Cybersecurity Act (according to NIS2)
The new Cybersecurity Act has been in force since 1 November 2025 and introduces new obligations, greater responsibility for management, and real operational impacts. We will verify whether the Act applies to your organisation, prepare the required documentation, and set up measures that reflect how your organisation actually operates. If needed, we can also fully cover the outsourcing of security roles.
What’s changing?
- Thousands of newly affected organisations: While the law previously applied only to a limited number of entities, it now affects thousands of companies across industries. The requirements cover both corporate governance and technical security.
- Two regimes of obligations: The scope of obligations varies depending on the regime you fall under (higher or lower level of obligations).
- Processes and accountability: The organisational side includes defining responsible roles, updating documentation, managing risks and assets, training employees and management, and business continuity planning.
- Tools and technology: The technical side covers areas such as monitoring, access management, system updates, incident response, and supplier security controls.
Will the changes brought by the new law apply to you?
How can we help?
We take it step by step. First, we clarify whether the new law applies to you at all and what it actually means for your organisation. Then we look at your current state – what already works, what you have covered, and where gaps may cause problems.
Based on this, we design measures that fit your operations without slowing you down unnecessarily. We then handle the paperwork: preparing complete documentation and business continuity plans, and assessing security risks related to suppliers and their access to your systems.
Finally, we train management and employees and if you don’t have the capacity to handle everything internally, we can take over part of the obligations – from monitoring legislation to outsourcing security roles and handling incidents.
- By doing a gap analysis, we will verify your company’s current state and prepare a plan for the next steps.
- We will conduct analysis of assets and risks
- We will assess the security risks of your supply chains
- We explain what the new obligations mean and provide training for top management
- We will prepare business continuity plan and all other required documentation
- We will provide outsourcing cyber security manager and other security roles
- If you operate in both the Czech Republic and Slovakia (or have a group structure), you don’t need a different partner for each law. We help you achieve compliance with both Czech and Slovak cybersecurity legislation in a way that makes sense operationally and organisationally.
We take care of your cybersecurity end to end
Kybernetickou bezpečnost řešíme end to end
In cooperation with Gordic we have created a turnkey service that saves you time and effort from risk identification to clear, meaningful documentation. All fully aligned with the Cybersecurity Act, DORA, GDPR, and other regulatory requirements.
You don’t need to know where to start
Just get in touch and we’ll figure it out together.
We start with a consultation
We design the solution
We clarify what applies to you and what doesn’t. We propose a concrete approach so you know exactly what lies ahead, how much it will cost, and how long it will take.
We help with implementation
Mandatory training in cybersecurity made easy with Cybrela Academy
Povinné kyberškolení vyřešíte v Cybrela akademii
Who trusts us?
Frequently asked questions
Co Vás ohledně nového zákona o kybernetické bezpečnosti nejvíce zajímá? Projděte si dotazy, na které se nás v souvislosti s novým zákonem ptáte nejčastěji. Nenašli jste svou odpověď? Mrkněte na blog nebo nám napište na info@cybrela.com.
Who does the new Cybersecurity Act apply to and how can we tell?
The new Cybersecurity Act applies to significantly more organisations than the previous legislation (an estimated 8,000–10,000 entities in the Czech Republic). It also affects organisations that previously had no cybersecurity obligations. Whether the Act applies to you depends mainly on whether you provide a regulated service and meet the criteria defined by the law (such as company size, sector, type of services provided, or holding specific licences).
You can perform a basic free assessment of whether the Cybersecurity Act applies to you using our application URČI.SE. We strongly recommend validating the result with an expert or your company lawyer.
What is a regulated service and how do I know if I provide one?
Regulated services are key services (for example in energy, transport, healthcare, or digital infrastructure) that are considered critical from a cybersecurity perspective and are therefore subject to security requirements under the new Cybersecurity Act. All regulated services are listed in the Decree on Regulated Services. In total, there are 102 regulated services across 22 sectors. If you find a service in the decree that matches what your organisation does (whether as your core business or as part of day-to-day operations) it is likely that the Act applies to you.
In practice, there are also exceptions and specific situations where this may not be obvious at first glance. In some cases, details matter – such as how the service is provided, a combination of activities, or meeting specific parameters (you can read more about these situations here). Before starting implementation, we therefore recommend verifying regulated services with an expert.
What are the main obligations according to the new Cybersecurity Act?
Key obligations include reporting regulated services, reporting contact details of responsible persons, reporting cybersecurity incidents and mplementing security measures.
The scope of security measures depends on the obligation regime you fall under. The higher regime requires stricter and more detailed measures, with a strong focus on systematic risk management. The lower regime focuses on basic protective measures that are now considered a security minimum. A major new requirement introduced by the Act is the obligation for top management to review key security documents and undergo regular training. Other important areas include HR security, access management, business continuity management, and securing communication networks.
What do the obligation regimes mean?
Higher and lower obligation regime are something like two levels of difficulty. The lower regime involves fewer duties, the amount of documentation required is barely half the size and there is one security role to be covered. If you have a skilled IT, you may not even need to hire a new person. In theory, you just need someone to explain the detail of the new obligations.
Organisations under the higher regime must appoint at least three security roles, manage risks, maintain and regularly update more than 20 documents, implement and operate network monitoring systems, and meet many additional requirements.
How long does implementation usually take?
Implementing the new legislative requirements typically takes 6–12 months, depending on the size of the company and its current level of cybersecurity. We recommend starting preparations as early as possible.
How much is the initial consultation?
The initial consultation is free. Its purpose is to understand your situation, the risks you face, and what outcome you need. We will review your current state and discuss how we can help. You can book the consultation via the contact form or simply email us at info@cybrela.com.
Contact us and get your umbrella against cyber threats!
Need help with the new Cybersecurity Act? We’ll help you understand the new obligations and propose an approach that fits into your day-to-day operations.