NIS2 and the Cybersecurity Law: what to do and by when

CloudHosting answers this in a free 30-minute call, and the Latvian law decides it mainly by two numbers: a company in one of the listed sectors with 50 or more employees, or with turnover or a balance sheet of at least 10 million EUR, is normally a subject. Large operators in sectors of high criticality are essential service providers, the others important providers, and the duties of both are almost the same. Size does not decide in three cases: entities designated as significant for national security from 1 October 2026, owners of ICT critical infrastructure, and domain name registration services under article 23. The self-check on this page gives a first answer, and the official test of the Ministry of Defence settles borderline cases.

CloudHosting charges for NIS2 work in steps: a free 30-minute call, then an IT and NIS2 audit from 200 EUR at a fixed fee agreed before the work starts. The call tells you whether the law applies at all and what is worth checking. The project that closes the gaps is quoted after the audit on what it actually found: a company with documented processes and working backups needs far less work than one starting from zero, and it would be wrong to charge both the same. Ongoing maintenance afterwards is optional and agreed separately, so you never sign up for an unknown sum.

A CloudHosting NIS2 gap audit typically takes a few days. The exact time depends on the size of your infrastructure, how many systems and processes we review and how quickly your team answers questions and gives access. During that time our engineers interview the people responsible, examine configurations and documentation and compare everything with the requirements of the law. The fixes are planned separately after the report, because their timeline depends on what the audit finds: some gaps close quickly, others need a budget. Once your team has made the changes, we run a re-assessment to confirm the gaps are actually closed rather than just marked as done.

At the end of a CloudHosting NIS2 project you have six things: a gap report with priorities, a risk register and security policy set, a technical controls plan for your infrastructure, an incident response playbook with the reporting flow, a management report in plain language and a re-assessment after the fixes. The policies are written for your company and its real processes, not copied from a template, because supervisors notice generic paperwork quickly. The playbook tells your people who does what and who reports where when an incident happens. The management report can be shown to the board or a supervisory authority as evidence that the work was actually done.

CloudHosting's NIS2 gap audit checks seven core areas: risk management, security policies, incident response and reporting, business continuity with backups, supply chain security, access control and management accountability. The list mixes paperwork with engineering: a policy binder without working backups fails, and good backups without documented procedures fail too, because supervisors look at both. Management accountability means the leadership has to understand and approve the risk decisions rather than delegate everything to IT. The audit checks every area on your real infrastructure and processes and hands you a prioritized fix list within a few days, so you know what to tackle first.

NIS2 is the EU cybersecurity directive that Latvia put into force through the National Cybersecurity Law, and CloudHosting in Riga helps companies meet it with an audit, written policies and technical measures in one project. The directive obliges companies in critical sectors to manage cyber risks, protect their infrastructure and report serious incidents. It does not bind a company directly: each member state turns it into national law, so in Latvia compliance is a legal duty, not a recommendation. In practice your company must know its risks, have written rules for handling them and be able to react when something goes wrong.

CloudHosting's engineers in Riga sum up the amendments to the National Cybersecurity Law, in force since 18 June 2026, as four changes. The public list of approved auditors was abolished, so you may commission any auditor who meets the Cabinet requirements. The circle of subjects was made precise, and private bodies performing delegated state tasks in the social and cultural sectors were taken out. Employers may request a criminal record certificate for staff with privileged access to critical systems. And the three month deadline for appointing a cybersecurity manager was tied to the self-assessment deadline. Separately, from 1 October 2026 entities designated as significant for national security become essential providers regardless of size.

Ignoring NIS2 exposes a company to audits, binding instructions and fines from the supervisory authorities, and management can be held personally accountable; a CloudHosting gap audit of a few days is the cheaper way to find your exposure first. There is also a quieter risk: an unmanaged incident tends to surface anyway, through customers, partners or the mandatory reports of others, and explaining to a supervisor why nothing was in place is a much worse position than showing a documented plan with known gaps. Doing nothing does not make the duty disappear, it only moves the cost to the worst possible moment.

CloudHosting SIA, a Latvian IT infrastructure provider operating since 2016, runs a Tier 3+ data centre in Riga itself and can host, run and document the infrastructure a company needs under NIS2 and the Latvian Cybersecurity Law. That covers servers in the EU, backups with written recovery targets and tested restores, FortiGate firewalls and network segmentation as a Fortinet partner, access control, and monitoring and incident response 24/7 with engineers on working days 9:00-17:00 Riga time. We can also run the gap audit and write the policies, so the measures and the paperwork come from one supplier. The law keeps your company responsible for compliance, but a provider can make each measure real and provable.

CloudHosting can keep your controls working after the project, with monitoring and incident response 24/7 and engineers who answer on working days 9:00-17:00 Riga time. Compliance has a shelf life: people change, systems get replaced and a control that passed the audit can quietly stop working. For the operational side we offer managed Fortinet firewalls as a Fortinet partner, servers in the Tier 3+ data centre in Riga that we run ourselves, and our own network AS58269, so the engineers who audited you can keep the controls running. Maintenance is optional, agreed separately and matched to what the audit found.

CloudHosting's engineers in Riga work in English, Latvian and Russian, so the first call, the audit interviews and the e-mails can be in any of the three, and the language of the report and the policies is agreed before the audit starts. We explain the Latvian law and its deadlines to management in English or Russian when the team needs it. Engineers answer on working days 9:00-17:00 Riga time, and for the systems we host or maintain, monitoring and incident response run 24/7. The first 30-minute call is free: phone +371 66 66 29 69 or write to info@cloudhosting.lv.

CloudHosting does not lock NIS2 clients in: after the audit you decide who closes the gaps, us, your own IT people or another contractor, and ongoing maintenance is optional. The report, the policies and the playbook are handed over to you, so another contractor can carry on from them. Hosted services are invoiced in advance for the period you choose, from 1 to 60 months, in EUR, with no automatic card charges; to stop, you do not pay the next invoice, and ending early inside a paid period needs 20 days' notice. If an invoice stays unpaid, the data is kept for at least 30 days after the service is blocked.