01 / VISIBILITY
Know what is in scope
Maintain an approved asset register with accountable owners, technology context and clearly defined assessment boundaries.
National digital resilience · Independent proposal
A more resilient
digital Latvia.
Latvia Cyber Resilience 2027–2029 is a proposed multi-institution programme focused on improving the visibility, prioritisation and remediation of cybersecurity weaknesses across authorised public-sector digital services.
2027–2029Proposed programme period
36 monthsPhased delivery concept
4 stagesCore assurance workflow
Evidence-ledRemediation verification
01 / The programme
From identification
to verified resolution.
The proposal is designed to help participating institutions maintain a clear record of authorised digital assets, understand material security weaknesses and demonstrate that remediation actions have been completed and independently verified.
02 / PRIORITISATION
Focus on meaningful risk
Assess weaknesses in the context of exploit evidence, exposure, operational importance and available safeguards.
03 / ACCOUNTABILITY
Make action traceable
Route validated findings to responsible teams with documented decisions, review points and remediation milestones.
04 / VERIFICATION
Confirm the outcome
Support closure through retesting or equivalent evidence rather than relying solely on a change of ticket status.
05 / COORDINATION
Work alongside institutions
Support existing security and incident-response structures without replacing statutory responsibilities or incident command.
06 / ASSURANCE
Report what matters
Provide management with a consistent view of coverage, outstanding exposure, progress and documented exceptions.
02 / Programme architecture
A measurable programme, designed around accountability.
Two reference views of the proposed delivery model: the planned 36-month programme structure and preliminary response objectives. These are programme design parameters—not measurements of government systems, completed work or current vulnerabilities.
Delivery model / 2027–2029
36-month implementation framework
Select a phase to examine its intended scope, duration and expected output.
Source: Latvia Cyber Resilience programme concept · Proposed phased plan. Dates and scope are subject to approvals and institutional agreement.
Response design / Preliminary objectives
Risk review response windows
Proposed time to begin reviewing a reported finding, by risk level—not a remediation completion deadline.
Method: Business-day equivalents shown for comparison (8 business hours = 1 day). Objectives are indicative and require validation during programme design.
Public reporting principle. These charts describe proposed programme commitments, not operational performance. Verified programme results should only be published after authorisation, validation and an agreed disclosure process. No institutional asset, finding or incident information is exposed.
02 / Operating approach
A controlled, accountable process.
01
Authorise
Agree assets, responsible owners, testing permissions and operational safeguards.
02
Identify
Assess authorised systems and validate findings with appropriate technical review.
03
Remediate
Prioritise action, assign ownership and document changes and exceptions.
04
Verify
Review supporting evidence and confirm whether the weakness has been resolved.
Designed to complement existing national capabilities
The proposed programme focuses on vulnerability management and remediation assurance. It is not a replacement for national incident response, regulatory oversight or institution-specific security operations.
03 / Proposed roadmap
Built to progress
through clear stages.
A phased delivery model allows scope, controls and results to be evaluated before broader adoption. Select a stage to explore its purpose and proposed outcomes.
MONTHS 01–03
Discovery and programme design
Establish participating responsibilities, assessment scope, technical requirements and baseline measures. Define approval procedures, safeguards and acceptance criteria before operational activity begins.
Proposed outcome: approved programme design and controlled pilot plan.
04 / Governance and safeguards
Security, responsibility
and public trust.
The proposal is framed around lawful authorisation, institutional accountability, privacy protection and auditable outcomes.
Institutional responsibility
Each participating organisation retains responsibility for its systems and operational decisions. Any future implementation would require defined contracting arrangements, written scope approval and a clear division of roles.
Security assessment activities would take place only within authorised boundaries and approved operational conditions. Findings and actions would be recorded with appropriate access controls and oversight.
Latvia’s cybersecurity framework
Latvia’s cybersecurity governance includes the National Cybersecurity Law and national structures such as the National Cybersecurity Centre and CERT.LV. The proposed programme is intended to operate alongside those established arrangements, subject to applicable requirements and formal approvals.
The European Union NIS2 framework provides broader context for cybersecurity risk management and institutional responsibilities.
05 / Public information
Frequently asked questions.
A concise explanation of the programme’s purpose, boundaries and proposed delivery model.
It is an independent programme proposal for coordinated vulnerability management and remediation assurance across consenting public-sector institutions.
No. The proposal focuses on authorised asset assessment, findings management, remediation and verification. Existing national incident-response responsibilities remain with the relevant authorities.
Any eventual assessment would require written authorisation, defined scope, approved methods and operational safeguards. This public website performs no scanning.
The source document is an independent proposal prepared for preliminary discussion. It does not establish government approval, procurement award or operational deployment.
The proposal emphasises baseline coverage, clear ownership, timely action and evidence-backed verification. Any performance targets would be established through a controlled pilot and agreed acceptance criteria.
Programme perspective
A stronger foundation for digital public services.
Public digital infrastructure depends on the ongoing security of applications, platforms and supporting systems. Sustainable resilience requires more than identifying weaknesses: it requires prioritised action, responsible ownership and evidence that corrective measures work.
Latvia Cyber Resilience 2027–2029 proposes a structured approach to those activities, with an emphasis on measured outcomes, careful institutional coordination and transparent governance.
Public information only
No private asset registers, vulnerability records, security credentials, internal incident information or confidential institutional data are published here.