Observa: cyber security and compliance with NIS2 and DORA in one place

The Czech Cybersecurity Act (Act No. 264/2025 Coll.) and its implementing decrees are in force, the act is how the Czech Republic implements the NIS2 directive, and financial institutions deal with the DORA regulation on top of that. What regulators want is reasonably clear: know your services and assets, know your risks, assess your suppliers, report incidents within set deadlines and be able to evidence all of it.

The harder part is the state of the records. Assets in one spreadsheet, risks in another, supplier questionnaires in a mailbox, policies in a folder and review dates known only to one colleague. When an audit or a regulatory question arrives, evidence is collected from five places and nobody is sure it is current. Observa was built for exactly this situation.

Asset records of a sample organisation: regulated services and assets in one tree.

What Observa is and who it is for

Observa is a Czech web application for managing cyber security and regulatory compliance, the field known as GRC (governance, risk and compliance). It runs as a cloud service, so there is no server to install or operate. You keep records of regulated services and assets, risks, incidents, suppliers, policies and people, you assess how well you meet regulatory and standard requirements, and you produce evidence for management, auditors and regulators.

It is used by organisations in scope of the Czech Cybersecurity Act and NIS2, by small and mid sized financial institutions under DORA, by companies preparing for ISO/IEC 27001 certification, and by IT service providers who manage compliance for several clients. We do not assess on your behalf whether a regulation applies to your organisation. We do help with preparing for the obligations that follow from it.

The regulatory profile decides what applies to you

A new organisation starts with a four step wizard that sets the regulatory profile: sector, size, main regulation and regime (the Czech Cybersecurity Act in its higher or lower regime, DORA, ISO/IEC 27001, another regulation, or undecided for now). Based on the profile, Observa selects the default assessment framework, incident reporting deadlines and recipient, supplier requirements, asset terminology and the legal citations used in reports. You do not have to read through the whole legislation and pick the relevant parts by hand.

The application contains 11 frameworks with more than 970 requirements and over 1,800 links between them. Assessment frameworks for the Czech Cybersecurity Act, DORA and GDPR are included in every plan and are never a paid add on. Professional adds two further frameworks of your choice, Enterprise all of them plus custom frameworks.

The modules in brief

• Asset inventory and impact analysis. Regulated services, primary, supporting and technical assets, a map of dependencies, impact assessment, documents and recovery plans, vulnerabilities, hardening rules, licences and data location. All plans.
• Risk management. Risk register, treatment and controls, scheduled reviews and risk reports. All plans.
• Suppliers and the supply chain. Supplier register with requirements based on your regime, contracts, questionnaires, reviews, data location and ICT provider data structured as required by the DORA register of information. From the Professional plan.
• Incidents and reporting. Incident records with a journal that cannot be rewritten, deadlines by severity, a prefilled reporting draft and a proposed incident classification under DORA. From the Professional plan.
• Policies and methodologies. Security policies with approval, versions and staff acknowledgement (from Professional) and methodology documents generated from your own settings (all plans).
• Security maturity and frameworks. Gap assessment of requirements, statement of applicability, and framework to framework mapping in Enterprise. All plans.
• People and identities. People and technical identities, teams, key security roles required by the decree with a check on incompatible roles, training and document acknowledgement. All plans.
• Change management. Approval and deployment of IT changes so that the security review is not forgotten. From the Professional plan.
• Tasks and alerts. Corrective actions with owners and due dates, automatically created tasks, in app and e-mail alerts and a daily digest. All plans.
• Reports. PDF outputs for management, auditors and regulators, more than 50 templates. From the Starter plan.
• AI assistant. Chat over your records and summaries. It only reads records, changes nothing, and sees only what the signed in user can see. Its answers are not legal advice. Professional and Enterprise.
• Trust Center. A page where you show customers and partners how you handle security. All plans, publishing from Starter.

Over the coming weeks each module gets its own article and we will add the links here.

Risk map of a sample organisation by likelihood and impact.

What Observa does on its own

People always make the decisions. The application prepares the groundwork and reminds you of deadlines, so that nothing surfaces for the first time during an audit.

• Raises risks from the gaps it finds. For most customers this is the single most useful part: a risk no longer appears only when somebody remembers it in a workshop. Observa raises risks on its own wherever it finds a gap in your records, for example an asset with a known vulnerability, an expired licence or a setting that does not match the decree. Required supplier documentation missing? A risk is raised automatically and closes itself once the gap is filled. Gaps from the maturity assessment, vulnerabilities without a risk and suppliers, changes and incidents without a risk sit in their own tabs in the risk register, where a risk is created with one click. Missing documents and overdue dates therefore become a register entry with an owner and a date, not an audit finding.
• Links the assessment frameworks to each other. The requirements of the act, DORA, ISO/IEC 27001 and other frameworks largely overlap. Observa holds more than 1,800 links between them, mapped onto 144 shared controls, so an answer to one requirement automatically proposes answers for related requirements in the other frameworks, and a new assessment can be prefilled from an assessment you have already completed. Each proposal shows the strength of the link (exact, partial, related topic) and you accept or reject it. A proposal never overwrites your own manual answer. You do not answer the same question five times. Framework to framework mapping is in the Enterprise plan.
• Sets requirements from your profile. The regulatory profile determines which requirements, deadlines and methodologies apply to you.
• Watches supplier reviews and dates. A nightly check creates tasks for upcoming reviews and moves a supplier with an overdue review to the Under review state.
• Calculates incident deadlines. Based on severity it sets response and resolution deadlines, prefills a reporting draft in the structure of the national authority form, and for financial institutions proposes a classification under the DORA implementing rules (RTS 2024/1772). It does not submit the report for you.
• Generates methodologies. Methodology documents are produced from your settings. When you change scales or settings, Observa flags that an issued document is out of date.
• Reminds you of dates. A digest of upcoming reviews, contracts, certificates and training arrives by e-mail instead of living in a calendar.
• Collects acknowledgements. People confirm training and policy acknowledgement from an e-mail link, with no account needed. The record stays with the person and with the document.

Gaps from a maturity assessment that Observa turns into risks.

Connecting to the systems you already run

Observa is not meant to replace your tools, it is meant to know about them. You can start by importing from an Excel workbook or CSV file, covering assets, services, risks, suppliers, tasks, incidents, people and maturity assessment answers. A file check first shows what will be created, changed and skipped. Import, export and PDF outputs are available from the Starter plan.

From the Professional plan you get a REST API, webhooks and an export of audit events to your SIEM. In practice this means new servers from your inventory system appear in the asset register on their own, scanner findings can be loaded continuously, a security event from the SIEM can open an incident, and an incident can be handed over to Jira or ServiceNow with status synchronisation. Enterprise adds sign in with your corporate identity (SSO) and account provisioning from your directory (SCIM). Policies, methodologies, maturity assessment, People and identities, Trust Center and the AI assistant have no API and are used through import, export and links.

Trust Center as an answer to customer questionnaires

If you supply regulated companies yourself, you know the other side of this: every customer sends its own questionnaire and asks for policies, certificates and a list of subprocessors. Trust Center is a page at trust.observa.cz with your organisation name where you show all of this once. It has sections for Overview, Compliance, Controls, Processed data, Documents, Subprocessors, FAQ and News, and it takes content from your records in Observa, so nothing is written twice.

Only what you select and publish leaves the application. The page can be internal, limited to your IP ranges, limited to selected e-mail addresses and domains, or public. Documents can be offered on request, where the visitor verifies an e-mail address and accepts a non disclosure agreement, access is time limited and can be revoked at any time (Professional and Enterprise). Risks, assets, vulnerabilities, incidents and maturity results are never published.

Three common questions

Do we have to tidy up our spreadsheets first?

No. A usual start is to import what you have, even if it is incomplete. Observa then shows what is missing and the gaps are filled over time. The file check before an import tells you what will be created and changed, so nothing is overwritten by accident.

Is DORA a paid add on?

It is not. Assessment frameworks for the Czech Cybersecurity Act, DORA and GDPR are in every plan. The Incidents, Suppliers, Policies and Change management modules start with the Professional plan. For ICT service providers we keep data structured as required by the DORA register of information, but Observa does not produce the register submission for the regulator.

Who will work with it?

Usually one to three people who run security, plus the owners of individual assets, risks and tasks. Permissions are set per module, so an asset owner sees their own records without access everywhere. External consultants have a separate partner access whose scope you define.

Security and operations

Data is encrypted in transit and at rest, including the database. Files and attachments are stored encrypted with a key for each organisation and every download is written to the audit trail. Organisations are separated from each other, two factor authentication is in every plan and single sign on is in Enterprise. The audit log records sign ins, record, permission and setting changes and exports, and it cannot be edited or deleted in the application. The service runs in data centres in the European Union.

Plans and prices

Prices are shown excluding VAT. What each plan contains is listed in the Observa pricing (in Czech).

Scope of features by plan. Prices are listed in the Observa pricing.

Try Observa for free

You can start a trial on the Observa registration page. It runs for 7 days and needs no payment card. The other option is a walkthrough with us, where we go through Observa on your own scope and say which obligations the application covers and which remain work on your side. Interested, or have questions? Get in touch.

Over the coming weeks a detailed article on one module will be published every Monday. The first one covers the asset inventory and impact analysis: where to start, what has to be recorded and how to decide which service matters most to the company.

Sources: NUKIB, Czech Cybersecurity Act and implementing decrees · EUR-Lex, DORA regulation