Organisations that have received a registration decision from the Czech national cyber security authority face one practical question before all the others: who will actually run security for them. The decrees implementing Act No. 264/2025 Coll. name the role, but nowhere do they say whether it has to be filled by an employee or by an external specialist. The decision therefore sits with the management board, and it usually has to be made now, while budgets and headcount for next year are being prepared.
This text is not here to sell one option. It describes what the role requires, how much work it involves and what to decide it by.
What the decrees actually require
Higher obligations regime
Decree No. 409/2025 Coll. requires top management to appoint people to four security roles: cybersecurity manager, cybersecurity architect, asset guarantor and cybersecurity auditor (Section 4(4)). For the manager and the architect, management must also ensure that a deputy is in place (Section 4(5)).
The cybersecurity manager is charged with running the information security management system. The person must be trained for the role and must demonstrate professional competence through at least 3 years of experience with managing cybersecurity or information security (Section 5(1)). The manager is responsible for regularly informing top management and is a mandatory member of the cybersecurity management committee, which meets at least once a year and keeps a written record (Section 4(3)).
Lower obligations regime
Decree No. 410/2025 Coll. does not use the manager role in this form. Management appoints a person responsible for cybersecurity and gives that person the powers to manage and develop security, to oversee its state and to communicate with management. That person either completes professional training without undue delay or demonstrates professional knowledge of cybersecurity (Section 4). Management itself must complete training as well.
The deadline: the obligation to implement and carry out security measures must be met no later than 1 year from the day the registration decision is delivered (Section 13(4) of Act No. 264/2025 Coll.). The clock starts with the decision, not with the effective date of the Act.
An external specialist is a legitimate choice
In its supporting material on security role requirements (version 1.1 of 21 April 2026), the authority states that people appointed to security roles do not have to be in an employment or similar relationship with the regulated service provider. The role may therefore be performed by an external specialist. Two points are worth noting: an external manager must know the environment of the organisation well enough and must have real authority to perform the role, just like an internal manager, and requirements on education and certification should be covered in the contract. Responsibility does not move anywhere through outsourcing: the duties of top management remain in place.
What the role actually does
Behind the wording of the decrees sits a fairly ordinary list of work:
- Runs the implementation and operation of security measures and tracks what is done and what is slipping.
- Maintains the risk assessment and the risk treatment plan and revisits them after significant changes.
- Owns the security policy and documentation, including review cycles and staff acknowledgement.
- Takes part in supplier selection and in security clauses in contracts.
- Coordinates incident handling and reporting.
- Prepares materials for management, for audits and for a possible inspection by the authority.
- Keeps the training and security awareness plan running.
Most of this work is not technical. It is management, writing, and dealing with suppliers and with the board. That is why the role does not automatically fit the best administrator on the team, even though that person knows the environment best.
How much work the first year takes, and how much after that
The first year is a peak. Scope, asset inventory, risk assessment, a set of policies and procedures, supplier rules and contract clauses, training plans and records all have to be created. A large part of this is done once and then only maintained.
Routine operation follows an annual rhythm with fixed deadlines. In the lower regime, the overview of security measures is updated at least once a year, including an evaluation of their effectiveness, and the individual overviews are kept for at least 4 years. In the higher regime, the effectiveness of the information security management system is evaluated at least once a year and a review report is produced, the committee meets and the audit runs according to plan. In between come incidents, changes and supplier questions that cannot be scheduled.
The difference between the first year and routine operation matters for the decision: sizing the role permanently around the first year peak is wasteful, and sizing it around quiet operation means the first year will not be finished in time.
Your own person
In favour: the person knows the environment, the people and the history of decisions. Availability is daily, not contractual. The role grows with the organisation and can absorb related agendas. For an organisation that intends to run security on its own in the long term, this is the target state.
What to account for: the requirement of training and at least 3 years of experience narrows the pool of candidates, and recruitment for such a position is rarely a matter of weeks, while the deadline from registration keeps running. One person alone also does not satisfy the deputy requirement that the higher regime sets out explicitly. And if that person is also the head of IT, they end up reviewing their own work.
An external role
In favour: available immediately, experience and training can be evidenced and required in the contract, the supplier team covers deputising, and someone from outside looks at your IT and at your suppliers. The scope can follow the phase of the programme, one level in the first year and another in routine operation.
What to account for: an external manager knows your environment only as well as you show it, and the role does not work without regular contact with management and with IT. Availability during an incident belongs in the contract, not in goodwill. An external manager will usually be a significant supplier, so the role belongs in your own supplier management and contract clauses. And you will need someone internal anyway: a person who decides, opens doors and secures cooperation.
What is better kept separate
For the cybersecurity auditor, the decree builds on impartiality and on the audit independently assessing the correctness and effectiveness of the measures in place (Section 16). The authority adds in its material on security roles that the person responsible for the course of the audit should not at the same time perform the role of cybersecurity manager or architect.
The second separation is not written down as explicitly, but it follows from common sense and from inspection practice: whoever designs and operates the measures should not also be the one confirming that they are fine.
For supplier selection this gives a simple rule. Over the same area, one supplier may either implement measures or audit them. Not both. This holds even when keeping everything with one supplier is cheaper.
Which option suits whom
| Situation | What usually makes sense |
|---|---|
| Lower regime, working IT, no security agenda so far | An internal appointed person with a written mandate and genuinely increased capacity, with external support for the first year |
| Higher regime, no security role exists yet | An external role now because of the running deadline, with internal recruitment as the goal for the next period |
| Higher regime, an internal candidate with experience is already there | An internal manager, with deputising and architecture or audit brought in from outside |
| An audit or inspection is coming within a year | An external role for speed, with an internal counterpart for cooperation and decisions |
| Operations with industrial or production technology | Internal knowledge of the plant cannot be replaced, methodology and documentation can be added externally |
This is not a table to decide by without thinking. It is a starting point for the first discussion at board level.
Three questions that matter more than price
- Who will have the role in writing, and what powers come with it? A mandate without access to management and without a budget is just a name in a document.
- Who will stand in when that person is unavailable for two weeks? The higher regime requires it, and in the lower regime you will need it anyway.
- Who will check the result? If the answer is the same name as to the first question, you have an impartiality problem.
Once you can answer these three questions, the choice between hiring and an external role becomes mainly a question of capacity and budget. How our external security leadership works is described on the service page, and if you are weighing the two paths, we will go through your situation in an introductory consultation.
One final note. Determining which regime your organisation falls under, and what duties follow from that, is a matter of legal interpretation. We cover the security side of the work; the legal analysis belongs to lawyers.
Sources: Decree No. 409/2025 Coll., security roles and requirements on top management · Decree No. 410/2025 Coll., person responsible for cybersecurity · Act No. 264/2025 Coll. on cybersecurity, deadlines under Section 13 · Supporting material on security role requirements, version 1.1