Czech NIS2 readiness check

Have you appointed a person responsible for cybersecurity?

Top management appoints this person and gives them the necessary authority. Without undue delay, they complete specialist training or demonstrate expertise.

Decree s. 4(a)

Has top management demonstrably completed cybersecurity training?

Top management, meaning the statutory body or people in a similar position, must complete initial and regular training, and the training must be documented.

Decree s. 4(b) and s. 5(2)(a)

Do you have a register of security measures as set out in Annex 1?

For each measure, the register states its status: In place, with a description; In progress, with a date, priority and responsible person; or Not implemented, with a justification.

Decree s. 3(2)(a) and Annex 1

Do you update the register at least once a year, and does management review it?

Each update includes an evaluation of how effective the measures are. You keep the registers for at least 4 years, and management demonstrably reviews the state of implementation.

Decree s. 3(2)(b)–(c) and s. 4(d)

Do you have a security policy and rules for handling technical assets?

You must set out the security policy and documentation, review them regularly and enforce them. The decree does not set a review interval.

Decree s. 3(3)–(4)

Do you keep an inventory of assets related to the regulated service?

The act requires you to identify primary assets, decide whether they relate to the regulated service, identify their supporting assets and record them, including reasons for any exclusions. Assets you have not yet assessed are in scope.

s. 12 of Act No. 264/2025

Do you have a user security policy and rules for creating passwords?

The policy covers the topics in Annex 3 of the decree, such as passwords, multi-factor authentication, social engineering and backups. The awareness rules also cover how to create passwords.

Decree s. 5(1)(a)–(b) and Annex 3

Do users complete initial and regular security awareness training?

The decree requires initial and regular training but does not set an interval. In its explanatory memorandum, NÚKIB recommends at least once a year.

Decree s. 5(2)(b)–(c)

Do administrators and the cybersecurity officer receive specialist training?

The decree requires the necessary specialist training, both theoretical and practical.

Decree s. 5(2)(d)

Do you keep records of training sessions and lists of attendees?

Without records you cannot prove the training took place.

Decree s. 5(3)

Do you check compliance with the security policy and know how to handle breaches?

The decree requires compliance checks and rules for dealing with breaches of the policy.

Decree s. 5(1)(c)–(d)

Do your supplier contracts include the relevant requirements of Annex 2?

This applies to suppliers within the scope of your cybersecurity management. Annex 2 lists, for example, confidentiality, supplier audit rights, subcontracting chains, an exit strategy, incident handling and service levels. When contracting, also consider the supplier’s threats, vulnerabilities and quality of practices.

Decree s. 3(5) and Annex 2; s. 13(5) of the act

Do you set security requirements when buying, developing and maintaining systems?

For planned acquisitions, development and maintenance of technical assets, you must set security requirements and enforce them.

Decree s. 3(6)

Have you set a recovery order and procedures, and do you know who is responsible?

Top management sets the recovery priority of primary assets. For technical assets, you set the priority, order and procedures for recovery and the duties of specific people.

Decree s. 4(f) and s. 6(a)–(b)

Do you regularly back up the data, configurations and settings needed to restore the service?

The decree does not require testing or encrypting backups in the lower regime. Without a test restore, though, you don’t know whether the backups work.

Decree s. 6(c)

Do employees know whom to tell about unusual system behaviour or a suspected vulnerability?

Users, administrators and other employees must report such situations. You must detect and assess incidents.

Decree s. 10(a), (c) and (d)

Do you have a method for deciding whether an incident is significant?

The method sets a tolerable level of harm and assesses the impact on operations, the number of affected users, the resources needed for recovery, the type and location of assets, data sensitivity and the cause. An incident is significant if it exceeds the tolerable harm and is also assessed as significant in one of these areas.

Decree s. 10(b) and s. 14

Do you know how and when to report a significant incident to the National CERT?

In the lower regime, significant incidents are reported to the National CERT through the NÚKIB Portal: an initial report within 24 hours of detection, a notification within 72 hours and a final report within 30 days of the notification.

Decree s. 10(e)–(f); ss. 15–16 of the act

Do you use multi-factor authentication?

For administrators, users and technical assets, the decree requires at least two different types of factors, or continuous authentication based on a zero-trust model. Until then, use cryptographic keys or certificates, and only then passwords.

Decree s. 8(2)–(3)

Do your systems enforce the decree’s password rules?

Where only passwords are used: at least 12 characters for users, 17 for administrators and 22 for technical accounts, no simple or common passwords, a history of at least 12 previous passwords and a change at least every 18 months. Replace default passwords on technical assets with random ones without delay.

Decree s. 8(4)

Do you grant only the access people need and review it regularly?

Everyone has a unique account, a person’s user and administrator accounts are separate, and you review access rights regularly.

Decree s. 7(1)(a) and (d)

Do you adjust access as soon as someone changes role and remove it when they leave?

When a role changes, adjust or remove access without undue delay. When a contract ends, deactivate the account.

Decree s. 7(1)(e)–(f)

Do you have continuous, automatic protection against malicious code?

Especially on servers and endpoints, with regularly updated rules. This also covers inspecting traffic at the network perimeter and restricting autorun from removable media.

Decree s. 9(1)

Do you record security events?

Each record contains the date and time including the time zone, the type of activity, the asset and account involved, and whether the activity succeeded. You decide the retention period based on your needs.

Decree s. 9(2)–(3)

Do you install security updates without undue delay?

You must keep a record of systems no longer supported by their vendor, protect them with compensating measures and restrict their network traffic.

Decree s. 12(a)–(b)

Do you scan for vulnerabilities regularly?

The decree does not set an interval. In its explanatory memorandum, NÚKIB suggests weekly, monthly or quarterly scans, for example. You act on the results proportionately.

Decree s. 12(c)

Is your network segmented and remote access restricted?

Including separating the production and backup environments, limiting traffic at the network perimeter to what is necessary, and allowing remote access only as needed, with confidentiality ensured.

Decree s. 11

Do you use current cryptographic algorithms and secure communication?

The decree refers to NÚKIB’s recommendations on cryptographic means and requires securing voice, audiovisual and text communication, including email, and emergency communication.

Decree s. 13