NIS2 compliance guides and resources
Lithuania is the Baltics’ strictest NIS2 enforcer: €10M fines, NKSC’s 4-stage escalation, management function bans under Article 32, and a step-by-step appeals guide.
RIA serves as Estonia’s sole NIS2 authority, SPOC, and CSIRT. Learn incident reporting via CERT.EE, how X-Road affects your scope, and the 1 April 2026 registration deadline.
Latvia NIS2 fines reach €10M for essential entities. Directors risk 3-year disqualification. Guide: NCSC enforcement powers, Cabinet Reg 397, and cybersecurity manager deadline.
Latvia requires a vetted cybersecurity manager beyond NIS2. See how NCSC Latvia, CERT.LV, and the Constitution Protection Bureau each supervise your sector.
Cyprus NIS2 now exposes directors to personal bans under Law 60(I)/2025. Exact fine tiers (€10M/2%), DSA enforcement toolkit, DORA lex specialis rule explained.
Estonia’s NIS2 fines reach €10M/2% for essential entities. Learn how RIA’s proactive supervision model and CERT.EE’s enforcement feedback loop make compliance non-negotiable by 2028.
Croatian entities face NIS2 fines up to €10M and managers up to €6,000 personally — here’s what ZSIS inspects, which sectors face enforcement first, and how to appeal.
SEGA is Bulgaria’s NIS2 authority — but the 2-week registry update rule and 5 Bulgarian-specific additions set this framework apart from the EU baseline. What compliance officers need to know.
Three Cyprus authorities control NIS2: DSA enforces, Commissioner of Communications oversees, CSIRT-CY receives your 6-hour incident report.
50% grace period expired June 1 — Bulgaria NIS2 now enforces €10M/2% essential fines. €25,000 minimum floor, SEGA audit powers, 3-year equipment phase-out inside.
