Governance and responsibilities
Who owns security, who makes decisions, who controls the budget and who communicates during an incident.
[ NIS2 / Czech Act No. 264/2025 Coll. ]
The Act is already in force. Do you know exactly what is required of you?
The new Cybersecurity Act does not apply to everyone in the same way. The service provided, organisation size, sector and obligation regime all matter. We help you correctly define the scope, assess your current position and turn requirements into a concrete plan.
[ The first decision ]
First, you need to know whether the regulation applies to you and to what extent.
Being “an energy company” or “a medium-sized organisation” is not enough. What matters is the specific regulated service, the significance criteria and, in some cases, relationships between linked enterprises.
- 01
Do you provide a regulated service?
We identify the specific service and sector, not just a broad company category.
- 02
Do you meet the significance criteria?
We check size and other criteria for the relevant regulated service.
- 03
Which part of the organisation is in scope?
We define the service, supporting assets, processes and responsible people.
- 04
Which regime applies?
The lower- or higher-obligation regime determines the scope of the resulting requirements.
[ BOIT preliminary assessment ]
Does the new Act apply to you?
Answer four questions. Get an indicative result and a recommended next step without registering.
This is not a legal opinion or a substitute for an official assessment.
[ Registration is the beginning ]
Security does not end with submitting a form.
Regulation affects organisational governance, everyday processes and technical operations. You need a system you can use and demonstrate.
Assets and risks
What the organization protects, which systems support the regulated service, and which risks take priority.
Security measures
Technical and organizational measures suited to both the regulatory regime and the actual environment.
Incidents and continuity
How to recognize, escalate and report an incident, and maintain or restore service delivery.
Suppliers and people
Supply chain security, access management, training and employee preparedness.
[ What you actually receive ]
You leave with a working plan, not just a presentation.
The deliverables must be useful to management, IT and the people responsible for individual tasks.
Scope definition
An overview of regulated services, the affected parts of the organization and the expected regulatory regime.
Gap analysis
What you already have, what falls short of requirements, and what simply needs to be documented or adjusted.
Prioritized plan
Tasks ranked by risk, statutory priority, dependencies and effort.
Responsibility matrix
Who decides, who implements, who checks, and who needs to be informed.
Practical documentation
Policies, procedures and records that reflect how the organization actually works.
Incident response scenario
Contacts, escalation, decision points, reporting and links to business continuity.
[ Where you are now ]
You do not need to buy an entire project when you need one question answered.
Applicability assessment
For organizations unsure whether they fall under the regulation, which services are assessed, or which regime applies to them.
Gap analysis and roadmap
For organizations that have already defined their scope but do not know how far they are from meeting requirements.
Implementation support
For organizations that need to put measures, documentation and responsibilities into practice.
Ongoing readiness
For organizations that want security to continue beyond the end of a project.
[ A task for leadership ]
NIS2 is not a task you can simply forward to IT.
Technology is only one part. Management must decide who is accountable, what takes priority, and how to tell whether the measures work.
Decisions
Which risks we accept, what takes priority, and what resources the organization will allocate.
Accountability
Who owns the security of the regulated service and who checks that measures are implemented.
Readiness
How management can tell that measures actually work, rather than simply existing in the documentation.
[ How we work together ]
We start with how your organization works, before writing policies.
- 01
Scoping
Services, organization, sector, size and current state.
- 02
Scope and regulatory regime
What is regulated, what provides support, and what falls outside the project.
- 03
Gap analysis
People, processes, documentation, technology and suppliers.
- 04
Implementation
Critical gaps first, followed by long-term sustainability.
- 05
Verification
Checking evidence, responsibilities and how measures work in practice.
[ Your guide to the legislation ]
We work with current sources. Not a presentation from 2023.
Rules and supporting materials are continually updated. The authoritative sources are the Act, implementing regulations and official NÚKIB guidance.
[ Frequently asked questions ]
What you need to know before you start.
01How do we know whether we provide a regulated service?
This depends on the specific service, sector and significance criteria defined by the Act and implementing decree. The preliminary assessment above points you in the likely direction; a definitive conclusion must account for the organizational and technical context.
02What is the difference between the lower and higher obligation regimes?
The regimes differ in the scope and detail of obligations, security measures and incident reporting. The specific regime is determined by the regulated service provided and the conditions applicable to it.
03Do we have to buy new security software?
Not automatically. We first assess existing measures and actual gaps. A new tool only makes sense if it addresses a specific requirement or risk and the organization can operate it over the long term.
04Can you build on ISO 27001 or existing documentation?
Yes. We do not start from scratch if you already have a functioning management system, security policies or risk records. We reuse existing materials and add only what is needed.
05Do you provide a legal opinion?
BOIT focuses on cybersecurity, practical implementation of measures and technical readiness. If the situation requires a formal legal opinion, we recommend involving a legal specialist.