NIS2
Cybersecurity for companies and organizations under NIS2
The EU NIS2 Directive and the new Czech Cybersecurity Act fundamentally change the approach to cybersecurity in the Czech Republic. It is no longer just about technical measures, but about systematic risk management, management accountability and the ability to respond to security incidents.
NIS2 affects both public administration and private companies in key sectors of the economy. Organizations must demonstrate that they have an overview of their assets, risks, supply chain and security incidents.
XEVOS helps organizations get through NIS2 in a clear and practical way – from the initial impact assessment and the design of measures to their actual implementation and long-term support.
Regulated sectors and services:
22 sectors / 107 services
The new obligations will affect (10× more than before):
over 12,000 entities
Time to implement the measures after the NÚKIB decision:
12 months
Directive (EU) 2022/2555
What is NIS2
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union.
It sets minimum cybersecurity requirements for companies and organizations operating in significant sectors.
In the Czech Republic, it is implemented by Act No. 264/2025 Coll., on Cybersecurity. The details are set out in the implementing decrees of NÚKIB (the National Cyber and Information Security Agency): No. 408/2025 Coll. on regulated services, and No. 409/2025 Coll. and No. 410/2025 Coll. on security measures for the higher and lower obligations regimes.
NIS2 · Act No. 264/2025 Coll.
Do NIS2 and the new Cybersecurity Act apply to you?
The new act significantly expands the range of obligated entities. It applies mainly to medium-sized and large companies in 22 sectors and to parts of public administration.
We will help you verify whether the act applies to you and under which regime, and prepare the steps to meet your obligations.
The new act in numbers
2014 · Act No. 181/2014 Coll.
1 Nov 2025 · Act No. 264/2025 Coll. (NIS2)
the original Cybersecurity Act
replaces Act No. 181/2014 Coll., introduces NIS2 and expands the range of obligated entities
Regulated sectors
22
107 regulated services
Obligation regimes
2
lower and higher obligations
What regulated entities must do
- Notify NÚKIB
- Implement security measures according to their regime
- Report significant incidents
- Ensure management accountability
Registration with NÚKIB
The registration deadline has passed. Have you notified NÚKIB?
Organizations that met the criteria on 1 November 2025 had 60 days to notify their regulated service via the NÚKIB Portal. This deadline expired on 31 December 2025. No one receives a notice under the act, so every organization has to check for itself whether it is regulated. If you have not registered yet, now is the time to put it right. If a company meets the criteria only later (e.g. through growth or a new service), it has 60 days from meeting them to submit the notification.
In February 2026, NÚKIB publicly pointed out that even after the deadline, not all regulated entities had notified it, and warned them of the risk of legal penalties.
Who the new obligations apply to
The lower obligations regime applies to less critical entities that also fall under NIS2, but whose impact on society is not as significant. They must implement basic security measures and meet reporting obligations, but to a simpler extent.
The higher obligations regime applies to organizations in critical sectors where a cyber incident could seriously affect the functioning of the state or society. These companies must meet stricter security requirements, manage risks regularly and undergo audits.
How can you tell whether the NIS2 Directive and the new Cybersecurity Act apply to you?
1. Sector
Whether a company falls under NIS2 depends on whether it operates in a sector that the directive designates as important or critical. The more essential the sector is for the functioning of the state, the higher the level of obligations.
2. Company size
The size of an organization is only one of the criteria. Whether it is regulated, and under which regime, depends primarily on the type of service it provides and on the conditions of Decree No. 408/2025 Coll. Some organizations are regulated regardless of their headcount or turnover.
3. Type of service
Whether an organization falls under the higher or lower obligations regime is determined primarily by the service it provides. The list of regulated services and their assignment to regimes is set out in Decree No. 408/2025 Coll. on regulated services.
Incident reporting
You have only 24 hours for the first incident report
Regulated entities must report significant cyber incidents to NÚKIB within fixed deadlines. Without round-the-clock monitoring, meeting the 24-hour deadline on a Friday evening is almost impossible.
Our Security Operations Center monitors your systems 24/7, detects incidents in time and helps you with the reporting.
24 h
Initial report
Initial report of the incident to NÚKIB from the moment it is detected, including weekends and public holidays.
72 h
Incident notification
Incident notification with details of the impact and indicators of compromise.
30 days
Final report
Final report on the incident.
It’s not just about IT
What NIS2 changes for company management and suppliers
01
Management accountability
NIS2 moves cybersecurity from the IT department to the management level. The statutory body is responsible for approving security measures and overseeing their implementation.
02
Penalties
Failure to meet the obligations may result in a fine of up to:
CZK 250 million
or 2% of worldwide annual turnover · higher obligations regime
CZK 175 million
or 1.4% of turnover · lower obligations regime
03
Supply chain
The obligations also cover the security of suppliers who have access to your systems and data.
Even if your company is not directly regulated, your customers may require you to meet NIS2 requirements.
Trust the experts
How we can help
- Help with self-assessment
- We’ll guide you through the directive and help you decide whether the new obligations apply to you and what they will mean for you.
- Audit
- We’ll assess the current state of cybersecurity in your company and identify where it already meets the requirements of the directive and where new measures are needed.
- Solution design
- We’ll propose specific measures that meet the requirements of the Czech act and the NIS2 Directive, are easy to implement and are cost-effective.
- Solution implementation
- We’ll put the specific measures into practice in your organization.
Why choose us
- We have an expert team specializing in NIS2
- We have been following NIS2 closely since its preparation in the EU
- We have specialized in cybersecurity for businesses since 2008
- We’ll give you our immediate and full attention
- We’ll design the solution best suited to your company in terms of industry, processes and budget
Petr Letocha
Cyber Security Center Manager
NIS2 specialist
Just call or email us
We’ll discuss whether the Cybersecurity Act applies to you, under which regime, and what steps lie ahead.
Need help with NIS2?
We’ll make your cybersecurity compliant with NIS2 and the Czech Cybersecurity Act.
We’ll help you meet your obligations under the NIS2 Directive and the Cybersecurity Act No. 264/2025 Coll. – from checking whether the act applies to you and registering with NÚKIB to implementing security measures.