New obligations in the field of cyber security in 2024

When will the new rules apply?

Self-identification obligations

The first thing you can do now is to assess whether or not the new obligations will apply to you. If the answer is yes, you are required to self-report to the NCIS within 90 days of meeting the criteria below (or the new cybersecurity law taking effect). Theoretically, it may still be the case that you will not ultimately be subject to the new obligations, simply because the law and decrees are not yet final and the definitions of obligated entities may be refined.

How can you self-identify? First of all, you need to determine whether you fall (with exceptions) into the category of medium or large enterprises (you can read the article by my colleague Mgr. Antonín Hajdušek available here). In the case of a more complex ownership structure of the company, a problem may already arise here. The same rules are used to determine the size as for example for subsidies, if you still do not know what to do, we are of course ready to help you with this as well. Next, you need to assess the content and scope of the activities provided, or whether yours is a regulated service. A regulated service is defined as a service whose disruption could have a significant impact on the security of important social or economic activities, the list and description of which are regulated in the decrees to the Cybersecurity Act.

The most important conclusion for you in the self-identification process will be whether you are classified in the higher or lower obligation regime, with approximately 1,000 obliged entities having to comply with the higher obligation regime and at least 6,000 obliged entities having to comply with the lower obligation regime. These two regimes then affect the range of obligations or measures that will apply to you. If you comply with the higher regime obligations in one regulated service, you will have to comply with them in all your regulated services.

Human resources and their (in)sufficiency

Procuring sufficient staffing in the area of cybersecurity, both in-house and from outsourcing, will also be key. So, whether you align yourself with a regime of lower or higher responsibilities, you need to clearly identify those responsible.

You will need to be careful in the case of a higher duty regime, where you will need to provide much more staffing, especially from the ranks of experts. For example, you will need a cybersecurity manager, a cybersecurity architect or an asset guarantor or cybersecurity auditor. In addition, there are requirements for these persons in terms of experience in the field of cyber security, etc., and it may therefore be very challenging to find such an expert, given the possible wide demand following the discussion of the new draft law.

And what if it does not happen?

There are fines of up to €250 million for breaches of higher obligations. CZK or 2% of net worldwide annual turnover. For breaches of lower obligations, the penalty is up to 175 million or 1.4% of net worldwide annual turnover.

But these are not the only penalties, there are also other sanctions such as suspension of certification, suspension from management, administrative or coercive fines.

Some good advice in conclusion

The first recommendation is to start implementing or at least preparing for these changes well in advance.

• Determine what the gap is between the current state of cybersecurity in your company and the legally required target state.
• Dedicate resources and funding to implement the new obligations.

Experts believe that the obligations arising from the lower regime are the minimum that all companies should comply with. The addressees of cyber-attacks are no longer just the most important companies, but can be anyone. So try to think about how much money you lose if you don't have a functioning e-shop or your production line stops.

If you are unsure about self-identification or anything else in this area, or need legal advice, please do not hesitate to contact us, we will be happy to help.