What your company must comply with by the end of 2026: NIS2 checklist

Act No. 264/2025 Coll. On cybersecurity entered into force in October 2025. Regulated entities: approximately 6,000 companies and organisations in the Czech Republic, are required to gradually meet the requirements set out by the Act and Implementing Decree No. 409/2025 Coll. Deadlines vary according to the entity category, but 2026 is a key year for implementation for most companies.

This checklist covers four main areas: organisational measures, technical measures, documentation and registration with NÚKIBEach item refers to specific requirements of Decree No. 409/2025 Coll.

Are you unsure whether the law applies to you at all?

First verify whether your company is a regulated entity under Act No. 264/2025 Coll. Use the free online audit at secureon.cz nis2ok.cz - result within 10 minutes.

1. Organisational measures

Organisational measures form the foundation of NIS2 compliance. Without a properly established organisational structure and clear responsibilities, neither technical nor documentation requirements can be effectively met.

Organisational measures

A Cybersecurity Manager (MKB) with the corresponding qualification in accordance with Decree 409/2025 Coll. Has been appointed. MKB must meet qualification requirements. Alternative: external contractor according to NIS2Manager.cz.

The company's management has been trained on legal obligations and the personal liability of the statutory body. Act No. 264/2025 Coll. Introduces direct liability of management for the state of cybersecurity.

Roles and responsibilities in cybersecurity are defined across the organisation. Who reports what, who decides what, and who is the contact person for NÚKIB.

A process for assessing and approving safety measures has been introduced by management. Regular reports to the MKB management, approval of the security strategy.

Analysis of the supply chain completed, assessment of key suppliers with regard to cybersecurity. Supply chain security is an explicit requirement of Decree No. 409/2025 Coll.

All employees have completed basic cybersecurity training (phishing, safe behaviour). The decree requires regular training: at least once a year.

2. Technical measures

Technical measures under Decree 409/2025 Coll. Cover network security, access management, cryptography, monitoring and recovery after an incident. This is the broadest area with the greatest potential impact on IT infrastructure.

Technical measures

Multi-factor authentication (MFA) has been implemented for all privileged accounts and remote access. Priority No. 1, accounts without MFA are a critical security risk.

All network access points are managed and documented, and network segmentation has been implemented. Critical systems must be isolated from the standard office network.

Patch management implemented, system and application updates are carried out regularly and documented. Define an SLA for critical patches (e.g., a critical vulnerability requires a patch within 72 hours).

Data encryption at rest and in transit, sensitive data and communications are encrypted. TLS 1.2+ for transmissions, disk encryption for data at rest.

Backup of critical systems and data, backups are tested, stored separately and are recoverable. 3-2-1 rule: 3 copies, 2 different media, 1 off-site. Test recovery at least twice a year.

Security monitoring (SIEM or equivalent) is deployed, logs are centralised and retained for at least 12 months. Without logging tools, compliance cannot be demonstrated and incidents cannot be investigated.

A penetration test or vulnerability scan of key systems has been carried out. Pentesting at least once a year for essential entities, recommended for all.

Third-party access managed, separate accounts, restricted permissions, logging. Vendor access management is a critical area where numerous incidents occur.

3. Documentation

Decree No. 409/2025 Coll. Explicitly requires a set of documents that the regulated entity must have available and update regularly. Without documentation, compliance cannot be demonstrated, even during an inspection by NÚKIB.

Mandatory documentation

Risk Assessment Report (RAR), current, approved by management, covering all key assets. The RPA must be updated at least once a year or following any significant change to the environment.

Cybersecurity policy: approved by management and distributed to employees The overarching document defining the company's commitments in the field of CB.

Cybersecurity Incident Response Plan What to do in the first 24 hours after detecting an incident, who informs whom, and when to report to NÚKIB.

Activity Recovery Plan (Business Continuity Plan / Disaster Recovery Plan) RTO and RPO for critical systems, recovery procedures, responsibilities.

Asset inventory, complete list of hardware, software, data and process assets with classification Without an inventory, a risk analysis cannot be carried out nor can an overview of critical systems be demonstrated.

Security policies for specific areas: access rights, cryptography, remote work, mobile devices Subsidiary policies build on the overarching KB Policy and address specific scenarios.

Contracts with key suppliers include security requirements (SLAs, obligation to report incidents, rights audits). Supply chain security: suppliers must meet your security standards.

4. Registration with NÚKIB

The obligation to register with the National Cyber and Information Security Authority (NÚKIB) is one of the first specific duties arising from Act No. 264/2025 Coll.

Registration and communication with NÚKIB

Legal analysis completed, confirmed whether the company is a critical or important entity under Annex I or II of the Act. Without legal confirmation, you risk either unnecessary compliance or neglecting your obligations.

The company is registered in the NÚKIB Portal (portal.nukib.gov.cz), including completion of all mandatory details. Registration is a legal obligation. Deadlines depend on the entity category, do not miss them.

A contact person for communication with NÚKIB is designated (available 24/7 for reporting incidents). NÚKIB requires a contact available outside working hours for urgent incidents.

I am familiar with the procedures and deadlines for reporting cyber security incidents to NÚKIB. The law requires reporting serious incidents within 24 hours of detection (early warning) and submitting a full report within 72 hours.

Registered for communication with GovCERT.cz (the Czech Government Security Team) GovCERT distributes alerts on current threats relevant to regulated entities.

What are the next steps?

If you have ticked off fewer than half of the items, we recommend immediately launching a structured gap analysis process. Start by a free online audit on nis2ok.cz, which will show you priority areas within 10 minutes. For an in-depth gap analysis and the preparation of an action plan, contact us. SecureOn.czIf you need a certified cybersecurity manager, visit secureon.cz. NIS2Manager.cz.