NÚKIB: What is the National Cyber and Information Security Bureau?

NÚKIB - The National Cyber and Information Security Bureau is the central administrative authority of the Czech Republic responsible for national cybersecurity. Established in 2017 as the successor to the NBÚ's cybersecurity department, it has since become a key player in the country's digital security landscape. For companies required to comply with NIS2, the NÚKIB is the body that handles registration, conducts inspections and imposes sanctions.

What does NÚKIB do specifically?

The scope of activities of NÚKIB is broad. The authority fulfils several key roles simultaneously:

• Regulator and supervisory authority - The National Cyber and Information Security Bureau supervises compliance with obligations under Act No. 264/2025 Coll. (implementation of NIS2 into Czech law). It may initiate an inspection, issue a binding instruction or impose sanctions.
• National CERT - NÚKIB operates CERT.cz and GovCERT.cz, which coordinate responses to cyber incidents. In the event of a large-scale attack on critical infrastructure, it takes over coordination of rescue measures.
• Training and awareness - The Office issues guidelines, recommendations and warnings, and organises courses and training for companies and public administration. It also operates the Nukib.gov.cz platform with freely available materials.
• Inter-ministerial coordination - NÚKIB cooperates with security agencies (BIS, Police of the Czech Republic), ministries and international partners (ENISA, NATO CCDCOE).
• Management of NIS2 entity registration - Companies and organisations required under Act No. 264/2025 Coll. Register directly with NÚKIB via the online portal.

NÚKIB and NIS2: A Key Connection

Act No. 264/2025 Coll., which implements the EU NIS2 Directive into Czech law, has significantly strengthened the powers of NÚKIB. The Office has become the primary regulator for approximately 6 000 Czech companies and organisations in critical and important sectors.

Specifically NÚKIB within the framework of NIS2:

• Accepts and processes registrations of regulated entities.
• Maintains the register of obligated entities
• Accepts reports of cyber incidents (within 24 hours of detection).
• Carries out on-site and remote inspections.
• Issues binding instructions for remediation
• Imposes sanctions: up to 250 million Kč for essential entities and up to 125 million Kč for important entities.

Which sectors does NÚKIB regulate?

NÚKIB supervises entities in two categories according to the annex of Act No. 264/2025 Coll.:

Highly critical sectors (key entities): energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space.

Critical sectors (key entities): postal and courier services, waste management, production, manufacturing and distribution of chemicals, production and distribution of foodstuffs, manufacture of medical devices, electronics, machinery and motor vehicles, and digital service providers.

If your business operates in any of these sectors and exceeds the threshold values (50+ employees or EUR 10 million turnover), you are likely subject to a registration obligation. Small businesses below these thresholds are generally exempt, with the exception of entities providing critical services, regardless of size.

NÚKIB issues warnings and recommendations

In addition to its regulatory role, NÚKIB actively publishes safety information. On the website nukib.gov.cz you will find:

• Safety warning - current information on threats, vulnerabilities and attack campaigns targeting the Czech Republic
• Recommendations and methodologies - practical guides for implementing security measures
• Annual reports - overview of the cyber situation in the Czech Republic for the previous year
• Regulatory documents - laws, implementing decrees, technical standards

Monitoring of NÚKIB warnings should be part of every company's security programme. If NÚKIB issues a warning about a specific vulnerability, regulated entities are obliged to take adequate measures.

How does NÚKIB inspect companies?

NÚKIB inspections are carried out in two forms. Remote inspection includes review of documentation, questionnaires and technical reports. On-site inspection It is a physical visit involving an audit of systems, processes and documentation.

Before commencing an inspection, NÚKIB usually informs the company. Exceptions apply in cases of suspected serious violations or in response to a reported incident. The outcome of the inspection may be:

• Report with no findings (all in order)
• Recommendations for remediation (non-binding)
• Remedial measure (mandatory, with deadline)
• Administrative proceedings leading to a sanction

What does this mean for your business?

If you are a regulated entity under NIS2, NÚKIB is your regulator, just as ČNB is for banks or ČTÚ for telecommunications. It is therefore not enough to implement security measures merely formally. During an inspection, NÚKIB will verify whether the measures actually work and whether they are appropriate to the risks of your organisation.

Key steps to prepare for a potential inspection by NÚKIB:

1. Complete registration in the NÚKIB system (if you are a mandatory entity)
2. To have a processed risk analysis and security policy
3. Keep safety measure documentation up to date
4. Have incident reporting processes in place (internal and to NÚKIB).
5. Continuously train employees

More about the registration process can be found in our article. Registration in the NÚKIB system: a guide for companies. For more details on the relationship between NIS2 and NÚKIB, see the article. NIS2 and NÚKIB: how they are related.