Runs an essential service, in the Czech Republic

Act No. 264/2025 Coll., Cybersecurity Act, Sections 13-14 · Read the law's page

• Adopt and implement organisational and technical security measures adequate and proportionate to securing the regulated service's proper provision and the cybersecurity of the assets you use to provide it, within a scope you determine and must regularly review.
• If you are in the higher-obligations regime and do not provide a service listed in Section 18(1), cover at least: an information security management system, top-management requirements, security roles, security-policy and documentation management, asset management, risk management, supplier management, human-resources security, change management, acquisition and development security, access management, handling of cybersecurity events and incidents, business-continuity management and cybersecurity auditing, plus physical security, communications-network security, identity administration and access-rights management, detection, logging and evaluation of cybersecurity events, application security, cryptographic algorithms, availability assurance, and, where applicable, security of industrial, control or similarly specific technical assets.
• If you are in the lower-obligations regime and do not provide a service listed in Section 18(1), a reduced set applies: a minimum cybersecurity assurance system, top-management requirements, asset management, risk management, human-resources security, business-continuity management, access management, identity and authorisation management, detection and logging of cybersecurity events, incident handling, communications-network security, application security, and cryptographic algorithms.
• If you provide a DNS resolution, trust, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, adopt appropriate and proportionate measures covering at least risk management, security-policy and documentation management, incident handling, business continuity, supplier management, secure acquisition, development and maintenance, application security, human-resources security, cryptography, access management and identity administration, to the extent and in the manner the Commission's NIS2 implementing regulation sets; Section 13(2) does not apply to that service.
• Where a supplier implements a security measure on your behalf, select that supplier consistent with the measure's requirements and write those requirements into your contract with the supplier.
• This binds a poskytovatel regulované služby (provider of a regulated service) under Sections 3 to 5, drawn from 15 named sectors, where you are a medium or large enterprise under Commission Recommendation 2003/361/EC or are otherwise significant for essential social, economic or security functions regardless of size; Section 18 names an online marketplace, an internet search engine and a social-networking-platform provider among the digital-infrastructure-and-services sector's regulated services. The wider sector classes this binds (public administration, energy, manufacturing, food, chemicals, water, waste, transport, financial markets, healthcare, science and education, postal and courier services, defence, and space) are reached too, by declaring that you are an essential or important entity.

Act No. 264/2025 Coll., Cybersecurity Act, Sections 15-16 · Read the law's page

• If you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact.
• If you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision.
• For an incident with significant impact, follow with a report no later than 72 hours after detection that updates your initial assessment and gives the incident's impact and, where available, indicators of compromise.
• If you provide a trust service under the directly applicable EU regulation, submit the notification of an incident with significant impact within 24 hours after detection, not 72.
• Submit an interim report on request, and a final report no later than 30 days after submitting the notification under Section 16(3)(a) (the 72-hour notification, or the 24-hour one for a trust-service provider), or, if the incident is still ongoing at that point, a progress report followed by a final report within 30 days of resolution.
• If you provide a DNS resolution, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, report every incident with significant impact on that service, with significance set by the Commission's NIS2 implementing regulation; the procedure in Sections 15 and 16 still applies unless that regulation sets a special one.
• Report through NÚKIB's Portál Úřadu where you can; otherwise a higher-obligations provider emails NÚKIB or uses its data-box address, and a lower-obligations provider does the same with the Národní CERT.
• This binds a poskytovatel regulované služby under Sections 3 to 5, which Section 18 extends by name to an online marketplace, an internet search engine and a social-networking-platform provider among other digital-infrastructure-and-services roles; the wider sector classes are reached as on this jurisdiction's companion security-measures row.

Act No. 264/2025 Coll., Cybersecurity Act, Sections 25 to 33 and 59(3) · Read the law's page

• This binds a provider of a regulated service whose service the government has listed by regulation as strategically significant, meaning its disruption could seriously affect the security or internal order of the Czech Republic (Section 25); a supplier to such a provider is reached through the provider's own duties and through NÚKIB's measures of general nature (reached by declaring that you are an essential or important entity).
• Make reasonable efforts to find out who supplies you with security-significant deliveries, record at least which deliveries and which suppliers, and report that information and any change to NÚKIB within 10 days of finding it out; make the first report within 1 year of your service becoming strategically significant (Section 31(1) and (2)).
• Observe the conditions, or the ban, that NÚKIB sets by a measure of general nature on using a supplier's performance in the critical part of your service, when the government has resolved the measure is necessary to protect the security of the Czech Republic (Section 29(1)).
• Report to NÚKIB within 60 days a change to your regulated service that makes it strategically significant (Section 26(1)).
• Keep the service available from the territory of the Czech Republic to the necessary extent, and check at least once every 2 years that it can be provided from there, keeping a record (Section 33).

Decree No. 408/2025 Coll., on Regulated Services, Sections 2 and 3 and the Annex · Read the law's page

• When you assess the significance conditions, convert the euro amounts in Commission Recommendation 2003/361/EC at the Czech National Bank's rate for the last day before the assessed calendar year (Section 2(2)).
• If you provide a service listed in the Annex to Decree No. 408/2025 and meet its significance conditions, you are a provider of a regulated service under Section 4 of the Cybersecurity Act, in the higher-obligations or lower-obligations regime the Annex assigns; the sector classes the Annex covers are reached by declaring that you are an essential or important entity.

Decree No. 409/2025 Coll., on Security Measures of a Higher-Obligations Provider, Sections 3 to 26 · Read the law's page

• Run an information security management system: set its objectives, manage risks under Section 8, and adopt security measures proportionate to the cybersecurity needs of the regulated service (Section 3).
• Have your statutory body or equivalent top management complete the training under Section 10(3)(a) and see that the security policy and the objectives of the management system are set (Section 4).
• Adopt measures on security roles, security policy and documentation, risk management, suppliers, human-resources security, change management, acquisition, development and maintenance, access management, handling of events and incidents, cybersecurity audit, identity administration, detection, logging and evaluation of events, application security, cryptographic algorithms and availability of the regulated service (Sections 5 to 26).
• Set a plan for cybersecurity audits and audit whether the measures the Act and this decree require are in place and comply with law, internal rules, contracts and best practice (Section 16).
• If you are a provider of a regulated service in the higher-obligations regime under the Cybersecurity Act, matching NIS2's essential entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an essential entity.

Decree No. 410/2025 Coll., on Security Measures of a Lower-Obligations Provider, Sections 3 to 14 · Read the law's page

• Introduce and carry out security measures proportionate to your security needs, and at least those in Section 3(2) to (6) and Sections 4 to 6 and 10 (Section 3(1)).
• Keep an overview of the security measures you have introduced, will introduce with deadlines, priority and a responsible person, and have not introduced with reasons; update it and evaluate the measures' effectiveness at least once a year; keep each version for at least four years (Section 3(2)).
• Set the tolerable level of harm from a cybersecurity incident and the areas for assessing the significance of an incident's impact on the regulated service (Section 14).
• If you are a provider of a regulated service in the lower-obligations regime under the Cybersecurity Act, matching NIS2's important entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an important entity.