Internal vs. External manager
cybersecurity: comparison

Act No. 264/2025 Coll. On Cybersecurity requires every obligated organisation to appoint a cybersecurity manager (MKB) with the appropriate qualifications. The Act explicitly allows this role to be fulfilled by an external provider such as NIS2 Manager, available at nis2manager.cz. internal employee and external specialist.

Which option to choose? Let's look at the key criteria.

Costs: a significant difference in the real price

KB Internal Manager

The average gross salary of a certified cybersecurity manager in the Czech Republic is around 80 000 - 120 000 Kč per month. To this, add:

• Employer contributions (~34%): 27,000-41,000 Kč/month.
• Benefits, company laptop, mobile: 5 000 - 10 000 Kč/month.
• Ongoing training and recertification: 30,000-80,000 Kč/year
• Recruitment and onboarding: 50,000-150,000 Kč one-off

Actual annual costs: 1 500 000 - 2 200 000 Kč

External KB Manager

The cost of an external KB manager depends on the scope of cooperation and the size of the company. Typical models:

• Retainer (monthly flat rate): 15,000-45,000 Kč/month depending on scope
• Project collaboration (GAP analysis, documentation): from 50 000 Kč as a one-off fee
• No deductions, no benefits, no onboarding

Actual annual costs: 180 000-540 000 Kč

Availability and flexibility

Internal employee It is available every day during working hours. This is an advantage for large organisations with intensive KB agenda. However, it can also be overloaded with operational tasks and lose track of current threats.

External manager offers flexibility: the scope of collaboration adapts to current needs. During implementation, it can work more intensively; in quieter periods, fewer hours suffice. It is not tied to a single company, so it maintains an overview of situations across various sectors.

Expertise and up-to-date knowledge

Cybersecurity is a field where threats change day and night. An internal employee can easily fall into a "tunnel": seeing only one company's environment and failing to keep up with new trends.

An experienced external KM manager works with multiple clients across various sectors. They see what works (and what doesn't) in practice and bring current know-how to your company.

When is an internal CISO preferable?

An in-house employee makes sense in these cases:

• Large organisation (500+ employees) with extensive IT infrastructure
• A company in critical infrastructure with a very strict security agenda.
• Organisations where the physical on-site presence of a Key Management Board member is legally required.
• A company that needs an MKB as part of its internal team to build a compliance culture.

When is an external Key Bank Manager preferable?

The external variant is optimal for:

• Medium-sized companies (50-500 employees) are subject to mandatory compliance under NIS2.
• Companies that need to quickly meet legal obligations without lengthy recruitment.
• Organisations where the KB agenda is not a daily priority but is required by law.
• Companies seeking to optimise costs while maintaining quality

Conclusion

For most companies required under Act No. 264/2025 Coll. External KB manager significantly more advantageous - lower costs, immediate availability and broader expertise. The law explicitly supports this option.

As a certified KB manager under Decree 409/2025 Coll. And ENISA ECSF, I offer precisely this model: an external expert who will handle all your company's NIS2 affairs. Contact me for a non-binding quotation.