LexLint.ioBeta

Know the law your code answers to.

Law / Czech Republic

Decree on the Security Measures of a Provider of a Regulated Service in the Lower-Obligations Regime (Vyhláška č. 410/2025 Sb.)

Decree No. 410/2025 Coll., on Security Measures of a Lower-Obligations Provider, Sections 3 to 14

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

As of .

What it requires

  • If you are a provider of a regulated service in the lower-obligations regime under the Cybersecurity Act, matching NIS2's important entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an important entity.
  • Introduce and carry out security measures proportionate to your security needs, and at least those in Section 3(2) to (6) and Sections 4 to 6 and 10 (Section 3(1)).NIST CSF 2.0ID.RA-06
  • Keep an overview of the security measures you have introduced, will introduce with deadlines, priority and a responsible person, and have not introduced with reasons; update it and evaluate the measures' effectiveness at least once a year; keep each version for at least four years (Section 3(2)).NIST CSF 2.0ID.RA-06NIST CSF 2.0GV.OV-03
  • Set the tolerable level of harm from a cybersecurity incident and the areas for assessing the significance of an incident's impact on the regulated service (Section 14).NIST CSF 2.0GV.RM-02

These lines are LexLint's reading of the law's text, as of . Also read by: National Cyber and Information Security Agency (NÚKIB) (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P5Protection processes are improved.
NIST CSF 2.0
  • GV.RM-02Risk appetite and risk tolerance statements are established, communicated, and maintained
  • GV.OV-03Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Failing to establish or carry out a Section 13 security measure is an administrative offence (přestupek) under Section 59(2), not a criminal offence.

Penalty structure

Section 59(4)(b) of the Act sets the fine for a lower-obligations provider's infringement of the Section 13 security-measure duty at up to CZK 175,000,000 or up to 1.4 percent of the worldwide net annual turnover of the undertaking it belongs to, whichever is higher.

Rule
Higher of
As of
Currency
CZK
Fixed cap
175,000,000
Turnover percentage cap
1.4

Who enforces it

Enforcement body

Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB, the National Cyber and Information Security Agency), the central administrative authority for cybersecurity under Section 42(1) of the Act.

Settledness

The guidance is the Agency's own revised explanatory report to the decree, published as an informative document that is not identical to the version submitted in the legislative process.

As of
Guidance link
https://portal.nukib.gov.cz/storage/uploads/2025/12/03/duvodova-zprava-vyhlaska-nizsi-rezim_uid_693039f42250d.pdf
Guidance body
National Cyber and Information Security Agency (NÚKIB)

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Decree No. 410/2025 Coll. of the National Cyber and Information Security Agency (NÚKIB), issued under Section 13(3) and Section 15(3) of the Cybersecurity Act and promulgated on , sets the minimum security measures of a provider of a regulated service in the lower-obligations regime and how the provider determines the significance of a cybersecurity incident's impact.

Section 3 requires the provider to introduce measures proportionate to its security needs, including at least those in Section 3(2) to (6) and Sections 4 to 6 and 10. Under Section 3(2) the provider keeps an overview of the measures it has introduced, will introduce, and has not introduced with reasons, updates it with an evaluation of effectiveness at least once a year, and keeps each version for at least four years.

Section 14 requires the provider to set the tolerable level of harm from an incident that does not yet endanger life, health or its ability to meet its obligations, and the areas for assessing an incident's impact, which cover operational impact, the number of users affected, recovery resources, the type and location of the assets affected, the sensitivity of the data and the direct cause. The decree took effect on .

Section 70(1) of the Cybersecurity Act, under whose Section 13(3) this decree is issued, disapplies the Act's provisions on security measures, including their supervision, where a directly applicable EU regulation lays down such obligations with at least comparable effect, and Section 70(3) counts a regulation that itself says so.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service or operates a social platform.

Back to the example  ·  Lint your app