Implementation of Cybersecurity: What We Protect and by What Rule

employee training,

software protection of networks, clouds, applications, data, and information,

database and infrastructure security,

mobile device security (phones, tablets),

physical security of information,

operational security,

data backup,

data recovery after an attack.

self-identification - each provider itself assesses whether it provides a regulated service; the state no longer designates it,

registration - the regulated service must be reported to NÚKIB via the Portal within 60 days of meeting the conditions,

security measures - to be implemented within 12 months of the registration decision (Decrees No. 409, 410/2025 Coll.),

incident reporting - initial report within 24 hours, update within 72 hours, final report within 30 days,

penalties - up to CZK 250 million or 2 % of the annual global turnover.

ISMS is an information security solution in IS.

ISMS is a continuous process whose individual activities are repeated.

ISMS is an integral part of a company’s information system and overall security system.

defined information assets are protected,

information security risks are managed,

implemented security measures are controlled.

identifying, assessing, and managing risks associated with information assets,

procedures for detecting, reporting, and resolving security incidents,

plans to ensure continuous operation in the event of a cyber attack or other disruption,

regular training of employees on current threats and security procedures.

protection against malware and unauthorized access,

protection of sensitive information using cryptographic algorithms,

regular backup of important data in case of loss or damage,

monitoring and detection of unusual activity on the network,

regular updates of software and systems to fix vulnerabilities.

The organizational security measures cover the following areas:

Asset management

Risk management

Supplier management

Human resources security

Change management

Acquisition, development, and maintenance

Access management

Cybersecurity event and incident management

Business continuity management

Cybersecurity audit

Physical security

Communication network security

Identity management and verification

Access rights management

Detection of cybersecurity events

Event logging

Evaluation of cybersecurity events

Application security

Cryptographic algorithms

Ensuring the availability of the regulated service

Security of industrial, control, and similar specific technical assets

ISMS, top management, security roles, policy and documentation management — §§ 3-6, modules 02, 03

Asset management, risk management — §§ 7-8, modules 01, 02

Supplier management, human resources security — §§ 9-10, module 03

Change management, acquisition / development / maintenance, access management — §§ 11-13, module 04

Event and incident management, business continuity, cybersecurity audit — §§ 14-16, modules 04, 06

Physical security, network security, identity management, access rights management — §§ 17-20, modules 04, 05

Detection, event logging, evaluation of events, application security — §§ 21-24, module 05

Cryptographic algorithms, availability, industrial and control systems — §§ 25-27, modules 04, 05

Creation of security documentation

Introduction of security processes and roles

Implementation of specific mechanisms

Introduction of security checks — audit

the security role responsible for ensuring the development, use, and security of the asset; the roles are detailed in Asset Roles below. ISO/IEC 27002:2022, control 5.9

Asset inventory (CZ: katalog aktiv)

Asset classification (with confidentiality, integrity, availability ratings)

Evaluation of the (importance of) primary assets

Assets are publicly accessible or intended for publication. A breach of asset confidentiality does not jeopardize the legitimate interests of the obligated person.

When sharing such assets with third parties and using classification according to the traffic light protocol (TLP), the TLP:WHITE designation is used. No protection is required.

Disposal/deletion of assets at the Low level

Assets are not publicly accessible and constitute the know-how of the obligated person; protection of assets is not required by any legal regulation or contractual agreement.

When sharing such assets with third parties and using classifications according to TLP, the designations TLP:GREEN or TLP:AMBER are mainly used. Access control measures are used to protect confidentiality.

Disposal/deletion of assets at the Medium level

Assets are not publicly accessible and their protection is required by law, other regulations, or contractual agreements (trade secrets, personal data).

When sharing such assets with third parties and using classification according to TLP, the TLP:AMBER designation is primarily used.

Measures are used to protect confidentiality, ensuring control and recording of access. Information transfers via communication networks are protected using cryptographic measures.

Disposal/deletion of assets at the High level.

Assets are not publicly accessible and require a higher level of protection than the previous category (strategic trade secrets, special categories of personal data).

When sharing such assets with third parties and using TLP classification, the TLP:RED or TLP:AMBER designation is primarily used.

Measures are used to protect confidentiality, ensuring access management and logging. Furthermore, protection methods prevent misuse of assets by administrators. Information transfers are protected using cryptographic means.

Disposal/deletion of assets at the Critical level.

the value of the asset (especially in terms of confidentiality),

the technology of the asset, types and sizes of information carriers,

whether the information carrier is under the control of the organization or not,

whether the data is part of a dedicated or multi-tenant environment,

who will perform the data disposal,

availability of disposal equipment and tools.

capacity of the media being disposed of,

whether trained personnel are available,

time required for disposal,

cost of disposal with regard to tools, training, validation, reuse of the information carrier,

possible methods of data disposal,

applicable methods of data disposal with regard to the condition of the information carrier.

the information asset carrier and

the disposal level (Low, Medium, High, Critical)

Printed documents , notes , etc.

Mobile phones , tablets

Network devices; routers, switches, modems

Office equipment; scanners, printers

Magnetic tapes, floppy disks, hard drives

Optical media: CD, DVD, Blu-ray

Flash memory