SlovakiaVyhláška NBÚ č. 226/2025 Z. z., Details of Cyber Security Reports
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- If you are an essential service operator or another person who reports under Section 24 of Act 69/2018 on cyber security, report a serious cyber security incident with the particulars of Annex 2: your identity and contact data, the time of detection, a description of the incident and its consequences or expected scope, whether unlawful conduct may have caused it, whether it may have cross-border impact and the effect on trust services; the follow-up report adds updated information, the status of resolution and the measures taken.NIST CSF 2.0RS.CO-02
- When you report a significant cyber threat, a near miss or a vulnerability, give the particulars of Annex 3: the type, description, possible impact and time of discovery of what you report and, for a vulnerability, the ICT product, ICT service or operational technology concerned and its manufacturer or provider where you know it.NIST CSF 2.0RS.CO-03
- Judge whether an event is a serious disruption of an essential service against the criteria of Annex 1, including outages of more than 30 or 60 minutes, impairments of more than 60 or 180 minutes, an economic loss above 0.1 percent of gross domestic product and a loss to one user above EUR 250,000.NIST CSF 2.0RS.MA-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The decree creates no offence and sets no penalty of its own; sanctions for failing to report are those of Act 69/2018.
Who enforces it
Enforcement body
Národný bezpečnostný úrad (National Security Authority), the authority that issues the decree under Section 32(1) of Act 69/2018 and carries out the supervision the Act provides.
Settledness
- As of
What this law does
Decree 226/2025 of the National Security Authority (Vyhláška Národného bezpečnostného úradu) sets the details of reports under Act 69/2018 on cyber security, was approved on , promulgated on and took effect on .
Annex 1 defines the criteria for a serious disruption of the operation of an essential service operator, among them a complete outage of more than 30 minutes for an operator of a critical essential service or 60 minutes for another essential service operator, an impairment of more than 60 or 180 minutes, an economic loss above 0.1 percent of gross domestic product and a loss to at least one user above EUR 250,000.
Annex 2 sets what a report of a serious cyber security incident under Section 24(3)(a) and (b) of the Act contains, namely the reporter's identity and contact data and the time of detection, a description of the incident and its consequences or expected scope, whether it may have been caused by unlawful conduct, whether it may have cross-border impact and the effect on trust services, and, in the follow-up report, updated information and the status and reactive measures taken.
Annex 3 sets what a report of a significant cyber threat, a near miss or a vulnerability under Section 24(5), and a report of an incident, threat or near miss under Section 24(6), contains, and for a vulnerability also the identification or description of the ICT product, ICT service or operational technology concerned and its manufacturer or provider where known to the reporter.
Section 24(8) of Act No. 69/2018, whose reports this decree details, has an essential-service operator that Regulation (EU) 2022/2554 (DORA) covers meet its reporting duty by reporting a major ICT-related incident through DORA's competent authority, in the scope, manner and time limits DORA sets.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.