One of the most frequent questions I hear from companies: How much will this cost us? The answer depends on what you already have in place, but with real figures from practice, you can get an idea in advance.
Why do costs vary so much?
The scope of investment in NIS2 depends on three main factors:
- Current level of security - A company with ISO 27001 is 70-80% done. A company without any security policy starts from zero.
- Entity category - Basic entities have stricter requirements than important ones.
- Size and complexity of IT - number of systems, employees, locations and suppliers.
Below we provide indicative ranges for a medium-sized company (50-150 employees) without prior formalised security measures.
Overview of cost items
| Item | Estimated cost | Note |
|---|---|---|
| GAP analysis | 40 000-120 000 Kč | Depends on the scope of IT; 2-4 weeks |
| KB Manager: first year | 120 000-300 000 Kč | Internal: higher, external: lower |
| Documentation and policies | 30 000-80 000 Kč | Templates vs. Bespoke Solutions |
| Technical measures | 80 000-500 000 Kč | Firewall, EDR, MFA, backups: as required |
| Staff training | 20 000-60 000 Kč | E-learning + 1 live practical session |
| Penetration test | 40 000-150 000 Kč | Recommended, mandatory for basic entities |
| Total (first year) | 330 000-1 210 000 Kč | Average for medium-sized companies: ~600 000 Kč |
From the second year onwards, costs drop significantly: the GAP analysis is no longer required and most documentation is already in place. What remains is the ongoing KB manager (80-150 thousand Kč/year), refresher training and any necessary audits.
Internal vs external CISO: which is cheaper?
The law requires the named cybersecurity manager. You have two options:
KB Internal Manager
Existing employee with supplementary training or new recruitment.
- Labour costs: 80 000-130 000 Kč/month (gross salary + contributions)
- Certification training: 60,000-120,000 Kč as a one-off payment.
- Available on-site
- Risk: devotes time to other business areas as well.
Annual cost: ~1 000 000-1 700 000 Kč
External KB Manager
Certified specialist on a part-time basis.
- Flat rate: 15,000-40,000 Kč/month
- No recruitment, no conscription, no dismissal.
- Immediate knowledge of legislation
- Experience from multiple companies
Annual cost: ~180,000-480,000 Kč
For the vast majority of medium-sized companies, External KB manager more cost-effective - Savings compared to internal recruitment amount to 500,000-1,000,000 Kč annually. More on the comparison in the article Internal vs. External Cybersecurity Manager.
How to reduce costs for technical measures
Technical measures are the most variable item. Where companies unnecessarily "overdo it":
- New NGFW firewall - if you have older equipment, upgrading to a FortiGate or Sophos XGS costs between 80,000 and 200,000 Kč. There is no need to purchase the highest-end series.
- MFA - Microsoft Entra ID or Duo Security costs hundreds of Kč per user annually, not thousands.
- EDR/XDR - solutions such as Microsoft Defender for Endpoint (part of M365 Business Premium) significantly reduce the need for additional purchases.
- Deposits - The 3-2-1 rule is the standard; Veeam or Acronis for SMBs costs tens of thousands annually.
The key is first a GAP analysis. You know exactly what to buy and what you do not need. Without it, companies spend money on duplicate or unnecessary solutions.
Fine versus implementation: simple maths
Act 264/2025 Coll. Stipulates fines up to 10 million Kč or 2% of global turnover for important entities, for basic entities up to 250 million Kč or 2%. Even with a conservative estimate:
- A company with a turnover of 100 mil. Kč: maximum fine 2 000 000 Kč
- NIS2 implementation: 330,000-600,000 Kč (first year)
- The average implementation is 4-6 times cheaper than a single fine - not counting reputational damage and personal liability of the management.
Important: personal responsibility of management
Act 264/2025 Coll. Allows for direct sanctions to be imposed. individuals in management positions - managing directors, members of the board or CEOs, if NÚKIB proves neglect of supervision. Maximum fine for individuals: 5 million Kč.
Don't waste time: first steps free of charge
If you are unsure where to begin, the first steps are free of charge:
- Start free online audit at NIS2OK.cz - find out whether and in which category you fall under the law.
- Request a quote a non-binding consultation - We will review your current situation and estimate the actual scope of implementation.
- Based on this, you will receive a specific quotation: with no hidden costs.
Find out the real costs for your company
30-minute consultation free of charge. No obligation, specific figures for your case.
Non-binding consultation →