NIS2 Directive: What Czech Businesses Need to Know

What Is the NIS2 Directive?

The NIS2 Directive (EU 2022/2555) is the European Union's updated framework for network and information security. It replaces the original NIS Directive from 2016 and significantly expands the scope of organisations that must comply with cyber security requirements.

For businesses operating in the Czech Republic, NIS2 was transposed into national law through the Cyber Security Act (zákon o kybernetické bezpečnosti), bringing enforceable obligations that took effect in late 2024.

Who Is Affected?

NIS2 applies to a much broader range of organisations than its predecessor. The directive distinguishes between essential entities and important entities:

Essential Entities

• Energy (electricity, oil, gas, heating)
• Transport (air, rail, water, road)
• Banking and financial market infrastructure
• Healthcare
• Drinking water and wastewater
• Digital infrastructure (internet exchange points, cloud providers, DNS)
• Public administration (central government level)

Important Entities

• Postal and courier services
• Waste management
• Manufacture of certain products (medical devices, chemicals, food, electronics)
• Digital providers (online marketplaces, search engines, social networking platforms)
• Research organisations

Medium-sized and large organisations in these sectors are required to comply. In some sectors, smaller entities may also be included.

Key Obligations Under NIS2

Affected organisations must implement a set of minimum cyber security measures, including:

• Risk analysis and information system security policies
• Incident handling — detection, response, and reporting
• Business continuity and crisis management (backups, disaster recovery)
• Supply chain security — vetting suppliers and service providers
• Network and system security — access controls, patching, asset management
• Multi-factor authentication (MFA) across critical systems
• Encryption of data at rest and in transit
• Security awareness training for staff

Incident Reporting Requirements

NIS2 introduces strict incident reporting timelines:

1. Within 24 hours — early warning to the national authority (NÚKIB in Czech Republic) when you become aware of a significant incident
2. Within 72 hours — incident notification with initial assessment
3. Within 1 month — final incident report with full details and remediation steps

Failure to report in time carries significant penalties.

Penalties for Non-Compliance

The potential fines are substantial:

• Essential entities: up to €10 million or 2% of annual global turnover (whichever is higher)
• Important entities: up to €7 million or 1.4% of annual global turnover

Senior management can be held personally liable, and reputational damage can be severe.

How Securac Can Help

Our team of certified cyber security consultants has deep expertise in NIS2 compliance. We can help you:

1. Assess your current position — gap analysis against NIS2 requirements
2. Build a compliance roadmap — prioritised, practical action plan
3. Implement technical and organisational measures — hands-on support
4. Prepare for regulatory review — documentation and evidence packs
5. Train your team — security awareness aligned to your NIS2 obligations

Next Steps

If your organisation falls within the NIS2 scope, now is the time to act. The regulatory window has closed — compliance is now mandatory.

Contact our team for a free NIS2 readiness assessment and find out exactly where your organisation stands.