Directive (EU) 2022/2555, NIS2, sets cybersecurity management requirements across many sectors. Obligations for organisations arise through each member state's implementing legislation. This article offers a practical approach, not legal advice or an assessment of your particular situation.
Determine whether and how regulation applies
In the Czech Republic, Act No. 264/2025 Coll. on Cybersecurity implements NIS2. According to the Czech National Cyber and Information Security Agency (NÚKIB) guide, it took effect on 1 November 2025. The Act distinguishes higher and lower obligation regimes. The regulated services decree determines the regime, chiefly by enterprise size, with additional factors for some services.
NÚKIB states that organisations report meeting regulated service criteria within 60 days. Following delivery of the registration decision, a period of up to one year applies for implementing measures and incident reporting. In the lower regime, reporting concerns incidents with significant impact. NÚKIB's calculator supports initial orientation but does not constitute an official opinion.
Use NÚKIB materials when assessing enterprise size and regulated services, and consult a lawyer where unclear. Slovakia has separate legislation and procedures.
Risk assessment as the basis for controls
Article 21 requires appropriate and proportionate technical, operational and organisational measures, considering exposure, entity size and incident likelihood and severity. Risk analysis policy is among the minimum areas.
NÚKIB describes the Czech higher-regime decree as building on international standards. The lower-regime decree is shorter and establishes a minimum security baseline. In either regime, risk assessment helps make controls proportionate and defensible.
It need not be a huge document. Ask:
- Which services and processes matter most to the organisation and customers?
- Which systems, data, people and suppliers support them?
- What could harm them and how likely is it?
- What would disruption, disclosure or alteration cause?
- Which controls exist and how is their effectiveness known?
The result is a prioritised risk list that informs control implementation.
Involve operational and business owners alongside IT. Business owners understand disruption impact; administrators understand weaknesses and likelihood. Update the assessment after major changes, incidents or new test findings.
Give controls owners
Article 21 includes areas such as:
- Incident handling and business continuity, including backups and recovery.
- Supply chain security.
- Secure acquisition, development and maintenance, including vulnerability handling.
- Assessment of control effectiveness.
- Cyber hygiene and training.
- Access control, asset management and MFA where appropriate.
National legislation and the relevant regime define specific requirements.
Start supplier reviews with those accessing your systems or operating critical services. Define security requirements, incident notification and relationship ownership, recording material requirements in contracts.
Every control needs an owner, deadline and verification method. “Introduce MFA” is an intention. “MFA for all remote access and administrative accounts by quarter end, owned by the IT lead and verified through configuration review” is manageable.
Article 20 also assigns management responsibilities: approving and overseeing measures and receiving training. Cybersecurity extends beyond IT.
Verify effectiveness through configuration checks, restoration tests, incident exercises or scoped penetration tests. None alone guarantees legal compliance, but they show whether controls work.
First steps checklist
- Identify regulated services and the applicable regime.
- Confirm reporting obligations and deadlines.
- List key services and supporting systems.
- Complete, prioritise and obtain management approval for risk assessment.
- Assign control owners, deadlines and verification.
- Know key suppliers and their security requirements.
- Define incident reporting under national law.
- Ensure management understands its responsibilities and has received training.
This overview does not guarantee compliance or replace legal advice. Confirm applicability and interpretation with a lawyer or the competent authority. Our team can assist with technical and organisational assessment, priorities and control verification through a consultation.
