Czech RepublicCybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures
Act No. 264/2025 Coll., Cybersecurity Act, Sections 13-14
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a poskytovatel regulované služby (provider of a regulated service) under Sections 3 to 5, drawn from 15 named sectors, where you are a medium or large enterprise under Commission Recommendation 2003/361/EC or are otherwise significant for essential social, economic or security functions regardless of size; Section 18 names an online marketplace, an internet search engine and a social-networking-platform provider among the digital-infrastructure-and-services sector's regulated services. The wider sector classes this binds (public administration, energy, manufacturing, food, chemicals, water, waste, transport, financial markets, healthcare, science and education, postal and courier services, defence, and space) are reached too, by declaring that you are an essential or important entity.
- Adopt and implement organisational and technical security measures adequate and proportionate to securing the regulated service's proper provision and the cybersecurity of the assets you use to provide it, within a scope you determine and must regularly review.NIST CSF 2.0ID.RA-06
- If you are in the higher-obligations regime and do not provide a service listed in Section 18(1), cover at least: an information security management system, top-management requirements, security roles, security-policy and documentation management, asset management, risk management, supplier management, human-resources security, change management, acquisition and development security, access management, handling of cybersecurity events and incidents, business-continuity management and cybersecurity auditing, plus physical security, communications-network security, identity administration and access-rights management, detection, logging and evaluation of cybersecurity events, application security, cryptographic algorithms, availability assurance, and, where applicable, security of industrial, control or similarly specific technical assets.NIST CSF 2.0GV.PO-01
- If you are in the lower-obligations regime and do not provide a service listed in Section 18(1), a reduced set applies: a minimum cybersecurity assurance system, top-management requirements, asset management, risk management, human-resources security, business-continuity management, access management, identity and authorisation management, detection and logging of cybersecurity events, incident handling, communications-network security, application security, and cryptographic algorithms.NIST CSF 2.0GV.PO-01
- If you provide a DNS resolution, trust, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, adopt appropriate and proportionate measures covering at least risk management, security-policy and documentation management, incident handling, business continuity, supplier management, secure acquisition, development and maintenance, application security, human-resources security, cryptography, access management and identity administration, to the extent and in the manner the Commission's NIS2 implementing regulation sets; Section 13(2) does not apply to that service.NIST CSF 2.0GV.PO-01
- Where a supplier implements a security measure on your behalf, select that supplier consistent with the measure's requirements and write those requirements into your contract with the supplier.NIST CSF 2.0GV.SC-06NIST CSF 2.0GV.SC-05
These lines are LexLint's reading of the law's text. Also read by: Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A Section 13 or Section 18(1) infringement is an administrative offence (přestupek) under Section 59, not a criminal offence.
Penalty structure
Section 59(4)(a) sets the fine for a higher-obligations (essential-entity) provider's Section 59(1)(f) infringement (failing to establish or carry out a security measure under Section 13(2) or Section 18(1)) at up to CZK 250,000,000 or up to 2 percent of the offender's group worldwide net annual turnover for the preceding accounting period, whichever is higher, mirroring NIS2 Article 34(4). Section 59(4)(b) sets the same infringement by a lower-obligations (important-entity) provider under Section 59(2)(f) at up to CZK 175,000,000 or up to 1.4 percent of that turnover, whichever is higher, mirroring NIS2 Article 34(5).
- Rule
- Higher of
- As of
- Currency
- CZK
- Fixed cap
- 250,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB, the National Cyber and Information Security Agency), the central administrative authority for cybersecurity under Section 42.
Settledness
- As of
- Guidance link
- https://portal.nukib.gov.cz/pruvodce-novym-zakonem-o-kyberneticke-bezpecnosti
- Guidance body
- Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB)
- Open questions
- Which classification and technical-measures vyhlášky (implementing decrees) has NÚKIB issued under Sections 8(2) and 14 since the Act's effective date, and do any of them narrow the Section 14 measures list as it applies specifically to an online marketplace, internet search engine or social-networking-platform provider?
What this law does
Section 13 requires a provider of a regulated service, within the scope it determines for its own assets, to adopt and implement organisational and technical security measures adequate to secure the regulated service's proper provision and the cybersecurity of its assets.
Section 14(1) sets at least 14 organisational measure categories for a provider in the higher-obligations (essential-entity) regime, including an information security management system, top-management requirements, security roles, security-policy and documentation management, asset, risk, supplier and change management, human-resources security, acquisition and development security, access management, incident handling, business-continuity management and cybersecurity auditing, plus at least 11 technical measure categories including physical security, communications-network security, identity and access-rights administration, event detection, logging and evaluation, application security, cryptographic algorithms, availability assurance, and security of industrial or control-system assets.
Section 14(2) sets a reduced 13-category combined list for a provider in the lower-obligations (important-entity) regime.
Section 18(1) instead requires a provider of DNS resolution, trust, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed-service or managed-security-service offerings to adopt appropriate and proportionate measures covering at least risk management, security-policy and documentation management, incident handling, business continuity, supplier management, secure acquisition, development and maintenance, application security, human-resources security, cryptography, access management and identity administration, to the extent and in the manner set by the Commission's implementing regulation under NIS2, and Section 13(2) does not apply to those services.
Under Section 13(4), a provider must begin implementing and applying the security measures for each regulated service no later than one year from the day the decision registering that service is delivered to it. Section 70(1) disapplies this Act's provisions on security measures and incident reporting, including their supervision, where a directly applicable EU regulation lays down such obligations with at least comparable effect.
Section 70(3) counts as having that effect the provisions of a directly applicable EU regulation that itself says they do. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .