NIS2 Compliance for Banking in Lithuania
Credit institutions and banking entities fall under both NIS2 Annex I and DORA (EU) 2022/2554. NIS2 obligations apply in parallel with DORA's digital operational resilience requirements. Systemic importance makes this a priority sector.
Reporting to National Cyber Security Centre (NKSC)
Banking entities in Lithuania report significant cybersecurity incidents to NKSC-LT, operating under National Cyber Security Centre (NKSC). The NIS2 Article 23 timeline applies:
- 24 h Early warning — notify NKSC-LT
- 72 h Formal incident notification with initial assessment
- 1 month Final incident report with root cause and remediation
Key cyber risks for Banking in Lithuania
- ▸DDoS attacks on online banking services
- ▸SWIFT and interbank network compromise
- ▸Account takeover and credential stuffing
- ▸Third-party ICT provider failures
Key NIS2 obligations for Banking entities
- ✓ICT risk management framework (aligned with DORA)
- ✓72-hour incident notification to national authority
- ✓Third-party ICT service provider oversight
- ✓Business continuity and disaster recovery testing
Example in-scope organisations
- ·Commercial and retail banks
- ·Credit institutions (licensed under CRR)
- ·Online banking platforms
- ·Payment infrastructure operators
Is your Banking organisation in scope in Lithuania?
Get a personalised assessment in 30 seconds — obligation checklist, readiness score and gap report included.
Run the free NIS2 scope check →Frequently asked questions
Is my Banking organisation in scope for NIS2 in Lithuania?
Yes — if you are a medium or large organisation. In Lithuania, Banking is a NIS2 Annex I sector. Large organisations are Essential Entities; medium organisations are Important Entities. Transposed via the Law on Cybersecurity (2024 amendment); NKSC is both competent authority and national CSIRT. Use our free scope checker for a personalised result.
Who do I report NIS2 incidents to in Lithuania as a Banking entity?
Report significant incidents to NKSC-LT (National Cyber Security Centre (NKSC)). You must submit an early warning within 24 hours, a detailed notification within 72 hours, and a final report within one month — per NIS2 Article 23.
What security measures must Banking organisations implement under NIS2 in Lithuania?
Under NIS2 Article 21, organisations must implement risk-proportionate security measures including: ICT risk management framework (aligned with DORA); 72-hour incident notification to national authority; Third-party ICT service provider oversight. Additional requirements may apply under Lithuania's national transposition.
What are the NIS2 fines for Banking organisations in Lithuania?
Essential Entities face fines up to €10 million or 2% of global annual turnover under NIS2 Article 34. Lithuania's national transposition may set specific enforcement priorities and fine scales.
Related sectors in Lithuania
For decision-support purposes only. Exact scope depends on Lithuania's national transposition of NIS2 — verify obligations with a qualified expert.