source
• Emergency security ecs-org.eu · 28 Oct 2026 · secondary source
• The field of safety in emergency situations. ecs-org.eu · 28 Oct 2026 · secondary source
• The sphere of government, including digital infrastructure used by government agencies. ecs-org.eu · 28 Oct 2026 · secondary source

Registration

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 11,

• The service provider must notify the Autonomous Body of the cyber incident immediately, but not later than 24 hours after the cyber incident becomes known. Within 72 hours of becoming aware of the incident, it must submit update information about it to the Autonomus Body. Within a month, the service provider submits a final report to the Autonomous Body. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art 23

• If a service provider or a cybersecurity service provider fails to meet the legal requirements of the Self-Governing Body, the Self-Governing Body: ecs-org.eu · 28 Oct 2026 · secondary source
• Appeals to the superior body or appropriate official of a service provider or a cybersecurity service provider to initiate a disciplinary action against a person who fails to perform his or her duties. ecs-org.eu · 28 Oct 2026 · secondary source
• Appeals to the regulatory and other supervisory body of the service provider for appropriate action and for the use of responsibility for the service provider. ecs-org.eu · 28 Oct 2026 · secondary source
• Initiate the process of conducting a compliance assessment in accordance with the law. ecs-org.eu · 28 Oct 2026 · secondary source
• Wholly or partially restricts the use of a government information system or data exchange layer until the legal requirements of the Autonomous Body are met if there are substantial doubts that failure to implement the restriction may interfere with the safe and uninterrupted work of the state information system. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 6, 19

• International and national standards ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Law

What changed recently

No dated changes recorded.