NIS2 obligations in Latvia

Competent authority & CSIRT Legal ref: Art. 4, 9

• National Cyber Security Centre. ecs-org.eu · 28 Oct 2026 · secondary source
• Cyber Incident Response Institutions. ecs-org.eu · 28 Oct 2026 · secondary source
• Cyber Incident Response Institutions: Military Intelligence and Security Service, Institute of Mathematics and Computer Science of the University of Latvia and Institute of Mathematics and Computer Science of the University of Latvia , Constitution Protection Bureau. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 3, 20, 21

• NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Besides essential and important entities, the law applies to holders of critical infrastructure of information technologies. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 22

• After conducting self-assessment, entities have to notify the National Cyber Security Centre. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities are required to submit the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name and details of the organisation/natural person (legal status, form of economic activity, registration number). ecs-org.eu · 28 Oct 2026 · secondary source
• Field of activity. ecs-org.eu · 28 Oct 2026 · secondary source
• Legal address. ecs-org.eu · 28 Oct 2026 · secondary source
• List of essential and important services provided. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details of the entity/legal holder. ecs-org.eu · 28 Oct 2026 · secondary source
• List of the countries where the entity/natural person provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 34

• Significant incidents shall be reported, without delay, to the competent Cyber Incidents Response Instiution ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Initial incident report within 72 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Inform the recipients of their services (immediately). ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the competent Cyber Incidents Response Institution (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 46

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (legal holders of ICT critical infrastructure). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 45

• Reference to EU standards under the NIS2 Directive. ecs-org.eu · 28 Oct 2026 · secondary source
• Latvia has adopted a light approach to risk analysis. It must be embedded into Business Continuity Planning and must focus on ICT systems and the supply chain. There is a requirement to review and update the risk analysis every one to two years (for essential entities) or every three years (for important entities). There are no explicit audit requirements. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text · Regulation No. 397 on Minimum cybersecurity requirements; Entered into force on 02/07/2025

What changed recently

1. 1 Sep 2024
   National NIS2 law enters into force (per tracker) ecs-org.eu needs verification