Act No. 264/2025 Coll., effective from November 2025, imposes new obligations on thousands of Czech companies. I will ensure all NÚKIB requirements are met, as your external or internal cybersecurity manager with certification in accordance with Decree No. 409/2025 Coll.
The new cybersecurity law applies to thousands of companies in the Czech Republic. Find out if you are among them. regulated entities and what your obligations are towards NÚKIB.
Large companies in key sectors of Annex I: energy, transport, healthcare, digital infrastructure, banking, water management, public administration and others.
Medium and large companies in the sectors listed in Annex II: postal services, waste management, manufacturing, chemical industry, food, digital markets, science and research, and others.
The law is complex and fine for failure to register or non-compliance with obligations reaches up to 250 million Kč or 2 % of annual global turnover (basic subjects).
Free check: 30-minute consultationComplete coverage of obligations under Act No. 264/2025 Coll.: from the initial analysis to ongoing compliance management.
I act as your certified external or part-time cybersecurity manager. You will meet the legal requirement to have a designated CISO without incurring the costs of an internal employee.
We will determine how your company stands in relation to the requirements of NIS2 and Decree No. 409/2025 Coll. You will receive a clear report with a prioritised remediation plan.
Technical, procedural and legal implementation in accordance with Decree 409/2025 Coll., risk management, network security, cryptography, physical security, access control.
Complete preparation of mandatory documentation: Risk Assessment Report (RAR), Business Continuity Plan (BCP), Incident Management Policy and other documents as required by law.
Practical training for management (legal liability, strategy) and employees (phishing, safe behaviour, incident reporting). Meets the requirements of Decree No. 409/2025 Coll.
I will prepare your company for an inspection by the National Cyber and Information Security Bureau (NÚKIB). Internal audit, identification of deficiencies and their rectification before the deadline. No unpleasant surprises.
I am Ing. Vít Vomáčko: an IT expert with more than 20 years of experience in information technology and a certified cybersecurity manager under the new Czech legislation.
I pride myself on a clear approach: cybersecurity isn't just for technicians. Management must understand the risks and legal obligations. I always speak your business language, not IT jargon.
A structured process from the initial consultation through to ongoing compliance management with NIS2.
We will call or meet up. I will gather basic information about your company, sector, size, existing security measures. I will assess whether the law applies to you and how urgent the situation is.
Detailed analysis of compliance with the requirements of Act No. 264/2025 Coll. And Decree No. 409/2025 Coll. The result is a clear report: what is in order, what is missing, and what is most critical.
Based on the GAP analysis, I will prepare a realistic implementation plan with priorities, deadlines and cost estimates. Management will approve the scope of cooperation and the method of financing.
Systematic implementation of security measures, preparation of documentation (ZHR, POA, policies), training of employees and management, and technical securing of infrastructure.
As your KB manager, I continuously monitor legislative changes, report incidents to the NÚKIB, update documentation and prepare you for potential inspections. You are always in compliance with the law.
Answers to the most common issues companies face regarding NIS2 and Act No. 264/2025 Coll.
The law applies to companies in regulated sectors (energy, transport, healthcare, banking, digital infrastructure and others) that exceed the size threshold. There are also exemptions and specific rules. The most reliable approach is a free consultation. I will assess your case specifically and at no cost.
The fine for non-compliance with Act No. 264/2025 Coll. Depends on the entity category. For basic entities (BE) can reach up to 250 million Kč or 2% of annual global turnover, for important entities (IEs) up to 100 million Kč or 1.4% of annual global turnover (always the higher of the two values applies). The Act also introduces personal liability for the statutory body, management may be fined directly regardless of the company's liability.
It depends on your company's current status. Basic compliance (registration, appointment of the CISO, gap analysis and priority measures) can be achieved within the timeframe. 3-6 months. Complete implementation of all security measures in accordance with Decree No. 409/2025 Coll. Usually takes 6-18 months.
External KB manager is significantly cheaper than an internal employee (the average salary at MKB is 80-120 thousand Kč/month plus contributions and benefits). Additionally, you gain a specialist with broader experience from various companies, flexible scope of cooperation and immediate availability. Act 264/2025 Coll. Explicitly allows an external KB manager.
ENISA ECSF (European Cybersecurity Skills Framework) is the European framework for cybersecurity competencies. Decree No. 409/2025 Coll. Requires that a cybersecurity manager meets defined professional requirements. My ENISA ECSF certification fulfills this statutory requirement, guaranteeing you a competent specialist, not just a consultant.
I tailor the cooperation precisely to your company's needs: a one-off project (GAP analysis, documentation) or an ongoing retainer (NIS2 Manager as a monthly service). I set the price after a free initial consultation where I determine the actual scope. Contact me for a non-binding quote.
Comprehensive NIS2 compliance solutions for Czech companies: from a free initial audit through expert consultancy to a certified CISO.
Free online NIS2 audit in 10 minutes. Find out if your company falls under Act No. 264/2025 Coll. And where you have security gaps. Suitable as a first step before consultation.
Start a free audit →Compliance cannot be maintained with a one-off effort. After implementing measures, operations begin: continuous vulnerability scanning and round-the-clock SOC/MDR monitoring. Find vulnerabilities before attackers do, on the internet provider's infrastructure operating 24/7.
Vulnerability management & SOC →Authorised Fortinet partner, supply, implementation and management of FortiGate firewalls. NIS2-ready network security: NGFW, VPN, SD-WAN, network segmentation in accordance with Act No. 264/2025 Coll.
FortiGate implementation →Practical information on cybersecurity, NIS2 and Act No. 264/2025 Coll.
The Cybersecurity Act applies to thousands of Czech companies from November 2025. We provide a clear guide on how to determine if you are a regulated entity and what to expect.
Read the article →What specific penalties face companies that fail to comply with Act No. 264/2025 Coll.? What is the personal liability of the statutory body? And what can management do right now?
Read the article →What is the real difference in costs, availability and quality? We compare both options so that management can make an informed decision.
Read the article →Request a consultation
Please provide some details about your company. I will get back to you within 24 hours with a proposal for the next steps: no obligation.
30 minutes to give you clarity. You will find out:
No obligation. No pressure. Just factual information from a certified expert.
The next step on the path to NIS2
The KB Manager is a key step. See what else you need.