LexLint.ioBeta

Know the law your code answers to.

Law / Czech Republic

Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.)

Decree No. 409/2025 Coll., on Security Measures of a Higher-Obligations Provider, Sections 3 to 26

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

As of .

What it requires

  • If you are a provider of a regulated service in the higher-obligations regime under the Cybersecurity Act, matching NIS2's essential entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an essential entity.
  • Run an information security management system: set its objectives, manage risks under Section 8, and adopt security measures proportionate to the cybersecurity needs of the regulated service (Section 3).NIST CSF 2.0GV.PO-01
  • Have your statutory body or equivalent top management complete the training under Section 10(3)(a) and see that the security policy and the objectives of the management system are set (Section 4).NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
  • Adopt measures on security roles, security policy and documentation, risk management, suppliers, human-resources security, change management, acquisition, development and maintenance, access management, handling of events and incidents, cybersecurity audit, identity administration, detection, logging and evaluation of events, application security, cryptographic algorithms and availability of the regulated service (Sections 5 to 26).NIST CSF 2.0GV.PO-01
  • Set a plan for cybersecurity audits and audit whether the measures the Act and this decree require are in place and comply with law, internal rules, contracts and best practice (Section 16).NIST CSF 2.0ID.IM-01

These lines are LexLint's reading of the law's text, as of . Also read by: National Cyber and Information Security Agency (NÚKIB) (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.IM-01Improvements are identified from evaluations
  • PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Failing to establish or carry out a Section 13 security measure is an administrative offence (přestupek) under Section 59(1), not a criminal offence.

Penalty structure

Section 59(4)(a) of the Act sets the fine for a higher-obligations provider's infringement of the Section 13 security-measure duty at up to CZK 250,000,000 or up to 2 percent of the worldwide net annual turnover of the undertaking it belongs to, whichever is higher.

Rule
Higher of
As of
Currency
CZK
Fixed cap
250,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB, the National Cyber and Information Security Agency), the central administrative authority for cybersecurity under Section 42(1) of the Act.

Settledness

The guidance is the Agency's own revised explanatory report to the decree, published as an informative document that is not identical to the version submitted in the legislative process.

As of
Guidance link
https://portal.nukib.gov.cz/storage/uploads/2025/12/03/duvodova-zprava-vyhlaska-vyssi-rezim_uid_69303a3e441fc.pdf
Guidance body
National Cyber and Information Security Agency (NÚKIB)

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Decree No. 409/2025 Coll. of the National Cyber and Information Security Agency (NÚKIB), issued under Section 13(3) of the Cybersecurity Act on and promulgated on , sets the content of the security measures a provider of a regulated service in the higher-obligations regime must adopt, and how it is to adopt and carry them out.

Section 3 requires the provider to set the objectives of an information security management system, to manage risks under Section 8, and to adopt proportionate measures for the regulated service. Section 4 requires the statutory body or equivalent top management to complete training and to see that the security policy and the objectives of the management system are set.

Sections 5 to 26 then set detailed measures, among them security roles, policy and documentation, risk management, suppliers, human-resources security, change management, acquisition, development and maintenance, access management, handling of events and incidents, cybersecurity audit, identity administration, detection, logging and evaluation of events, application security, cryptographic algorithms and availability of the regulated service.

Section 16 requires the provider to set a plan for its cybersecurity audits. The decree took effect on . Section 70(1) of the Cybersecurity Act, under whose Section 13(3) this decree is issued, disapplies the Act's provisions on security measures, including their supervision, where a directly applicable EU regulation lays down such obligations with at least comparable effect, and Section 70(3) counts a regulation that itself says so.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service or operates a social platform.

Back to the example  ·  Lint your app