NIS2 and the Czech Cybersecurity Act, evidenced.

The deadlines we work to

A regulated service has to be notified to NÚKIB within 60 days of the day the organisation met the conditions for registration (Section 6(1) of Act No. 264/2025 Coll.). Security measures and incident reporting then apply at the latest one year from the day the registration decision is delivered (Sections 13(4) and 15(4)).

Security measures as controls

The measures under Article 21 of NIS2 are controls in the platform, each with an owner and evidence, mapped at the same time to ISO 27001 and GDPR.

• Risk analysis and security policies (Art. 21(2)(a))
• Incident handling (Art. 21(2)(b))
• Supply chain security (Art. 21(2)(d))
• Cyber hygiene and training (Art. 21(2)(g))

Incidents recorded as they happen

The security-incident workflow records every step, so the material for reporting builds up while the incident is handled, not after it.

Where it fits

NIS2, ISO 27001 and ISO 37301 management is part of the Institutional plan.