Organisations that fell under the higher-duty regime of Act No. 264/2025 Coll., the Czech Cybersecurity Act, this year usually have two things ready: an initial gap analysis and a supplier chosen for part of the technical controls. Then comes the question we hear most often in replies. What is actually left to do after the analysis?
The short answer is that a list of findings is not yet a plan. Decree No. 409/2025 Coll. describes a different route from findings to controls: controls are implemented according to a risk treatment plan, which has a prescribed structure. And part of the work stays with your own people, no matter how many suppliers you hire.
What a gap analysis says and what it does not
A gap analysis compares the current state with the requirements of the decree and returns a list of what is missing. That is a good input, but it is not a work order. It does not set priorities, owners, deadlines or resources, and on its own it does not create the link to risks that the decree requires.
Under Section 8(2) of Decree No. 409/2025 Coll., the obliged entity implements security controls in line with the risk treatment plan. Findings from the analysis therefore first feed into the risk assessment, and only from there does a plan emerge. When this step is skipped, the same thing usually happens: tenders are split along the findings, money is spent, and then there is no record of why exactly this work was done and why something else was not done at all.
How findings turn into a plan with priorities and deadlines
Section 8(1) of the decree names the outputs an organisation in the higher-duty regime has to have: a methodology for identifying and assessing risks including criteria for risk acceptance, identification of risks with regard to assets, a risk assessment at least once a year and upon significant changes, a risk assessment report, a statement of applicability and a risk treatment plan.
The risk treatment plan is not a task list. Under Section 8(1)(g) it contains, for each control,
- a description of the control for risk treatment,
- the objectives and benefits of the control,
- the person who will ensure its implementation,
- the expected human, financial and technical resources,
- the required implementation deadline,
- the links between risks and controls, and
- the specific way the control will be delivered.
Only then does a list of findings become a plan. Priorities follow from the risk assessment and from the risk acceptance criteria the organisation sets itself, not from what a supplier has ready to deploy.
The second document that gets forgotten when work is divided is the statement of applicability under Section 8(1)(f). It is an overview of all controls required by the decree, stating which have been applied and how, and which have not, including the justification and any compensating controls. Section 8(4) of the decree explicitly allows an organisation not to apply some controls, but only on the basis of risk management. The statement of applicability is exactly where such a decision is documented.
Under the decree, controls are implemented according to the risk treatment plan, not directly from analysis findings.
What stays with your own people
The decree has a whole section on requirements for top management, meaning the statutory body or persons in a comparable management position. Section 4 sets out several things no supplier will do for you:
- management demonstrably completes training on its duties and on the security policy, in particular in the areas of the information security management system, risk management and business continuity (Sections 4(1)(a) and 10(3)(a)),
- management demonstrably familiarises itself with the review report on the information security management system, the risk assessment report, the risk treatment plan, the results of the impact analysis and the results of audits and inspections (Section 4(2)),
- management sets up a cybersecurity management committee whose members include at least one member of management or a person it authorises and the cybersecurity manager, and ensures it meets at least once a year with a record of the meeting (Section 4(3)),
- management appoints people to the security roles of cybersecurity manager, cybersecurity architect, asset guarantors and cybersecurity auditor, and provides them with the authority and the budget (Sections 4(1)(n) and 4(4)),
- management takes part in preparing the impact analysis and ensures testing of continuity plans, recovery plans and incident response processes (Sections 4(1)(h) and 4(1)(i)).
Section 5 is worth reading on the roles. The cybersecurity manager and the auditor must be trained for the role and prove professional competence by at least 3 years of practice, the manager may not be entrusted with roles responsible for the operation of technical assets, and the auditor may not hold any other security role. The decree does not say that the person in a role has to be an employee, but management appoints that person and the competence and separation of roles must be met. How exactly to fill the roles is the organisation's decision, with a lawyer involved in unclear cases.
Three places where a gap stays between suppliers
When delivery is split into several contracts, the uncovered places do not appear in the technology. They appear in the processes that nobody treats as theirs.
Risk management
A supplier delivers controls, not a process. Agree who owns the methodology and the risk acceptance criteria, who maintains the risk register, who convenes the annual assessment and who writes the risk assessment report and the risk treatment plan. Under Section 8(1)(c) the assessment is carried out at least once a year and in addition upon significant changes, and deploying a new supplier system is a significant change too.
Supplier security
Supplier management has its own set of duties in Section 9: rules for suppliers and demonstrably informing suppliers about them, a register of significant suppliers, demonstrably informing them in writing that they are in the register, contracts containing the provisions of Annex 5, assessment of risks related to the delivery during the tender or before signing the contract, regular checks of the controls in place at the delivery, and review of contract performance. No supplier will do this for you, because it concerns the suppliers themselves.
Incident response
Under Section 14 an organisation must have processes in place for detecting and evaluating events as well as for coordinating and handling incidents, with assigned responsibilities for both. If you have detection from one supplier and operations from another, check three things: who decides that an event is an incident, who files the report under Section 15 of the Act and within what deadline, and who makes these decisions at night and at weekends.
What to put in the tender before the work is divided
- the scope of cybersecurity management and the link between the delivery and the regulated service (Section 12 of the Act),
- which controls of the decree the delivery covers and which parts of them stay with you,
- the outputs the supplier is to hand over into the security documentation, and in what form,
- who keeps the documentation up to date after handover,
- for a significant supplier, the provisions under Annex 5 of the decree,
- the method and frequency of checking the controls in place (Section 9(2)(c)),
- the interface between suppliers: who informs whom in an incident, by what means and by when.
Deadlines the plan has to work with
The Act gives time to implement controls, but not unlimited time. The duty to implement and carry out security controls and the duty to report incidents apply at the latest within 1 year of delivery of the decision on registration of the regulated service (Sections 13(4) and 15(4) of the Act). For reporting an incident with a significant impact, the deadlines in Section 16 of the Act apply: an initial report within 24 hours, notification of the incident within 72 hours and a final report within 30 days of the notification.
On top of that comes the annual cycle the plan must not leave out: a risk assessment at least once a year, a review of the effectiveness of the information security management system with a review report at least once a year (Sections 3(f) and 3(g)) and at least one meeting of the cybersecurity management committee.
Where we can help
We do the security side of the work: the methodology and the risk assessment, the risk treatment plan and the statement of applicability, setting up the processes for suppliers and for incidents, dividing roles and responsibilities, and independent verification of what suppliers have actually put in place. We work as part of your team until the recommendations are really implemented.
What we do not do: interpret the law, assess whether and under which regime an organisation falls, draft contracts or contractual clauses, or deal with the regulator on your behalf. That is for your lawyer and for the responsibility of the statutory body.
If you want to go through what is left after the analysis and in what order to do it, get in touch through our contact page. The initial consultation is free of charge. More about our work on security assessments is on the security assessment page.
Sources: Act No. 264/2025 Coll. on cybersecurity, registration, controls and incident reporting · Decree No. 409/2025 Coll., security controls in the higher-duty regime