NIS2 in Lithuania and the KSIS register: who it applies to and what to do

A Lithuanian company often first meets NIS2 as a letter from the National Cyber Security Centre (NKSC) saying it has been entered in the register of cybersecurity entities and must register in KSIS.

This guide explains where that letter comes from and what follows it, using only Directive (EU) 2022/2555, the Lithuanian Kibernetinio saugumo įstatymas (Cyber Security Law, No XII-1428, new wording in force from 18 October 2024, last amended from 4 July 2026) and NKSC's own pages.

We are not NKSC, we cannot register anyone, and nothing here is legal advice.

Who is covered: sectors and size

Article 2(1) of the Directive applies it to entities of a type listed in Annex I or II that are medium-sized enterprises under Recommendation 2003/361/EC or exceed its ceilings. Article 2 of the Annex to that Recommendation defines a small enterprise as fewer than 50 persons and a turnover or balance sheet total not exceeding EUR 10 million; the SME category ends at 250 persons, EUR 50 million turnover or EUR 43 million balance sheet.

So a company in a listed sector with 50 or more staff, or with both turnover and balance sheet above EUR 10 million, is in scope.

Article 2(2) adds, regardless of size, electronic communications and trust service providers, TLD registries, DNS providers, sole providers of an essential service, central or regional public administration, and entities a Member State identifies because a disruption would hit public safety or carry systemic risk.

The sectors (the law's Annex 1 and 2 list the same sectors and subsectors in Lithuanian):

Essential or important

Article 3 of the Directive makes an Annex I entity above the medium-sized ceilings an essential entity; qualified trust service providers, TLD registries, DNS providers and central public administration are essential regardless of size; every other in-scope entity is an important entity. Member States had to list both by 17 April 2025 (Article 3(3)).

Article 11 of the Lithuanian law applies this with the size categories of the Lithuanian SME Development Law:

• Essential (esminiai subjektai, Article 11(3)): Annex 1 entities above the medium-enterprise headcount or both financial ceilings; qualified trust service providers, TLD registries and DNS providers; central, regional and municipal public administration.
• Important (svarbūs subjektai, Article 11(4)): Annex 2 entities above the small-enterprise ceilings whose revenue from that activity exceeds 50 per cent of annual revenue; Annex 1 entities above small but not above medium size; hosting and domain registration providers.
• Special criteria (Article 11(5)): sole provider, systemic risk, impact on an essential entity's service. Headcount comes from SODRA data (Article 11(8)).

What Article 21 asks for

Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, weighed against risk, size and cost. Article 21(2) lists the minimum; Article 14(5) of the law mirrors it in thirteen elements:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity: backups, disaster recovery, crisis management.
4. Supply-chain security, including the relationship with each direct supplier.
5. Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess whether the measures work.
7. Basic cyber hygiene and cybersecurity training.
8. Cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi-factor or continuous authentication and secured communications, where appropriate.

Article 14(2) of the law gives at least 12 months from registration to implement the Government's requirements description; the NKSC FAQ states 12 months for the organisational and 24 months for the technical requirements (points 71 and 72). Policy documents are not uploaded to KSIS, only their approval data, within five working days.

Incident reporting: 24 hours, 72 hours, one month

Directive Article 23(4) and law Article 18(4) use one clock for a significant incident, one causing or capable of causing severe operational disruption or financial loss, or considerable damage to others: an early warning within 24 hours of becoming aware, stating where applicable whether malicious acts are suspected and whether there could be a cross-border impact; an incident notification within 72 hours with an initial assessment of severity and impact and any indicators of compromise; an intermediate report on request; and a final report within one month, with the description, root cause, mitigation and cross-border impact.

The Directive counts that month from the 72-hour notification; Article 18(4)(4) of the law refers to the report in its point 1, the 24-hour early warning, so the safe reading in Lithuania is one month from the early warning.

Smaller incidents are reported within the terms of the National Cyber Incident Management Plan (Article 18(1)(2)).

Management responsibility

Article 20 of the Directive requires management bodies to approve the measures, oversee their implementation and accept liability for infringements; their members must follow training.

The law adds dates: the head ensures compliance (Article 14(6)); management bodies and the head complete cybersecurity training at least once every two years (Article 14(7)); the entity is audited at least once every three years by independent auditors under the NKSC methodology (Article 14(8)); and the head appoints a cybersecurity manager and a security officer for each system, roles that may be bought from a supplier (Article 15).

What KSIS is and how registration works

KSIS, the Kibernetinio saugumo informacinė sistema, is described by NKSC as a secure, closed platform of tools, threat monitoring and information exchange for cybersecurity entities. Under Article 13 of the law the register is kept inside KSIS and holds the entity's identification, contact, IP, service, system and sector data listed in Article 13(3).

As NKSC's page states on 2026-10-25: an organisation without an account registers through the form behind „Tapti KSIS nariu“, and only the head of the company may fill it in; existing users log in at org.nksc.lt. After the first login, NKSC recommends entering every website, the IP ranges and the contact persons, then confirming the information.

The public register check at nksc.lt/kssregistras was switched off when we read it; questions go to NKSC by e-mail. An NKSC letter is your evidence of entry.

What a smaller company should keep as evidence

Registered, in a customer's supply chain under Article 21(2)(d), or expecting a questionnaire: one folder answers all three.

Keeping runtimes current (PHP versions) and the mail domain protected (DMARC) is the part of Article 21(2)(e) a small company can start tomorrow.

Where Northwestern Tideline fits

Northwestern Tideline writes the applicability memo from a company's registry data and the texts above, prepares the data the head will enter in KSIS, and keeps the evidence folder current. We do not represent NKSC, we register no one, and we look only at systems a company has asked us in writing to look at.

The service is on the Tideline page; the wider picture is in cybersecurity for companies in the age of AI. If you have an NKSC letter, send us its date and your company code.