LexLint.ioBeta

Know the law your code answers to.

Law / Slovakia

Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation

Vyhláška Národného bezpečnostného úradu č. 227/2025 Z. z. o bezpečnostných opatreniach (26. augusta 2025), § 1 až 6

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

As of .

What it requires

  • If you are an essential service operator under Act 69/2018 on cyber security, maintain security documentation that contains an approved cyber security strategy, approved security policies, a classification of your information, the category of each network, information system and operational technology, a risk analysis with a list of assets, a documented list of the security measures you have and have not adopted with reasons, and the last final audit report (§ 4).NIST CSF 2.0GV.PO-01NIST CSF 2.0ID.RA-05
  • Manage risk by identifying assets and risks, analyzing and assessing them, adopting security measures with reasons for any you do not adopt, and reviewing the identified risks at least once a year; have the person named in Section 20(4)(h) of the Act approve the results of the analysis and the proposed measures (§ 5).NIST CSF 2.0ID.RA-05NIST CSF 2.0ID.RA-06
  • Keep a centrally managed register of your primary and supporting assets, their owners and the persons responsible for identifying and recording them, and keep it current (§ 6).NIST CSF 2.0ID.AM-02

These lines are LexLint's reading of the law's text, as of .

In the frameworks

NIST Privacy Framework
  • ID.IM-P1Systems/products/services that process data are inventoried.
NIST CSF 2.0
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • ID.AM-02Inventories of software, services, and systems managed by the organization are maintained
  • ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

The decree creates no offence and sets no penalty of its own; sanctions are those of Act 69/2018.

Who enforces it

Enforcement body

Národný bezpečnostný úrad (National Security Authority), the authority that issues the decree under Section 32(1) of Act 69/2018 and carries out the supervision the Act provides.

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Decree 227/2025 of the National Security Authority on security measures (Vyhláška Národného bezpečnostného úradu o bezpečnostných opatreniach) was approved on , promulgated on and took effect on , and repealed Decree 362/2018.

It sets the content of the security measures, the scope of the general security measures for networks, information systems and operational technologies, and the content and structure of the security documentation under Section 20 of Act 69/2018.

The security documentation contains an approved cyber security strategy, approved security policies, a classification of information, the assignment of networks and information systems to a category, a risk analysis with the level of identified, accepted and residual risks and a list of assets, a documented determination of the security measures adopted and not adopted with reasons, and the last final audit report.

Risk management includes asset identification, risk identification, risk analysis, risk assessment, adoption of security measures with reasons for any measure not adopted, and a review of the identified risks at least once a year. The operator keeps a centrally managed register of assets, made up of primary assets, supporting assets, asset owners and the persons responsible for identifying and recording the assets.

Section 20(3) of Act No. 69/2018 has security measures adopted and carried out in the scope and manner this decree sets, or that a special regulation sets where one has been issued. The Act's note 24 to that special regulation gives Regulation (EU) 2022/2554 (DORA) as its first example. Section 29(9) has an essential-service operator that DORA covers verify the effectiveness of its security measures under DORA.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.

Back to the example  ·  Lint your app