- Hana Skoupá
- 5 min read
Cybersecurity training is one of the security measures required by the Cybersecurity Act. The specific requirements are set out in implementing decrees according to the regime of obligations. Beyond regular employees, top management, administrators and people in security roles must each be addressed separately. What should mandatory training cover, how do the requirements differ between the lower-tier and higher-tier regimes, and how often does training need to be repeated?
Who needs cybersecurity training?
The decrees don’t simply split employees into “trained” and “untrained”. They distinguish between roles and set training requirements accordingly.
Employees (users)
What should training cover: Safe behaviour, accounts and passwords, phishing and social engineering, handling email, devices and data, reporting suspicious events, and other topics relevant to their work.
Top management
What should training cover: Their own obligations, the security policy and accountability for cybersecurity management. In the higher-tier regime, also risk management, the information security management system (ISMS) and business continuity.
Administrators
What should training cover: Specialist theoretical and practical training matching their job responsibilities.
Security roles
What should training cover: Specialist training tailored to the specific role and responsibilities. In the lower-tier regime, the person responsible for cybersecurity must complete specialist training without undue delay, unless they can demonstrate their expertise in another way. In the higher-tier regime, the cybersecurity manager must be trained for the role and have at least three years of experience. Further training is driven by the organisation’s current needs.
The decree for the lower-tier regime lists security awareness topics such as multi-factor authentication, social engineering, secure electronic communication, cloud services, BYOD, current threats and incident response procedures. However, organisations select the topics that are relevant to them – they don’t have to cover the entire list regardless of their environment.
In the higher-tier regime , the core security awareness topics stay largely the same. What changes is the greater emphasis on tailoring training to each person’s specific job and responsibilities. The decree requires not only instruction on the security policy, but also the necessary theoretical and practical training for users, administrators and security roles. For security roles, it additionally requires regular specialist training based on the organisation’s current needs.
The lower-tier and higher-tier regimes have different requirements
In the lower-tier regime, organisations must set up security awareness rules for top management, users, administrators and the cybersecurity officer. The decree requires onboarding and regular training, plus any necessary specialist theoretical and practical training for administrators and the responsible person, based on their work. Organisations must also keep a record of completed training and a list of trained staff.
The higher-tier regime goes further. Organisations draw up a security awareness plansetting out the format, content and scope of training. On top of the training itself, they must regularly assess employees’ security awareness based on their roles and evaluate how effective the training programme is.
In other words, the higher-tier regime requires more detailed management of training, with its effectiveness evaluated separately. In the lower-tier regime, effectiveness is assessed as part of the annual review of all measures in place.
How often do employees need training?
Let’s clear up a common misconception: the decrees do not impose a blanket obligation to train all employees once a year. They require onboarding and regular training. Each organisation must decide on the specifics based on its security needs, employee roles and other circumstances. But once you record the interval in your security documentation, you must stick to it and be able to prove it.
For example, a company with a few dozen office staff might give regular employees onboarding training when they join, followed by an annual refresher. Administrators, the person responsible for cybersecurity or management, however, will need different content and often a different training format too. Likewise, you may need to add training when someone changes roles, when a new system is introduced, or after an incidentthat exposes a specific weakness.
Handle top management training separately
Top management isn’t just another group of employees you can send the same course to. Even in the lower-tier regime, they must demonstrably complete onboarding and regular training on their obligations and the organisation’s security policy.
In the higher-tier regime, training must also cover the information security management system, risk management and business continuity. Management needs enough knowledge to judge which cyber risks the organisation faces and how they could affect the regulated service, what measures are being proposed, and where their decision is needed.
Training content should therefore match the managerial role. Management needs to know what they are accountable for, which obligations they can’t simply hand off to IT or the security team, what information they should receive regularly, and when they need to step in. They should also understand how decisions are made on risk acceptance, priorities, the security budget, and ensuring continuity during an outage or incident.
At Cybrela Academy, we offer a dedicated course for management covering both the lower-tier and higher-tier regimes of the Cybersecurity Act, available in Czech, English and German. We can also deliver the training live and tailor it to your organisation.
What to check in your existing training
If you already train your employees, you don’t automatically need to rebuild everything because of the new law. What matters is checking whether your current training matches people’s roles and the requirements that apply to them.
- Do you distinguish between regular users, top management, administrators and people in security roles?
- Does the training content reflect what each group actually does?
- Do employees know your internal rules and procedures, not just general cybersecurity principles?
- Do you have both onboarding and regular training in place?
- Can you prove who completed training, when, and what it covered?
- Has top management been trained separately, in line with their legal obligations?
- Do you have security awareness rules (lower-tier regime) or a security awareness plan (higher-tier regime) in place?
- Has the cybersecurity officer, or the cybersecurity manager, completed appropriate specialist training?
