NIS2 | ISMS Requirements

Overview of Information Security Management System requirements under NIS2.

How to read the Czech requirements: Determine the scope under § 12 of the Cybersecurity Act and the applicable regime for each service. The requirements of Decrees 409/2025 (higher obligations) and 410/2025 (lower obligations) below concern the general regime under § 13(2). Services listed in § 18(1) follow the specific measures in Regulation (EU) 2024/2690, rather than automatically the complete Czech decree checklist; other services of the same provider remain subject to their applicable duties. In the lower regime, distinguish proportionality under Decree 410 § 3(1)(a) from the mandatory minimum in point (b) (§ 3(2)–(6), §§ 4–6 and § 10). Document reasons for measures not implemented in the overview under § 3(2). In the higher regime, non-application of some measures must be based on risk management (Decree 409 § 8(4)); it is not an unrestricted choice. Under Regulation 2690, document non-application of conditional requirements as required by Article 2(2). This overview is not a complete inventory of the applicable measures and annexes.

What is ISMS?

ISMS (Information Security Management System) is a systematic approach to managing an organisation’s information security. NIS2 requires proportionate risk-management measures for entities in scope. In the general Czech higher regime an ISMS is mandatory (§ 14(1) of the Act, Decree 409 § 3); the lower regime requires a system for ensuring minimum cybersecurity (§ 14(2), Decree 410 § 3). This does not generally require ISO/IEC 27001 certification.

Specific rules by regime

Decree 409: an ISMS and at least annual effectiveness assessment (§ 3); a mandatory committee meeting at least annually with minutes, and specified security roles (§§ 4–5). Assess risks at least annually and on significant changes (§ 8(1)), with the equivalent or better process option under § 8(3) and Annex 4. Audit under a plan, on significant changes within their scope and at least every two years; justified cases may use systematic parts covering the whole scope within five years (§ 16(4)–(5)). The auditor meets § 5(4) and assesses independently; an external firm is not necessarily required.
Identity and access: Decree 409 § 19 and Decree 410 § 8 specify MFA using two different factor types or currently robust continuous authentication based on zero trust for administrators, users and technical assets. They provide interim alternatives using keys/certificates and then prescribed passwords; Decree 409 also requires records of non-compliant mechanisms. Apply the proportionality rules above. Access must be removed or changed without delay on termination or change of the relationship (Decree 409 § 13(2), Decree 410 § 7(1)).
Monitoring and testing under 409: retain the events covered by § 22 for at least 18 months; § 23 requires continuous evaluation. Scan vulnerabilities at least annually; penetration testing follows asset and risk assessments before operation, on relevant significant changes and at least every two years, with a justified option for systematic parts within five years and retesting of findings (§ 24). Regularly test continuity plans and backups (§§ 15 and 26).
Decree 410: update the measures overview and assess effectiveness at least annually; retain overviews and updates for four years (§ 3(2)). Set event retention according to security needs (§ 9(3)). Section 12 requires approved security updates without delay and regular vulnerability scanning; internal SLAs must not defer the applicable duty.
Regulation 2690: review the security policy, risk-assessment results and treatment plan at least annually and on specified incidents or changes (Annex 1.1.2, 2.1.4). Independent reviews have planned and event-based triggers (2.3); testing frequency follows risk (6.5), and critical vulnerabilities are addressed without undue delay (6.10.2). Authentication rules are in 11.3 and 11.6–11.7; log retention is in 3.2.5. Do not substitute Decree 409 intervals for these rules.

ISMS Structure

NIS2 Specific Requirements (Article 21)

Mandatory Security Measures

The table expands the ten areas in Article 21(2)(a)–(j) into multiple rows. Priorities illustrate internal sequencing, not a legal ranking of obligations.

#	Measure	Description	Priority
1	Risk analysis & policies	Policies for risk analysis and information security	Critical
2	Incident handling	Prevention, detection and response to incidents	Critical
3	Business continuity	BCM, backup, disaster recovery, crisis management	Critical
4	Supply chain security	Supply chain security	High
5	Secure acquisition, development & maintenance	Security in the acquisition, development and maintenance of network and information systems	High
6	Vulnerability handling	Vulnerabilities and their disclosure	High
7	Cybersecurity assessment	Evaluation of the effectiveness of measures	High
8	Cybersecurity hygiene	Basic practices and training	High
9	Cryptography	Policies and procedures for cryptography and, where appropriate, encryption	High
10	HR security	Human resources security	Medium
11	Access control	Access management	Critical
12	Asset management	Asset management	Medium
13	MFA/Continuous auth & secure communications	Where appropriate, MFA or continuous authentication, secured voice, video, text and emergency communications within the entity	Critical

Technical Controls

Implementation options — choose by risk and applicable rules

Control	Requirement	Standard	Status
Encryption at rest	AES-256 for data	FIPS 140-2/3	Example, not a fixed Art. 21 prescription
Encryption in transit	TLS 1.3 for all APIs	RFC 8446	Example, not a fixed Art. 21 prescription
Access Control	RBAC + MFA	NIST 800-63	Example, not a fixed Art. 21 prescription
Logging & Monitoring	Central monitoring; retention set by purpose and applicable law		Example, not a fixed Art. 21 prescription
Backup	Regular, encrypted, tested	3-2-1 rule	Example, not a fixed Art. 21 prescription
Patch Management	Critical <7d, High <30d		Example, not a fixed Art. 21 prescription
Firewall	Network perimeter + internal		Example, not a fixed Art. 21 prescription
Endpoint Protection	Antimalware, EDR		Example, not a fixed Art. 21 prescription
IDS/IPS	Network intrusion detection		Recommended
DLP	Data Loss Prevention		Recommended

Example cryptography policy

Organisational Controls

HR Security

The following values are suggested internal targets. Define and approve them for the service, risk and applicable implementing rules; Article 21 does not prescribe these exact intervals or recovery times.

Phase	Control	Description
Pre-employment	Background check	According to position and access level
Onboarding	NDA	Non-disclosure agreement
	Security training	Basic security training
	Policy acknowledgement	Confirmation of reading policies
	Access provisioning	Least privilege
During employment	Regular training	At least annually
	Phishing simulation	At least quarterly
	Access reviews	At least quarterly
Offboarding	Access revocation	Without delay on termination or change of the relationship, under the applicable regime
	Asset return	Devices, keys, badges
	Exit interview	Security debrief

Training Requirements

Role	Training	Frequency
All employees	Security awareness	Annually
All employees	Phishing awareness	Quarterly
IT staff	Technical security	Bi-annually
Developers	Secure coding	Bi-annually
Management	Security governance	Annually
CISO/Security team	Advanced certifications	Ongoing

Risk Management

Risk Assessment Process

The process and matrix below illustrate a method, not a “NIS2 methodology”. Under Decree 409, comply with § 8 and Annex 4, including the conditions for a different method; insurance or outsourcing does not transfer statutory accountability. A simple multiplication does not replace assessment of assets, threats and vulnerabilities.

Risk Matrix

Risk acceptance must satisfy the acceptability criteria. Under Decree 409 Annex 4 paragraph 6, risks above that threshold require security measures; merely documenting a decision is insufficient. Under Regulation 2690, management or the relevant authorised persons accept assessment results and residual risks, with appropriate reporting to management (Annex 2.1.1–2).

Likelihood / Impact	Low	Medium	High	Critical
High	Medium	High	Critical	Critical
Medium	Low	Medium	High	Critical
Low	Low	Low	Medium	High
Very Low	Low	Low	Low	Medium

Business Continuity

BCM Components

Component	Description	Requirement
BIA	Business Impact Analysis	Identify critical processes
BCP	Business Continuity Plan	Continuity plan
DRP	Disaster Recovery Plan	Technical recovery
IRP	Incident Response Plan	Incident response
CMP	Crisis Management Plan	Crisis management

Recovery Objectives

System	RTO	RPO
Critical production	<4h	<1h
Web services	<2h	<1h
Email	<8h	<4h
Internal apps	<24h	<8h
Development	<48h	<24h

Testing Schedule

Test	Frequency	Scope
Backup restoration	Monthly	Sample restore
Failover test	Quarterly	DR site activation
Tabletop exercise	Bi-annually	Scenario walkthrough
Full DR drill	Annually	Complete failover

Vendor Security

Due Diligence Checklist

Choose evidence according to risk and applicable contractual requirements (§ 13(5), Decree 409 § 9, Decree 410 § 3(5), or Regulation 2690 Annex 5). An ISO certificate, SOC 2 report, NDA or insurance is not itself a universal NIS2 requirement or evidence that all supplier duties are met.

Security questionnaire
Relevant ISO/IEC 27001 certificate or SOC 2 report
Penetration test results
A contract or other legal act under GDPR Article 28(3) and (9) where the supplier processes personal data on your behalf; a standalone DPA is not the only form
NDA
Insurance certificate
Sub-processor list

Ongoing Monitoring

Activity	Frequency
Security review	Annually
Access audit	Quarterly
Incident review	On incident
Contract review	On renewal

ISO 27001 Alignment

ISO/IEC 27001:2022 specifies ISMS requirements; the publisher also lists Amd 1:2024. It can help organise risk management, responsibilities and evidence. Build any detailed control mapping against applicable legislation and the current standard; it is not legal equivalence or complete NIS2 coverage. Certification is a separate choice and does not replace Czech duties or incident reporting.

Implementation Roadmap

The months are an illustrative project plan. Determine actual deadlines from registration, the specific regime and transition; this plan does not defer existing duties.

Next Steps

ISMS requirements understood
Questions to assess your obligations
Implement according to roadmap
ISO 27001 certification (recommended)

Content reviewed: 6 September 2026. Primary sources: NIS2 — Arts. 20–21, NÚKIB — national implementation, Implementing Regulation (EU) 2024/2690.

Czech legal basis: 264/2025, 408/2025, 409/2025, 410/2025, 2024/2690.