SlovakiaVyhláška NBÚ č. 493/2022 Z. z., Cyber Security Audit and Self-Assessment
Vyhláška Národného bezpečnostného úradu č. 493/2022 Z. z. o audite kybernetickej bezpečnosti (19. decembra 2022) v znení vyhlášky č. 212/2026 Z. z.
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- If you are an essential service operator under Act 69/2018 on cyber security, have a certified cyber security auditor audit your security measures, and finish each audit by the end of the third calendar year after the year your last audit ended, or by the end of the fifth calendar year if you do not run a critical basic service and carry out the self-assessment under Section 29(8) of the Act every two years (Annex 2, Part B(1)).
- Have an audit carried out at each significant change, at the latest within six months after the change has a significant effect on your security measures, and do not let one audit run longer than 12 consecutive months (Annex 2, Part B(2) and Section 2(5)).
- When you request an audit, give at least the particulars Annex 1 lists, among them whether you run a critical basic service, the number of your employees and of your suppliers, and the number of your information systems classed as ICT or OT (Annex 1).
- If you carry out the self-assessment, do it every two years, have your cyber security manager answer for its report, and submit the report to the Authority through the unified cyber security information system by the end of the calendar year in which you carried it out (Section 1(2), Section 2(7) and Annex 2, Part B(3)).
- If you began an audit and had not finished it by , finish it under the rules that applied before ; an audit you begin by may also follow those rules (Section 3a).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The decree creates no offence and sets no penalty of its own; sanctions are those of Act 69/2018.
Who enforces it
Enforcement body
Národný bezpečnostný úrad (National Security Authority), the authority that issues the decree under Section 32(1) of Act 69/2018.
Settledness
- As of
What this law does
Decree 493/2022 of the National Security Authority on cyber security audit (Vyhláška Národného bezpečnostného úradu o audite kybernetickej bezpečnosti) was approved on , promulgated on and took effect on . Decree 493/2022 repealed Decree 436/2019 on cyber security audit and the knowledge standard of the auditor.
Decree 212/2026 of the National Security Authority, approved on and promulgated on , amended Decree 493/2022 with effect from . A certified cyber security auditor under Section 29(3) of Act 69/2018 answers for the correctness and completeness of the final report on the results of an audit.
The final report of an audit states compliance, partial compliance or non-compliance with the requirements on the security of networks, information systems and operational technologies. An audit must be carried out and finished by the end of the third calendar year after the year the last audit ended, or by the end of the fifth calendar year for an essential-service operator that does not run a critical basic service and does a self-assessment every two years under Section 29(8) of the Act.
An audit is also carried out at each significant change, at the latest within six months after the change has a significant effect on the security measures in place. The self-assessment is carried out every two years, and its report is submitted by the end of the calendar year in which it is carried out. The 2026 amendment added to Section 2 that the self-assessment report is submitted to the Authority through the unified cyber security information system.
The 2026 amendment also added to Section 2 that an audit ends when the final report is handed to the operator and lasts at most 12 consecutive months. A request for an audit gives at least the particulars Annex 1 lists, among them whether the operator runs a critical basic service and the number of its information systems classed as ICT or OT.
An audit begun and not finished by is completed under the rules that applied before the 2026 amendment, and an audit begun by may also be carried out under them.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .