Handles health records, in Slovakia

Vyhláška Národného bezpečnostného úradu č. 493/2022 Z. z. o audite kybernetickej bezpečnosti (19. decembra 2022), v znení vyhlášky č. 212/2026 Z. z. · Read the law's page

• If you are an essential service operator under Act 69/2018 on cyber security, have a certified cyber security auditor audit your security measures, and finish each audit by the end of the third calendar year after the year your last audit ended, or by the end of the fifth calendar year if you do not run a critical basic service and carry out the self-assessment under Section 29(8) of the Act every two years (Annex 2, Part B(1)).
• Have an audit carried out at each significant change, at the latest within six months after the change has a significant effect on your security measures, and do not let one audit run longer than 12 consecutive months (Annex 2, Part B(2) and Section 2(5)).
• When you request an audit, give at least the particulars Annex 1 lists, among them whether you run a critical basic service, the number of your employees and of your suppliers, and the number of your information systems classed as ICT or OT (Annex 1).
• If you carry out the self-assessment, do it every two years, have your cyber security manager answer for its report, and submit the report to the Authority through the unified cyber security information system by the end of the calendar year in which you carried it out (Section 1(2), Section 2(7) and Annex 2, Part B(3)).
• If you began an audit and had not finished it by 31 August 2026, finish it under the rules that applied before 1 September 2026; an audit you begin by 31 December 2026 may also follow those rules (Section 3a).

Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., § 24 a § 6 ods. 5 · Read the law's page

• Report without undue delay, and no later than 24 hours after becoming aware of it, an early warning of a significant cyber security incident, stating in particular whether it may have been caused by unlawful conduct or may have a cross-border effect.
• No later than 72 hours after becoming aware of it, report a notification updating and completing the early warning, in particular an initial assessment of the incident's severity and impact.
• If you are also a trust service provider, report a significant cyber security incident, with its effect on your trust services, without undue delay and no later than 24 hours after discovering it, in place of the later notification (Section 24(3)(b)).
• On the CSIRT unit's request, report updated or other requested information about how the incident is progressing.
• No later than one month after the 72-hour notification, report a final report describing the incident, its severity and impact, the threat type or probable root cause, the mitigating measures taken and under way, and any cross-border impact.
• Where an incident with cross-border impact is still ongoing when the final report is due, report an updated final report within 30 days of restoring normal network and system operation; where any significant incident is still ongoing when you submit the final report, report further information and an updated final report within 30 days of its resolution.
• Through the same reporting system, also report a significant cyber threat you become aware of, a near-miss event that could have caused a significant incident, and a vulnerability in your own publicly available networks or systems that you could not remediate or mitigate in reasonable time.
• Where the EU Digital Operational Resilience Regulation (Regulation (EU) 2022/2554) applies to you as a financial entity, satisfy this duty by reporting a major ICT-related incident through that Regulation's own competent-authority channel instead.
• If the Authority so decides because of the nature or importance of your service, and no contract under Section 24(4) has been concluded, evaluate the occurrence of a cyber security incident and report it in an automated way, in the scope and manner the decision sets; the Authority bears the cost of the technical set-up (Section 24a(1) and (3)).
• Comply with the Authority's decisions after a significant incident or threat: resolve the incident when ordered; carry out a reactive measure when you are inactive in resolving the incident or the resolution is clearly failing; promptly report and prove to the Authority through its information system the reactive measure and its result; and on the Authority's call, submit a proposed protective measure for approval within the time set and carry out the approved measure (Section 27(3), (5), (6) and (8)).
• This binds a prevádzkovateľ základnej služby (essential-service operator) entered in the Authority's register under Section 17, whose designation follows the sector annexes: a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector is entered (Section 17(1)(e)), as is, whatever its size, a DNS service provider, a domain-name registration service provider and a person in one of the other positions Section 17(1)(c) lists. A digital provider that Section 2(2) names (a DNS service, a domain-name registration service, a cloud computing service, a data-centre service, a content delivery network, a managed service, a security service, an online marketplace, an online search engine, or a social-networking-services platform) is reached even without a seat in Slovakia where it takes most of its risk-management decisions in Slovakia (or carries out its cybersecurity measures, or has its largest EU establishment, there) or, if established outside the EU, has its Section 21(1) representative in Slovakia or none in any Member State, but a provider other than a DNS or domain-name registration provider is entered only on meeting the medium-enterprise test or another ground in Section 17(1). The wider sector classes (energy, transport, health, water, digital infrastructure, public administration and the other Annex 1 and Annex 2 sectors) are reached by the same designation. The Act does not apply to the banking, financial and financial-system network and information-security requirements that a special regulation sets (Regulation (EU) 2022/2554 and standards of the European Central Bank, the European System of Central Banks, the Eurosystem or the European supervisory authorities), nor to payment and securities clearing and settlement systems that the European Central Bank or the Eurosystem oversees or operates (Section 2(3)(d)).

Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., §§ 17 až 20 · Read the law's page

• Unless you are a digital provider that Section 2(2) names, whose security measures follow Commission Implementing Regulation (EU) 2024/2690 (Section 19(1)), within 12 months of your registration as an essential-service operator, and graded by your own risk analysis, adopt, maintain and carry out general security measures covering at minimum: information- and cyber-security governance; vulnerability and threat management; asset and risk management; incident and event handling; business continuity, backup and disaster recovery; secure acquisition, development and configuration of your networks, systems and applications; compliance assessment and control; cryptography; human-resources security; identity and access management; network-operations security; protection against malicious code and unwanted content; system, network and communications security; event monitoring, logging and reporting; physical and endpoint security; records, privacy and information-labelling protection; supply-chain security; and procurement and use of certified ICT products, services and processes.
• Build and implement an effective mechanism for promptly informing your statutory body and responsible senior employees of cyber threats, vulnerabilities, incidents, near-misses, their possible impact, and the status of your risk treatment.
• Where you also operate a service the Act designates a "critical basic service" (the functions of a central state-administration body; a large enterprise, above the medium-enterprise threshold, active in an Annex 1 sector other than public administration; a qualified trust service, TLD registry or DNS service; an at-least-medium-sized public electronic communications network or service; a size-independent position under Section 17(1)(c) points 5 to 9, such as sole provider of a key service or a service whose disruption could significantly affect public order, safety or public health; the provision of an essential service to a critical entity; or an information activity or electronic service using public-administration IT that the Authority designates), report that status to the Authority and expect a higher administrative-fine ceiling for the same duties.
• Notify the Authority within 60 days of the day you start an activity that Section 17(1) lists, giving your name, seat and contact data (including email addresses, public IP addresses and telephone numbers), the EU Member States in which you operate or provide the service, and your representative's name, seat and contact data; the Authority makes the register entry and informs you through its information system, and your duties as an operator begin on the day the entry notice names, no earlier than the 30th day after the entry (Section 17(2), (4) and (5)). Report any later change in the registered facts, other than a reference datum, through that system within 14 days (Section 17(6)); Section 19(7) separately gives 30 days for changes in registered data.
• Whatever sector measures apply to you, your security measures must include at least: a cyber security manager who is independent of the management of IT operations and service development and who meets the knowledge standards for the role; incident detection and an incident log; incident-handling procedures; a contact person for receiving and recording reports; a connection to the incident reporting and resolution system and the central early-warning system; assigned roles and responsibilities with training for each role; named persons responsible for approving the measures, oversight, control, audit, adequate resources and training; and security awareness training (Section 19(1) and Section 20(4)).
• Include in your risk analysis the political risk of each third party, assessed in particular against its compliance with the international commitments of Slovakia, the possibility that a state outside the EU and NATO influences it, its ownership and management structure including any foreign-state holding and foreign direct investment, that state's law and international commitments on human rights, cybersecurity, cybercrime, data protection and information protection, and information on that state and intelligence-service information on cyber threats; the Government approves the political risks on the Authority's opinion and the Authority publishes them in its information system (Section 20(5)).
• Have a certified cyber security auditor audit your security measures and your compliance with the Act within two years of your entry in the register, again after every change that significantly affects the measures and at the interval the Authority sets, and file the final audit report, with corrective measures and their deadlines, with the Authority within 30 days of the end of the audit (Section 29(1) to (5)). An operator that does not run a critical basic service may meet the first audit duty by self-assessment in the Authority's information system, carried out by its cyber security manager, but must be audited within five years of its entry in the register (Section 29(8)); an operator that Regulation (EU) 2022/2554 covers has the effectiveness of its measures verified under that Regulation by a certified auditor (Section 29(9)).
• Where a third party carries out an activity that directly bears on the availability, confidentiality or integrity of your networks and information systems, conclude a contract binding it to the security measures and notification duties of the Act for as long as it performs the activity, and carry out a risk analysis when you conclude it; no contract is needed where the third party is itself an operator or the risk is low, and you must tell the third party, to the extent necessary, of a reported incident that would otherwise make performance impossible (Section 19(2) to (4)). The third party must carry out the measures the contract sets and submit to your checks, and where you run a critical basic service the Authority may inspect it too and it is treated as an operator for that purpose; such an operator must also report to the Authority a contract with a third party that has significant influence over its cybersecurity, and the contract's termination (Section 19(2) and (7)); a third party with significant influence over cybersecurity that is under contract to a critical-service operator is itself entered in the register (Section 17(1)(i)).
• Also resolve any cyber security incident; cooperate with the Authority and the central body on a reported incident, giving them the help and information you hold; during an incident secure evidence so that it can be used in criminal proceedings; report to the law-enforcement authority or the Police a crime that an incident involves once you credibly learn of it; analyze the dependencies of your assets, information systems, ICT products and third-party ICT services in the supply chain to identify the impact of an incident; take account of the Authority's security methodologies and policies, current security trends, good practice and international standards; and notify the Authority of the appointment or change of your statutory body when that change is not a reference datum (Section 19(6)(a), (c) to (g) and (i)).
• If a person provides a Section 2(2) service or performs such an activity in Slovakia (or is a third party doing so) and has no residence, place of business or seat in an EU Member State, it must designate a representative who has one in Slovakia or in another Member State where it also provides the service, and keep one throughout (Section 21(1)); any person within Section 2(2) that the Act covers must, on the Authority's request, report in writing through its information system, within three months of the change, any change to its name, annex classification, establishment addresses, its representative's address or contact data, its own contact data, the Member States where it provides the service, or the IP address ranges it uses (Section 21(3)).
• If you run a top-level domain registry or provide domain-name registration, keep a separate register of registration data (the domain name, the registration date, the holder's name and contact data, and the applicant's contact data where different), adopt internal rules and procedures to verify the data submitted at registration, publish the non-personal registration data free of charge immediately after registration, give the Authority or the central body access to the data free of charge within 72 hours of a request, publish your internal rules and the procedure for giving data on your website, and share with the other registry or registrar the data needed so that an applicant need not supply it twice (Section 22(1) to (8)).
• Do not use a product, process, service or third party that the Authority has banned or restricted by a decision published in the Collection of Laws (a ban or restriction lasts up to two years per decision and may be repeated); for use begun before publication, stop or restrict it within the period the decision sets, which is not less than two years and not more than five, and within six months of publication apply appropriate risk-management measures (Section 27a(1), (4) to (7)).
• If you were an operator of an essential service under the Act as it stood until 31 December 2024, you are treated as an operator of a critical basic service unless the Authority decides by 31 December 2026 that you do not meet Section 18(1); a digital service provider under that earlier text is treated as an essential-service operator unless the Authority decides by that date that it does not meet Section 17(1). Until 31 December 2026 you may also adopt and carry out security measures, and run an audit, under the rules in force until 31 December 2024 (Section 34b(1) to (5) and (7)).
• This binds a prevádzkovateľ základnej služby (essential-service operator) entered in the Authority's register under Section 17, whose designation follows the sector annexes: a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector is entered (Section 17(1)(e)), as is, whatever its size, a DNS service provider, a domain-name registration service provider and a person in one of the other positions Section 17(1)(c) lists. A digital provider that Section 2(2) names (a DNS service, a domain-name registration service, a cloud computing service, a data-centre service, a content delivery network, a managed service, a security service, an online marketplace, an online search engine, or a social-networking-services platform) is reached even without a seat in Slovakia where it takes most of its risk-management decisions in Slovakia (or carries out its cybersecurity measures, or has its largest EU establishment, there) or, if established outside the EU, has its Section 21(1) representative in Slovakia or none in any Member State, but a provider other than a DNS or domain-name registration provider is entered only on meeting the medium-enterprise test or another ground in Section 17(1). The wider sector classes (energy, transport, health, water, digital infrastructure, public administration and the other Annex 1 and Annex 2 sectors) are reached by the same designation. The Act does not apply to the banking, financial and financial-system network and information-security requirements that a special regulation sets (Regulation (EU) 2022/2554 and standards of the European Central Bank, the European System of Central Banks, the Eurosystem or the European supervisory authorities), nor to payment and securities clearing and settlement systems that the European Central Bank or the Eurosystem oversees or operates (Section 2(3)(d)).

Vyhláška Národného bezpečnostného úradu č. 226/2025 Z. z. o podrobnostiach o hláseniach (26. augusta 2025) · Read the law's page

• If you are an essential service operator or another person who reports under Section 24 of Act 69/2018 on cyber security, report a serious cyber security incident with the particulars of Annex 2: your identity and contact data, the time of detection, a description of the incident and its consequences or expected scope, whether unlawful conduct may have caused it, whether it may have cross-border impact and the effect on trust services; the follow-up report adds updated information, the status of resolution and the measures taken.
• When you report a significant cyber threat, a near miss or a vulnerability, give the particulars of Annex 3: the type, description, possible impact and time of discovery of what you report and, for a vulnerability, the ICT product, ICT service or operational technology concerned and its manufacturer or provider where you know it.
• Judge whether an event is a serious disruption of an essential service against the criteria of Annex 1: an outage of more than 30 minutes (critical essential service) or 60 minutes (other essential service), an impairment of more than 60 or 180 minutes, a threat to the availability, authenticity, integrity or confidentiality of data protected under a special regulation, a threat to data or related services that affects more than 25,000 persons, an economic loss above 0.1 percent of gross domestic product, an economic loss or material damage to one user above EUR 250,000, rescue work or distress assistance, injury to more than 100 persons needing medical treatment or the death of at least one person, and an event involving apparent unauthorized access to, or a failure of, a network or information system that could cause those consequences, an event that may significantly disrupt another critical-service operator, or an event that is a significant incident under Article 3 of Commission Implementing Regulation (EU) 2024/2690 or an incident under the Critical Infrastructure Act, Act No. 367/2024 Z. z. (Annex 1, points 1 to 8).

Vyhláška Národného bezpečnostného úradu č. 227/2025 Z. z. o bezpečnostných opatreniach (26. augusta 2025), § 1 až 6 · Read the law's page

• If you are an essential service operator under Act 69/2018 on cyber security, maintain security documentation that contains an approved cyber security strategy, approved security policies, a classification of your information, the category of each network, information system and operational technology, a risk analysis with a list of assets, a documented list of the security measures you have and have not adopted with reasons, and the last final audit report (§ 4).
• Manage risk by identifying assets and risks, analyzing and assessing them, adopting security measures with reasons for any you do not adopt, and reviewing the identified risks at least once a year; have the person named in Section 20(4)(h) of the Act approve the results of the analysis and the proposed measures (§ 5).
• Keep a centrally managed register of your primary and supporting assets, their owners and the persons responsible for identifying and recording them, and keep it current (§ 6).
• Include in risk management a functional impact analysis that assesses the effect on your operations of a crisis scenario that may hit the resources and assets supporting your processes or endanger the continuity of your services, and that sets a recovery time objective and a recovery point objective (§ 5(2)).
• Your contract with a supplier under Section 19(2) of the Act must at least bind the supplier to follow your security policies, record its consent to them, provide for the scope, manner and possibility of your controls and audits at the supplier, and require it to inform you of a cyber security incident and of facts that affect cybersecurity and to help resolve it (§ 7(2)); a contract concluded by 31 August 2025 stays valid only for the term originally agreed and cannot be extended after that date if it does not comply with the security measures of §§ 3 to 7 (§ 8).