New Cybersecurity Act
Expanded framework covering approximately 10,000 entities with sector-specific supervision in energy and transport. Introduces GDPR-like fines up to 2% of turnover and mandatory cybersecurity training requirements.
| Jurisdiction | Czech Republic |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The New Cybersecurity Act introduces several key requirements for covered entities:
- Expanded scope: The Act now covers approximately 10,000 entities, with sector-specific supervision in energy and transport. This represents a significant expansion of regulatory oversight.
- Mandatory cybersecurity training: All employees of covered entities must undergo regular cybersecurity awareness training. This is aimed at improving the human element of cybersecurity defenses.
- GDPR-like fines: Non-compliance can result in fines of up to 2% of global annual turnover, similar to GDPR penalties. This significantly increases the financial risk of non-compliance.
- Risk assessment requirements: Entities must conduct regular cybersecurity risk assessments and implement appropriate controls based on their risk profile.
- Incident reporting: Organizations must report significant cybersecurity incidents to relevant authorities within 72 hours.
Compliance Challenges
Organizations face several common challenges in complying with the New Cybersecurity Act:
- Resource constraints: Many organizations struggle with limited cybersecurity budgets and staffing, making comprehensive compliance difficult.
- Technical complexity: Implementing robust cybersecurity measures across diverse IT environments can be technically challenging, especially for smaller entities.
- Keeping pace with evolving threats: The rapidly changing threat landscape makes it challenging to maintain effective defenses.
- Supply chain risks: Many organizations struggle to ensure cybersecurity compliance across their supply chains, as required by the Act.
Implementation Best Practices
To effectively implement the New Cybersecurity Act requirements, organizations should:
- Adopt a recognized framework: Implement a comprehensive cybersecurity framework like the NIST Cybersecurity Framework or ISO 27001 to ensure a structured approach.
- Conduct regular risk assessments: Utilize tools like the CISA Cyber Security Evaluation Tool (CSET) for comprehensive risk analysis.
- Implement robust training programs: Leverage resources like SANS Security Awareness for employee cybersecurity education.
- Establish incident response plans: Develop and regularly test incident response plans using guides like the NIST Computer Security Incident Handling Guide.
- Engage in information sharing: Participate in Information Sharing and Analysis Centers (ISACs) relevant to your industry to stay informed about emerging threats.
Recent Updates
The New Cybersecurity Act has seen several recent updates:
- Expanded scope: The latest amendment (effective January 1, 2024) increased the number of covered entities from 5,000 to 10,000.
- Enhanced reporting requirements: As of March 15, 2024, entities must now report attempted cyberattacks in addition to successful breaches.
- New sector-specific guidelines: The energy sector guidelines were updated on April 1, 2024, with compliance required by October 1, 2024.
Related Regulations
The New Cybersecurity Act interacts with several other regulations:
- GDPR: There is significant overlap in data protection requirements and penalties, particularly for personal data breaches.
- NIS Directive: The Act builds upon and expands the scope of the NIS Directive, particularly for critical infrastructure.
- CCPA/CPRA: For entities operating in California, there are additional data protection requirements that must be considered alongside the Act.
Industry Impact
The New Cybersecurity Act has significant industry-specific impacts:
- Energy sector: Utilities face stringent new requirements for operational technology (OT) security and supply chain risk management.
- Transport sector: Airlines and rail operators must implement enhanced passenger data protection measures and real-time threat monitoring systems.
- Financial services: Banks and insurers face increased scrutiny of third-party vendors and must implement advanced threat detection capabilities.
Sources
- ENISA NIS Directive Overview
- CISA Cybersecurity Training Resources
- GDPR Fines and Penalties
- NIST Cybersecurity Framework
- ENISA Incident Handling Process
- ISACA Cybersecurity Skills Gap Report
- McKinsey Cybersecurity Trends Report
- World Economic Forum Global Cybersecurity Outlook
- NIST Supply Chain Risk Management Practices
- ISO 27001 Standard
- CISA Cyber Security Evaluation Tool
- SANS Security Awareness Training
- NIST Incident Handling Guide
- National ISACs
- European Commission Cybersecurity Act Press Release
- ENISA Incident Reporting Guidelines
- U.S. Department of Energy Cybersecurity
- California Consumer Privacy Act (CCPA)
- IATA Data Protection Standards
- Bank for International Settlements Cybersecurity Guidelines
Recent developments
- — European Commission presents a **new revised EU Cybersecurity Act** as part of a broader cybersecurity package, aiming to strengthen EU resilience, reinforce ENISA’s mandate, and establish a trusted ICT supply chain security framework with harmonised, risk-based controls.[1][2] (source)
- — Commission’s proposal for the **revised Cybersecurity Act** introduces a renewed European Cybersecurity Certification Framework and mandatory derisking of EU mobile networks from high‑risk third‑country suppliers, significantly tightening cybersecurity requirements for ICT products and services.[2] (source)
- — Alongside the revised Cybersecurity Act, the Commission proposes **targeted amendments to the NIS2 Directive** to simplify compliance and risk‑management obligations, aligning incident reporting and certification with the new Act for companies operating in the EU.[1][2] (source)
- — European Parliament announces a plenary **debate on the revised EU Cybersecurity Act**, highlighting its role in updating the EU’s cyber protection regime and formalising ENISA’s expanded responsibilities amid increasingly complex cyber threats.[6][1] (source)
- — Key provisions of Singapore’s Cybersecurity (Amendment) Act **enter into force**, operationalising expanded reporting within two hours for specified incidents and broadening national‑level response and compliance duties across critical operators and temporary high‑risk systems.[5] (source)
- — Singapore’s **Cybersecurity (Amendment) Act** updates regulations for Critical Information Infrastructure and extends oversight to new regulated entities, tightening incident reporting (including APT‑related events) and imposing stricter cybersecurity measures on systems of temporary cybersecurity concern.[5] (source)
- — Cybersecurity industry stakeholders react to the proposal by highlighting that the Act’s **trusted ICT supply chain framework and ECCF timelines (12‑month default for schemes)** will drive vendors to build security by design, while raising concerns over implementation complexity and readiness in smaller providers.[2] (source)
- — EU policy commentary on the revised Cybersecurity Act underscores its **impact on third‑country ICT suppliers and mobile network vendors**, signalling potential market shifts as high‑risk suppliers are phased out and EU‑wide certification becomes a prerequisite for access.[1][2] (source)
- — Targeted amendment to the existing Cybersecurity Act is **adopted to enable EU certification schemes for managed security services**, covering incident response, penetration testing, security audits and consultancy, which expands the Act’s scope into service‑based cybersecurity offerings.[1] (source)
- — Industry and policy analysis notes that the revised EU Cybersecurity Act will **simplify certification, centralise incident reporting, and increase obligations on telecoms and other critical sectors**, with expectations of higher compliance costs but improved supply‑chain assurance and consumer trust.[2] (source)
Related regulations
- Czech Republic NIS2 Transposition (Cybersecurity Act 2025) — Czech Republic, Active, effective 2025-11-01
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates