Cybersecurity law & regulation in Liechtenstein (2026)

Legal framework

Cyber-Sicherheitsgesetz (CSG, LGBl. 784.13) and Cyber-Sicherheitsverordnung (CSV), in force since 1 February 2025, transposing EU NIS2 Directive (EU) 2022/2555 into Liechtenstein law. Supervised by the Stabsstelle Cyber-Sicherheit (National Cyber Security Unit).

Key points: cybersecurity in Liechtenstein

1. 01NIS2 transposition via CSG

   The total revision of the Cyber-Sicherheitsgesetz (CSG) was adopted by the Landtag in late 2024 and entered into force on 1 February 2025 together with the Cyber-Sicherheitsverordnung (CSV), making NIS2 (Directive (EU) 2022/2555) directly applicable in Liechtenstein law.

   llv.li regierung.li

2. 02Competent authority

   The Stabsstelle Cyber-Sicherheit (National Cyber Security Unit), reporting to the Prime Minister's Office, is the national supervisory and incident-response authority. It maintains the register of covered entities, receives incident notifications, and coordinates cross-border cooperation.

   llv.li llv.li

3. 03Expanded scope and entity classes

   The CSG significantly broadens scope to essential and important entities across sectors including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, postal/courier, waste management, food and research. Covered entities were required to (re-)register with the Stabsstelle in early 2025.

   llv.li regierung.li

4. 04Incident reporting duties

   Essential and important entities must notify significant incidents to the Stabsstelle Cyber-Sicherheit following the NIS2 timeline: an early warning within 24 hours of awareness, an incident notification within 72 hours (with initial severity/impact assessment), and a final report within one month.

   regierung.li llv.li

5. 05Risk-management obligations and sanctions

   Covered entities must implement technical and organisational risk-management measures (policies, supply-chain security, cryptography, access control, training, business continuity). The CSG provides for administrative fines, enforcement measures and management accountability aligned with NIS2 (up to the directive's EUR 10 million / 2% worldwide turnover maximum for essential entities).

   regierung.li llv.li

6. 06Sectoral overlay: DORA for financial entities

   Regulation (EU) 2022/2554 (DORA) was implemented in Liechtenstein with effect from 1 February 2025. The Financial Market Authority (FMA) supervises ICT risk management, digital operational resilience testing, third-party ICT risk and incident reporting for banks, insurers, investment firms and other financial entities via its e-Service Portal.

   fma-li.li fma-li.li

Timeline of decisions

1. 1 Feb 2025Guidance · official
   National Cyber Security Strategy 2025 Takes Effect; NIS2 Entity Registration Mandatory

   Liechtenstein's updated five-year National Strategy for Protection Against Cyber Risks entered into force, coordinated by the National Cyber Security Unit (NCSU); the mandatory NIS2 entity registration portal launched simultaneously, with existing NIS1 entities required to re-register by 31 March 2025.

   ENISA

2. 1 Feb 2025Guidance · official
   National Strategy for Protection Against Cyber Risks 2025 takes effect

   Liechtenstein adopted an updated national cyber strategy succeeding the 2020-2024 plan, reflecting the new CSG, evolving threats and technological change, and reinforcing the role of the national Cyber Security Unit and CSIRT.

   Government of Liechtenstein (Regierung.li)

3. 1 Feb 2025Law · official
   DORA applies to Liechtenstein's financial sector

   The EU Digital Operational Resilience Act (Regulation 2022/2554), incorporated into the EEA Agreement and supplemented by a national implementing act (EEA-DORA-DG), began applying in Liechtenstein, imposing ICT risk-management, incident-classification/reporting and third-party-risk rules on financial entities supervised by the FMA.

   Finanzmarktaufsicht (FMA) Liechtenstein

4. 1 Feb 2025Law · official
   Revised Cyber Security Act (CSG) transposing NIS2 enters into force

   Liechtenstein's overhauled Cyber-Sicherheitsgesetz and accompanying ordinance (CSV) implement EU Directive 2022/2555 (NIS2) via the EEA, vastly expanding covered sectors (energy, water, public administration, postal, waste, food, research, space) and introducing mandatory registration with the Stabsstelle Cyber-Sicherheit plus incident-reporting and supervisory/sanction powers.

   Government of Liechtenstein (Regierung.li)

5. 4 May 2023Law · official
   Original Cyber Security Act (CSG) adopted, transposing NIS1

   Liechtenstein enacted its first dedicated Cyber-Sicherheitsgesetz (LGBl. 2023 No. 269), implementing the EU NIS Directive (2016/1148) via EEA Joint Committee decisions and creating the legal basis for protecting operators of essential services and digital service providers.

   Government of Liechtenstein (Regierung.li)

6. 1 Jan 2021Decision · official
   National Cyber Security Unit (NCSU) and CSIRT.LI Established

   The government created the NCSU as the central coordinating body for all cyber-risk matters and stood up CSIRT.LI as Liechtenstein's official Computer Security Incident Response Team; the move was driven by a surge in cybercrime, cases grew 88% in 2020 and a further 172% in 2021, making it the fastest-growing offence category in the country.

   Liechtenstein National Administration (llv.li)

7. 1 Jan 2021Guidance · official
   FMA Guideline 2021/3 on ICT and security risk management

   The financial-market authority issued guidance harmonising ICT and cyber risk-management expectations for supervised financial intermediaries, laying the groundwork later aligned with and superseded by DORA.

   Finanzmarktaufsicht (FMA) Liechtenstein

8. 1 Aug 2020Guidance · official
   First National Cyber Risk Strategy adopted; Cyber Security Unit set up

   The government approved Liechtenstein's inaugural 'National Strategy for the Protection of Liechtenstein against Cyber Risks' (2020-2024), targeting the population, economy/financial centre, critical infrastructure and state bodies, and anchoring the Stabsstelle Cyber-Sicherheit and national CSIRT.

   Government of Liechtenstein (Regierung.li)

9. 1 Nov 2016Incident
   Valartis Bank Liechtenstein data breach and extortion

   Hackers exfiltrated several gigabytes of client data from Valartis Bank Liechtenstein and attempted to blackmail account holders for Bitcoin ransoms, a high-profile incident that highlighted financial-sector cyber exposure ahead of formal cyber legislation.

   The Register

10. 28 Jan 2016Law · official
    Liechtenstein Ratifies the Budapest Convention on Cybercrime

    Liechtenstein deposited its instrument of ratification with the Council of Europe; under Liechtenstein's monist legal system the Budapest Convention became immediately part of domestic law, with provisions distributed across the Criminal Code, Code of Criminal Procedure, Communications Act, E-Commerce Act, and Mutual Legal Assistance Act rather than in a single cybercrime statute.

    Council of Europe

Sources

1. 1.regierung.li/files/attachments/2025111000-csg-en.pdf
2. 2.llv.li/de/medienmitteilungen/die-totalrevision-des-cyber-sicherheitsgesetzes
3. 3.llv.li/en/national-administration/national-cyber-security-unit
4. 4.llv.li/de/landesverwaltung/stabsstelle-cybersicherheit/relevante-rechtsvorsc
5. 5.llv.li/serviceportal2/amtsstellen/stabstelle-regierungskanzlei/bua_093_2024_
6. 6.fma-li.li/en/supervision-regulation/dora
7. 7.fma-li.li/en/news/dora-in-force-new-event-related-notification-1091