Security governance
Organisation: [complete] · Owner: [complete] · Approved by: [complete]
Effective from: [complete after approval] · Review: [complete]
Scope and objectives
Define services, assets, data and dependencies. Establish whether the organisation provides a regulated service under Czech Act No. 264/2025 and which regime applies. A customer’s supply-chain requirement is different from direct statutory regulation.
Selecting controls
| Area | Decisions and evidence |
|---|---|
| Assets and owners | Purpose, criticality, dependencies and accountable owner |
| Access | Least privilege, strong authentication, review and offboarding |
| Vulnerabilities | Alert sources, impact assessment, remediation priorities and exceptions |
| Cryptography | Approved protocols, configuration, keys and update process |
| Records and monitoring | What is logged, who responds, proportionate retention and protection |
| Suppliers | Required contractual and technical evidence, dependencies and exit process |
A particular protocol, scan frequency or patch deadline should not be labelled a universal NIS2 requirement without justification. Choose technical standards using current authoritative guidance, risk and applicable law. Maintain parameters in a controlled configuration appendix.
Continuity and recovery
Assess outage impact and set a recovery time objective (RTO) and recovery point objective (RPO). Define backups, protection, separation and regular recovery tests. A test must demonstrate restored service and data, not only that a backup exists.
Incidents and changes
Connect monitoring to the incident procedure. For significant changes, verify new dependencies, permissions, logging, recovery and rollback. Tailor training to roles and practical risks.
Checking effectiveness
Assign an owner, evidence and next review to each control. Internal audits, penetration tests and certification address different questions. Derive scope and frequency from risk and the specific commitment; this template does not impose universal ISO 27001 certification or a fixed certification date.
NIS2 and Czech requirements · Audit and monitoring
Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.