Practical support with NIS2 and cybersecurity regulation
What does the new Czech cybersecurity law mean for you?
The European NIS2 Directive has been transposed into a new Czech cybersecurity law. For regulated organizations in the Czech Republic, the essential question is therefore not only what the EU directive says, but which specific duties arise under Czech law.
The first step is to determine correctly whether the organization provides a regulated service and which regulatory regime applies. That decision determines the scope of security measures, cybersecurity governance, responsibilities, documentation and incident-handling processes.
From initial assessment to an operational system
VIAVIS helps organizations understand their obligations and integrate them into day-to-day operations. We assess the current situation, identify missing measures, set priorities and develop a practical implementation plan.
The objective is not another set of documents gathering dust. Security measures must fit the actual infrastructure, processes, risks, capabilities and resources of the organization.
Organizational and technical security measures
The new legislation encompasses both organizational and technical controls, such as asset and risk management, accountability, personnel security, access management, business continuity, security-event detection and cybersecurity incident response.
The exact scope depends on the organization’s regulatory regime and environment. VIAVIS therefore designs each solution individually rather than treating compliance as a universal checklist.
Security with measurable value
Applicability and regulatory regime
Assess whether your organization meets the criteria for a regulated service provider and determine the applicable regime.
Current-state gap analysis
Compare existing processes, documentation and technical safeguards with the requirements relevant to your organization.
Implementation roadmap
Define corrective actions, their priorities, responsibilities and dependencies in a practical delivery plan.
Cybersecurity governance
Help establish accountability, security processes, risk management and the required documentation.
Technical security measures
Support the design or verification of monitoring, access controls, logging, backups, continuity and related safeguards.
Ongoing expert support
Continue with audits, outsourced security roles, SOC, penetration testing or ongoing consultations as needed.
Common questions
Are NIS2 and the new Czech cybersecurity law the same?
No. NIS2 is an EU directive. The specific duties of Czech regulated organizations follow from Czech cybersecurity law and its implementing regulations.
How do we find out whether the new law applies to us?
The decisive factors include the type of service provided, statutory provider criteria and other requirements of the legal framework. VIAVIS can perform an initial applicability assessment and propose next steps.
Are there higher and lower regulatory regimes?
Yes. Requirements differ depending on the applicable regime. Identifying the correct regime must precede the design of security measures.
How much time is available to implement the measures?
The Czech National Cyber and Information Security Agency (NÚKIB) states that a one-year transitional period for implementation of security measures and related duties runs from delivery of the registration decision. The specific requirements and deadlines must always be checked against current law.
Can VIAVIS help after implementation?
Yes. Support can continue through outsourced security roles, audits, SOC, penetration tests, risk management and ongoing professional advice.