ITER/CZCzechia
What the record establishes for Czechia: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Office for Personal Data Protection reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | Národní úřad pro kybernetickou a informační bezpečnost reported | https://portal.nukib.gov.cz/checked 2026-09-03 Portál NÚKIB. Where the portal is unavailable the guidance allows e-mail or a datová schránka. | nukib hlaseni incidentu |
| Financial supervisorDORA, article 19 | Česká národní banka reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Česká národní banka (CNB) reported | — | esma mar nca |
Transposition of NIS2 reported
| Act | Zákon č. 264/2025 Sb., o kybernetické bezpečnosti |
|---|---|
| In force | not stated in the material read |
| Recipient | Národní úřad pro kybernetickou a informační bezpečnost |
| Moves a term | Yes. In three places, and one of them changes who decides. The anchor is an internal determination. The initial report is due «bez zbytečného odkladu, nejpozději do 24 hodin», and the guidance says plainly what starts it: «tato lhůta se počítá od okamžiku, kdy u konkrétního subjektu osoba k tomu pověřená (například manažer kybernetické bezpečnosti) vyhodnotí zjištěnou událost jako kybernetický bezpečnostní incident», from the moment a designated person inside the organization classifies the event, not from the organization becoming aware of a significant incident. The authority decides significance, not the entity. After the initial report the Úřad tells the provider whether the incident has significant impact; where it does not, the guidance says the reporting ends there. The Directive leaves that assessment with the entity. The final report is measured from resolution. «Po jeho vyřešení nejpozději do 30 dnů závěrečnou zprávu», thirty days from the incident being resolved, where the Directive gives one month from the incident notification, with an interim report in the meantime if the incident is still running. |
| Standing | This is the Úřad's own supporting material on the ZKB and its implementing decrees, not the act. Two things it does not contain: any seventy-two hour stage, and the date from which the act binds. Neither is recorded here as a result. It also states a threshold of its own: the duty reaches incidents where intentional causation cannot be excluded without undue delay and within twenty-four hours, so operational incidents that can be ruled out are not reportable. |
| Source | nukib hlaseni incidentu |
An event in Czechia
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.