When we offer a security project at this time of year, we often hear that the company will not manage it before the year ends. That is a reasonable answer, because a year that is already running is not rebuilt for a new agenda. There are two catches. Deadlines under the Czech cybersecurity act do not follow the calendar year and every company has a different date from which they run. And if nothing is decided in November, next year starts with another round of working out where to begin.
This text is written for owners and directors of small and medium companies who want security in their plan and budget for next year, but do not want to spend more than a few hours on it.
Deadlines do not start in January
Act No. 264/2025 Coll. on cybersecurity, the Czech transposition of the NIS2 directive, has been in force since 1 November 2025. A company that meets the conditions for registration of a regulated service must notify the National Cyber and Information Security Agency (NUKIB) no later than 60 days from the day the conditions were met (Section 6 (1)). The agency then issues a registration decision, and the remaining deadlines run from the day that decision is served:
- contact and supplementary data within 30 days (Section 11 (1)),
- the duty to introduce and carry out security measures starts no later than one year after service (Section 13 (4)),
- the duty to report cybersecurity incidents starts no later than one year after service (Section 15 (4)).
What often gets lost in discussions about deadlines is that the one year period does not run from the date the act entered into force, but from service of the registration decision. Two similar companies can therefore have dates six months apart. If you already hold a registration decision, the date it was served is the single most important input for the whole plan for next year.
The content of the measures is set out in implementing decrees: Decree No. 409/2025 Coll. for the regime of higher obligations and Decree No. 410/2025 Coll. for the regime of lower obligations. The act itself lists the areas of measures in Section 14. The lower regime has thirteen of them, from asset management and risk management through access and identity management to cryptographic algorithms.
Whether a company provides a regulated service is something the company assesses itself under the act. The Czech cybersecurity act calculator and the guide to the new act on the NUKIB portal give a first orientation. We help with the security side of regulation. We do not provide binding interpretation of the act, nor do we assess whether a particular company falls under it.
What can be decided now
When the clock started for us
Three questions for the IT team and for whoever collects official post. Did we notify our regulated service? Do we have a registration decision and on which day was it served? Which regime of obligations are we in? Until you have these three facts together, any plan is only a guess.
Who leads it
In both regimes the act works with requirements on top management and with assigned responsibilities (Section 14). In practice that means the name of the person who owns security and an agreement on how many hours a week they have for it. That person does not need to be a security specialist. They need to be someone who can say no and who has the time. The decision takes a few minutes, and without it nothing else gets done.
Three budget lines instead of one project
Instead of one large item, put three in the budget. The first is finding out where you stand, that is an assessment against the decree and against common practice. The second is the first measures that come out of that assessment as the most important. The third is running cost: records, training, licences and the time of the people that security consumes every month, whatever the project is called.
If you do not know yet what belongs in the second line, that is fine. The first line exists precisely to find out. What matters is that all three are in the budget. A budget that contains only a one off project runs out mid year, and the rest of the agenda stays with people who are already full.
What can wait
Anything that gets done twice when priorities are unknown can wait: new tools and licences, a penetration test of the whole infrastructure, certification against ISO/IEC 27001, a large network segmentation project. These are not bad things, they just should not be first.
What should not wait is the work that is useful regardless of regulation and that costs a decision and some time rather than an investment:
- a backup you have actually tried to restore from, with the date of the last restore test,
- an overview of who holds administrator rights in the network and where multi factor authentication is missing,
- a list of assets and of suppliers who can reach your data and systems,
- one page saying who calls whom when an incident happens.
Incident reporting has short deadlines under the act: an initial report without undue delay and no later than 24 hours after the incident is detected, for significant incidents a notification within 72 hours and a final report no later than 30 days after that notification (Section 16). Once the duty applies to you, there is no time left to invent the procedure.
How to pick the first step
Two questions that management can answer without the IT team:
- What would stop the company if it did not work for three days? In a manufacturing company it is usually production control, dispatch or order intake. This is where business continuity and a tested recovery belong.
- What do clients and regulators ask for? Security questionnaires from large customers and requirements in contracts show what you will have to evidence. This is where records and documentation belong.
Only third in line comes the question of what the company lacks against the decree. That is what a security maturity assessment is for: it establishes the current state against a recognised framework (NIST CSF, ISO/IEC 27001, CIS Controls) with a link to the Czech cybersecurity act, NIS2 or DORA, and its output is a list of gaps with priorities. The service is described on the security assessment page.
Three hours of management time in November
One hour on scope and deadlines, one on priorities, one on budget and ownership. The output is not a strategy, but three sentences in the plan, one name and one number in the budget. That is enough for January to start with work rather than with another search for a starting point.
If you are not sure where the first step belongs in your case, we can go through it in an initial consultation, which is free of charge. Write to us through our contact page.
Sources: Act No. 264/2025 Coll. on cybersecurity, deadlines and the list of security measures · Decree No. 409/2025 Coll., security measures in the regime of higher obligations · Decree No. 410/2025 Coll., security measures in the regime of lower obligations · NUKIB portal, guide to the new cybersecurity act