The opportunity
2/2 · Clear, recurring pain
The new cybersecurity law makes each covered organisation register, then put security measures in place within a year.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- About 6,000 towns and firms are covered, in energy, manufacturing, food, logistics and digital services.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.SME Unionsme-union.czSME UNION — the deadlines are running (another site)The business association's alarm: 6,000+ firms affected across energy, manufacturing, food, logistics and digital services — and many SMEs still unaware they are in scope.
- Many small firms do not yet know the law covers them.SME Unionsme-union.czSME UNION — the deadlines are running (another site)The business association's alarm: 6,000+ firms affected across energy, manufacturing, food, logistics and digital services — and many SMEs still unaware they are in scope.
- The top fine is CZK 250m or 2% of global turnover.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
The opportunity
About this section
- What this shows
- The problem as it is today: what goes wrong, and who it costs.
- Why it matters to a builder
- Documented pain means you will not have to convince buyers the problem exists before you can sell them the fix.
- How to read the score
- 2/2 means clear, recurring pain: documented complaints, a petition or industry pressure. Scattered complaints make it 1/2.
The new cybersecurity law makes each covered organisation register, then put security measures in place within a year.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- About 6,000 towns and firms are covered, in energy, manufacturing, food, logistics and digital services.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.SME Unionsme-union.czSME UNION — the deadlines are running (another site)The business association's alarm: 6,000+ firms affected across energy, manufacturing, food, logistics and digital services — and many SMEs still unaware they are in scope.
- Many small firms do not yet know the law covers them.SME Unionsme-union.czSME UNION — the deadlines are running (another site)The business association's alarm: 6,000+ firms affected across energy, manufacturing, food, logistics and digital services — and many SMEs still unaware they are in scope.
- The top fine is CZK 250m or 2% of global turnover.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
- 4,825 had registered by February 2026, so over a thousand had not.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
- One university had to re-run its tender for an outside security manager, and in September it pushed the closing date back again.2 sourcesTEDted.europa.euMendel University cybersecurity manager — repeat procurement procedure (another site)Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. The notice was posted to the EU's TED procurement portal on 26 August 2026 under the govtech sector.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”TEDted.europa.euTED — Mendel University pushes its security-manager deadline back (another site)The university's repeated tender for the outsourced security manager the law requires was still open in September 2026, with its closing date moved from 29 September to 22 October.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”
The law is Act No. 264/2025, the Czech version of the EU's NIS2 directive (its common cybersecurity rules).Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m. Each organisation registers with NÚKIB (the national cyber-security agency), telling it that it runs a covered service, and its year for security measures runs from that registration.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- The agency counts a long delay against an organisation when it sets a fine.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
- The security measures are concrete steps set out in two decrees, No. 409/2025 and No. 410/2025.Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies. They include a list of the organisation's computers and data, a risk assessment, supplier checks, staff training, and reporting an attack to the agency within 24 hours.Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.
- The university is Mendel University in Brno. In August 2026 it went back to market for an outsourced security manager, a role the law requires.TEDted.europa.euMendel University cybersecurity manager — repeat procurement procedure (another site)Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. The notice was posted to the EU's TED procurement portal on 26 August 2026 under the govtech sector.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení” In September it moved the closing date for bids to 22 October 2026, so it had still not found one.TEDted.europa.euTED — Mendel University pushes its security-manager deadline back (another site)The university's repeated tender for the outsourced security manager the law requires was still open in September 2026, with its closing date moved from 29 September to 22 October.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”
Suggested solution
Build a small security agency that does the security work, and writes EU grant applications for the towns that qualify.
- A consultant who checks what the law requires. Today: Checks whether the new cybersecurity law covers the organisation, and what it owes. With the suggested solution: One fixed-price provider makes the same check, before the organisation's deadline.
- The town or care home. Today: Registers with the national cyber-security agency, which starts its one-year deadline for security measures. With the suggested solution: Unchanged: registering is the organisation's own duty.
- A consultant who writes grant applications. Today: Writes the EU grant application for the organisations that can get one. With the suggested solution: The same provider writes the application, inside the fixed price.
- A seller of ready-made compliance documents. Today: Sells the required documents as a package, without doing the security work. With the suggested solution: The documents describe security work the provider has actually done.
- Nobody in-house, at most of these organisations. Today: Nobody carries out the security measures; one university had to re-run its tender for an outside security manager. With the suggested solution: The provider does the security work itself, at the same fixed price.
- Who does this is not known. Today: Who checks the measures after the deadline, and when, is not known. With the suggested solution: Unchanged: the provider prepares the organisation for that check but does not perform it.
Not known: who checks the measures after the deadline, and when.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Suggested solution
About this section
- What this shows
- One way to solve the problem, and how the work would run with it.
- Why it matters to a builder
- It is a starting point to test with buyers, not a plan. The sections below are the evidence for and against it.
Build a small security agency that does the security work, and writes EU grant applications for the towns that qualify.
A covered town or care home buys help in pieces: one seller checks what it owes, another writes the grant application, a third sells paperwork.3 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.
One provider does the check, the application and the security work, so the organisation buys once instead of three times.
- A consultant who checks what the law requires. Today: Checks whether the new cybersecurity law covers the organisation, and what it owes. With the suggested solution: One fixed-price provider makes the same check, before the organisation's deadline.
- The town or care home. Today: Registers with the national cyber-security agency, which starts its one-year deadline for security measures. With the suggested solution: Unchanged: registering is the organisation's own duty.
- A consultant who writes grant applications. Today: Writes the EU grant application for the organisations that can get one. With the suggested solution: The same provider writes the application, inside the fixed price.
- A seller of ready-made compliance documents. Today: Sells the required documents as a package, without doing the security work. With the suggested solution: The documents describe security work the provider has actually done.
- Nobody in-house, at most of these organisations. Today: Nobody carries out the security measures; one university had to re-run its tender for an outside security manager. With the suggested solution: The provider does the security work itself, at the same fixed price.
- Who does this is not known. Today: Who checks the measures after the deadline, and when, is not known. With the suggested solution: Unchanged: the provider prepares the organisation for that check but does not perform it.
Not known: who checks the measures after the deadline, and when.
Why now
3/3 · Deadline with penalties
Towns, care homes and firms under the new law run out of time in late 2026, and first steps already cost about 100,000 CZK.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
- A firm's owner has one year from registering with the national cyber-security agency to put the required security in place, so the first deadlines fall in late 2026.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m. A firm that misses its deadline can be fined up to 2% of its turnover.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
- A town's director who wants the EU to pay half of the work first pays a consultant about 121,000 CZK just to write the grant application.2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026. The grant stops taking applications on 17 December 2026, so a town that has not applied by then pays the full cost itself.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- Hiring someone to do the work is hard. Mendel University in Brno had to run its tender for an outside security manager, the person the law requires to be in charge of security, a second time in August 2026, and in September it pushed the closing date for bids back to 22 October 2026.2 sourcesTEDted.europa.euMendel University cybersecurity manager — repeat procurement procedure (another site)Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. The notice was posted to the EU's TED procurement portal on 26 August 2026 under the govtech sector.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”TEDted.europa.euTED — Mendel University pushes its security-manager deadline back (another site)The university's repeated tender for the outsourced security manager the law requires was still open in September 2026, with its closing date moved from 29 September to 22 October.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení” A care home bought a ready-made package instead, at the price shown under Willing to pay.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Why now
About this section
- What this shows
- The dated rules and events that push buyers to act, soonest first.
- Why it matters to a builder
- A dated rule turns “nice to have” into “must buy by”, and tells you how long the window stays open.
- How to read the score
- 3/3 means an enacted rule binds these buyers within 18 months and names a penalty. Without a named penalty it is 2/3. A draft law, a rule on someone else, or a date further out is 1/3.
Towns, care homes and firms under the new law run out of time in late 2026, and first steps already cost about 100,000 CZK.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
- A firm's owner has one year from registering with the national cyber-security agency to put the required security in place, so the first deadlines fall in late 2026.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m. A firm that misses its deadline can be fined up to 2% of its turnover.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
- A town's director who wants the EU to pay half of the work first pays a consultant about 121,000 CZK just to write the grant application.2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026. The grant stops taking applications on 17 December 2026, so a town that has not applied by then pays the full cost itself.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- Hiring someone to do the work is hard. Mendel University in Brno had to run its tender for an outside security manager, the person the law requires to be in charge of security, a second time in August 2026, and in September it pushed the closing date for bids back to 22 October 2026.2 sourcesTEDted.europa.euMendel University cybersecurity manager — repeat procurement procedure (another site)Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. The notice was posted to the EU's TED procurement portal on 26 August 2026 under the govtech sector.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”TEDted.europa.euTED — Mendel University pushes its security-manager deadline back (another site)The university's repeated tender for the outsourced security manager the law requires was still open in September 2026, with its closing date moved from 29 September to 22 October.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení” A care home bought a ready-made package instead, at the price shown under Willing to pay.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- Many small firms do not yet know the law covers them.SME Unionsme-union.czSME UNION — the deadlines are running (another site)The business association's alarm: 6,000+ firms affected across energy, manufacturing, food, logistics and digital services — and many SMEs still unaware they are in scope. An organisation that has not registered already faces proceedings and a fine.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
The dates behind these deadlines come from the law itself, and from a second law on critical infrastructure:2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.Rowan Legalrowan.legalAct No. 266/2025 Coll. (critical infrastructure) (another site)The CER transposition puts a parallel physical-resilience compliance stack on an overlapping entity set — designations from July 2026, resilience plans and incident reporting through 2027.
- On 1 November 2025 the new cybersecurity law took effect.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- By 17 July 2026 the state had to name the organisations covered by the second law, on critical infrastructure.Rowan Legalrowan.legalAct No. 266/2025 Coll. (critical infrastructure) (another site)The CER transposition puts a parallel physical-resilience compliance stack on an overlapping entity set — designations from July 2026, resilience plans and incident reporting through 2027.
- In late 2026 the first one-year deadlines for security measures run out.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- By January 2027 a city such as Liberec, covered since January 2026, must have its security measures in place.Registr smluvsmlouvy.gov.czRegistr smluv — Liberec hands its security measures to its own IT company (~60M CZK) (another site)Liberec, covered by the law since January 2026 and due to have the security measures in place by January 2027, pays its own city IT company about 841,000 CZK a month to run its systems and those measures.In the source’s words“Zabezpečení informačního systému SML - II — 60068759.63”
- On 17 December 2026 the EU grant for towns, regions and hospitals stops taking applications.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- By mid 2027 most of the remaining deadlines have run out.Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.
- The top fine is CZK 250m or 2% of global turnover, and the agency counts a long delay against an organisation when it sets the fine.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.NÚKIBnukib.gov.czNÚKIB — registration tally (another site)The regulator's own count: 4,825 of ~6,000 expected entities had reported a regulated service by 8 Feb 2026 — verifying the 6,000 figure, with over a thousand obligated organisations not yet even registered.
The second law is Act No. 266/2025, the Czech version of the EU's CER directive (its rules for critical entities).Rowan Legalrowan.legalAct No. 266/2025 Coll. (critical infrastructure) (another site)The CER transposition puts a parallel physical-resilience compliance stack on an overlapping entity set — designations from July 2026, resilience plans and incident reporting through 2027. It puts physical-resilience duties only on the operators the state names, providers of essential services such as energy, health care, transport and communications: resilience plans, meaning how they keep essential services running through physical threats, and incident reporting, through 2027.Rowan Legalrowan.legalAct No. 266/2025 Coll. (critical infrastructure) (another site)The CER transposition puts a parallel physical-resilience compliance stack on an overlapping entity set — designations from July 2026, resilience plans and incident reporting through 2027. Some of them are covered by the first law too, which counts a named critical-infrastructure operator's service among the services it covers;Zákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m. a town or care home owes this work only if the state names it.Rowan Legalrowan.legalAct No. 266/2025 Coll. (critical infrastructure) (another site)The CER transposition puts a parallel physical-resilience compliance stack on an overlapping entity set — designations from July 2026, resilience plans and incident reporting through 2027.
Its clocks start only when the state names an organisation: 9 months for a risk assessment, 10 for a resilience plan.VeKLEPodok.gov.czVeKLEP — the critical-infrastructure resilience decree and its costs (another site)The interior ministry's explanatory report for the decree on resilience plans and incident reports: 9 and 10 months from being named, and new measures costing a few million to a few tens of millions CZK per organisation. The interior ministry expects each named organisation's new measures to cost a few million to a few tens of millions CZK, mostly for physical security.VeKLEPodok.gov.czVeKLEP — the critical-infrastructure resilience decree and its costs (another site)The interior ministry's explanatory report for the decree on resilience plans and incident reports: 9 and 10 months from being named, and new measures costing a few million to a few tens of millions CZK per organisation. Since 1 October 2026 named organisations report incidents through a state portal.e-Sbírkae-sbirka.gov.czDecree No. 178/2026 Coll. (critical-infrastructure portal) (another site)Since 1 October 2026 the organisations named under the critical-infrastructure law report incidents, and register the staff who act for them, through a state portal.In the source’s words“(4) Oprávněnému uživateli se prostřednictvím portálu umožňuje a) poskytovat součinnost správci a dalším oprávněným uživatelům v rozsahu nezbytném pro plnění povinností podle zákona o kritické infrastruktuře a b) hlásit incident podle § 18…”
Willing to pay
2/2 · Clear signs
The covered organisations pay, and towns, regions and hospitals can get half back from an EU grant.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- About €33M in public cyber-security tenders and awards landed in June–August 2026 alone.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- About 121,000 CZK is what one town paid a consultant just to write its grant application.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
- €500–6,000 a year is what compliance software costs one organisation.reglyze.comReglyze — NIS2 tooling price survey (another site)Named annual prices for NIS2 compliance software: Reglyze from €490/yr, Secfix ~€500 a month, Vanta and Drata ~$7,500 a year, OneTrust $30k+ — what a per-firm product can realistically charge.
Per seat, monthly
Per project
One purchase
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Willing to pay
About this section
- What this shows
- Who already spends money on this problem, how much, and how they buy.
- Why it matters to a builder
- If people already pay for this, even by hand or through a consultant, you are replacing a spend, not creating a budget.
- How to read the score
- 2/2 means a Czech buyer has paid for this, or a priced job also gets public money that pays part of it. A price on file makes it 1/2. Public money alone earns nothing. Only public buyers publish what they pay, so problems sold to private firms often score lower.
The covered organisations pay, and towns, regions and hospitals can get half back from an EU grant.2 sourcesZákony pro lidizakonyprolidi.czAct No. 264/2025 Coll. (new cybersecurity act) (another site)The Czech NIS2 transposition, effective 1 Nov 2025 — registration was due end-2025, security measures fall due within one year of registration, and fines reach 2% of global turnover or CZK 250m.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- About €33M in public cyber-security tenders and awards landed in June–August 2026 alone.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- About 121,000 CZK is what one town paid a consultant just to write its grant application.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
- €500–6,000 a year is what compliance software costs one organisation.reglyze.comReglyze — NIS2 tooling price survey (another site)Named annual prices for NIS2 compliance software: Reglyze from €490/yr, Secfix ~€500 a month, Vanta and Drata ~$7,500 a year, OneTrust $30k+ — what a per-firm product can realistically charge.
The €33M is spread over about 77 tenders and awards.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance. Buyers range from large hospitals to small towns:
- Motol and Homolka, two large Prague hospitals, bought threat detection and response for about €6.1M.TEDted.europa.euTED — Motol & Homolka award (~€6.1M) (another site)Prague's biggest hospitals bought cyber threat detection and response for ~€6.1M in June 2026 — the top of the public buying wave, with smaller hospital awards in the same window.
- The city of Prague bought security monitoring across the city for about €5.3M.TEDted.europa.euTED — Prague SIEM award (~€5.3M) (another site)The city of Prague bought a SIEM across the city hall, city police and districts — two security awards from one buyer in six weeks.
- Český Brod, a town of about 7,000, bought its whole cyber-security job; its price is in the table of what one buyer pays.Registr smluvsmlouvy.gov.czRegistr smluv — Český Brod (~9M CZK) (another site)A town of 7,000 signed ~9M CZK for municipal cyber security — one of 341 cyber contracts in the contract registry since June 2026.
- The smallest buyers choose ready-made packages. A care home in Napajedla bought one, and social-care services in the Zlín region ordered the same package within weeks; its price is in the same table.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- 341 cyber-security contracts have entered the state contracts register since June 2026.Registr smluvsmlouvy.gov.czRegistr smluv — Český Brod (~9M CZK) (another site)A town of 7,000 signed ~9M CZK for municipal cyber security — one of 341 cyber contracts in the contract registry since June 2026.
- The town of Týn nad Vltavou paid just to find out whether the law applied to it.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- Prague 5, a city district, is tendering two years of outside running of its security tools, including handling attacks, estimated at 11.8M CZK.TEDted.europa.euTED — Prague 5 outsources the running of its security tools (another site)A Prague city district tenders two years of outside administration, monitoring and evaluation of its cyber-security tools, including handling security incidents, at an estimated 11.8M CZK.In the source’s words“Czechia – System and support services – Správa, nastavení a dohled nad vybranými nástroji kybernetické bezpečnosti — 11827200 CZK”
- Prague 2, a second district, followed two weeks later: four years of outside support for its security systems, including continuous monitoring, estimated at 7.8M CZK.TEDted.europa.euTED — Prague 2 outsources the support and monitoring of its security systems (another site)A second Prague city district tenders four years of outside support for its cyber-security systems, including continuous security monitoring, at an estimated 7.8M CZK.In the source’s words“Czechia – Data network management and support services – Služby podpory systémů kybernetické bezpečnosti — 7800000 CZK”
- Jihlava's psychiatric hospital, one of the grant applicants, signed about 22.9M CZK in September 2026 for security hardware and software, part-paid by the EU's regional-development programme.2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.Registr smluvsmlouvy.gov.czRegistr smluv — Jihlava psychiatric hospital, grant-funded purchase (~22.9M CZK) (another site)A psychiatric hospital signed about 22.9M CZK for security hardware and software with installation and five years of support, part-paid by the EU's regional-development programme.In the source’s words“Kupní smlouva - Zvýšení kyberbezpečnosti PNJ — 27748306.85”
- Třebíč hospital needed cash up front for its own grant-funded project. Its region lent it about 36.9M CZK, interest-free, to pay its EU-funded cybersecurity project up front.Registr smluvsmlouvy.gov.czRegistr smluv — Vysočina region lends Třebíč hospital the cash for its cybersecurity project (~36.9M CZK) (another site)A region lent its hospital about 36.9M CZK, interest-free, to pay up front for an EU-funded cybersecurity project, repayable by April 2028.In the source’s words“Smlouva o zápůjčce za účelem podpory předfinancování projektu s názvem „Zvýšení kybernetické bezpečnosti Nemocnice Třebíč“ — 36866582.5” Two days later it signed about 52.3M CZK for the project's hardware and software.Registr smluvsmlouvy.gov.czRegistr smluv — Třebíč hospital buys the kit for the same project (~52.3M CZK) (another site)Two days after the region's loan, the hospital signed about 52.3M CZK for the project's hardware and software, installed and supported for five years.In the source’s words“Dodávka hardware a software IT infrastruktury včetně montáže, instalace a jejich implementace a poskytování servisní a provozní podpory. — 63256380.0”
- Liberec pays its own city IT company about 841,000 CZK a month, without a tender, to run its systems and the security measures the law asks for.Registr smluvsmlouvy.gov.czRegistr smluv — Liberec hands its security measures to its own IT company (~60M CZK) (another site)Liberec, covered by the law since January 2026 and due to have the security measures in place by January 2027, pays its own city IT company about 841,000 CZK a month to run its systems and those measures.In the source’s words“Zabezpečení informačního systému SML - II — 60068759.63”
The EU grant is IROP call 120 (the cyber-security call of the EU's regional-development programme). It holds about €99.6M and pays 50% of the cost.IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
A rough estimate from the software price range: if a quarter of the 6,000 paid €3,000 a year, software alone would bring about €4.5M a year.reglyze.comReglyze — NIS2 tooling price survey (another site)Named annual prices for NIS2 compliance software: Reglyze from €490/yr, Secfix ~€500 a month, Vanta and Drata ~$7,500 a year, OneTrust $30k+ — what a per-firm product can realistically charge. That is before the security work itself, which is what the public contracts buy.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
Across Europe, cybersecurity spending is about $70 billion in 2026, growing about 11% a year.Mordor Intelligencemordorintelligence.comMordor Intelligence — Europe cybersecurity (another site)Sizes European cybersecurity spend at ~$69.8 billion in 2026, growing ~10.6% a year to ~$115.7 billion by 2031 — with NIS2 and DORA named as the anchor drivers.
Money for building security tools, rather than buying them, also existed. The ECCC (the EU's cybersecurity competence centre) offered €56.2M from the HORIZON research programme to groups of firms and research bodies, Czech ones included. That call closed on 15 September 2026.ECCCcybersecurity-centre.europa.euHORIZON — ECCC cybersecurity calls (€56.2M) (another site)EU money for building security tooling itself — consortia, Czech firms eligible, deadline 15 Sep 2026. Funds the vendors, not the obligated buyers.
Per seat, monthly
Per project
One purchase
What one buyer pays
- 3 000 CZK a month
- An obligated Czech company nis2pruvodce.czNIS2 Průvodce — the Czech subscription (another site)An obligated Czech company pays 3,000 CZK a month for the Czech compliance platform, one subscription per company number, after a seven-day free trial.
- 91 000 CZK once
- Domov pro seniory Napajedla, in the smallest obligated tier Registr smluvsmlouvy.gov.czLexnova — the packaged order (another site)A care home paid about 91,000 CZK for a packaged cyber-security compliance order, and a second order of the same package followed within weeks.
- 121 000 CZK once
- Město Boskovice, a town applying for the EU cyber-security grant Registr smluvsmlouvy.gov.czBoskovice — a consultant paid to write the grant application (another site)A town paid a consultant about 121,000 CZK to write its EU cyber-security grant application, one piece of the job a single provider would take on.
- 495 000 CZK per project
- Sociální služby Uherské Hradiště, a social-services provider Registr smluvsmlouvy.gov.czUherské Hradiště — a care provider buys the whole job at a fixed price (another site)A social-services provider paid a security firm about 495,000 CZK, fixed, for its documents, risk analysis, recovery and continuity plans, and staff training under the new law.
- 1 894 000 CZK per project
- Městská část Praha 9, a Prague city district Registr smluvsmlouvy.gov.czPrague 9 — a city district pays a security firm to put the law's measures in place (another site)A Prague city district paid a security firm about 1.9M CZK, fixed, to put in place the security measures the new law sets for its lighter regime.
- 9 000 000 CZK once
- Město Český Brod, a town of about 7,000 people Registr smluvsmlouvy.gov.czČeský Brod — a town of 7,000 buys the whole job (another site)A town of about 7,000 people signed roughly 9M CZK for municipal cyber security, the top end of what the smallest obligated buyers pay.
10 public contracts and tenders, plus 3 grant calls
May2026
Jun
Jul
Aug
Sep
Oct
Grants open
Hospitals, towns, state agencies and other public bodies that signed or tendered between Jun and Sep 2026. The grant calls can pay for this work.
- €12M
- The National Agency for Communication and Information Technologies is establishing a framework agreement for support services on the Arcsight security platform, valued at EUR 11,600,000. TEDted.europa.euCzech IT agency Arcsight support — CZ framework deal for security platform services (another site)The National Agency for Communication and Information Technologies is establishing a framework agreement for support services on the Arcsight security platform, valued at EUR 11,600,000. The contract is scored as a recurring service.In the source’s words“Czechia – Computer support services – Rámcová dohoda o poskytnutí služeb pro technologii Arcsight”
- €6.1M
- Prague's biggest hospitals bought cyber threat detection and response for about €6.1M in June 2026. TEDted.europa.euTED — Motol & Homolka award (~€6.1M) (another site)Prague's biggest hospitals bought cyber threat detection and response for ~€6.1M in June 2026 — the top of the public buying wave, with smaller hospital awards in the same window.
- €5.3M
- The city of Prague bought a SIEM across the city hall, city police and districts. TEDted.europa.euTED — Prague SIEM award (~€5.3M) (another site)The city of Prague bought a SIEM across the city hall, city police and districts — two security awards from one buyer in six weeks.
- €3.4M
- Nemocnice Milosrdných bratří is tendering a security software package as part of a cybersecurity technology upgrade. TEDted.europa.euMilosrdní bratři hospital cyber upgrade — CZ tender for security software (another site)Nemocnice Milosrdných bratří is tendering a security software package as part of a cybersecurity technology upgrade. The contract is worth EUR 3,356,679.In the source’s words“Czechia – Security software package – Zvýšení kyberbezpečnosti v NMB - technologie — 83916980 CZK”
- €1.8M
- ČEZ Distribuce is procuring a security-monitoring tool for its technological network, valued at about €1.82 million. TEDted.europa.euČEZ grid security monitoring — CZ tool procurement for technology-network safety (another site)ČEZ Distribuce is procuring a security-monitoring tool for its technological network, valued at about €1.82 million. It is cybersecurity-related infrastructure procurement in the energy sector.In the source’s words“Czechia – Network equipment – NÁSTROJ PRO BEZPEČNOSTNÍ MONITORING TECHNOLOGICKÉ SÍTĚ”
- €930k
- Czech Television is tendering network equipment for security monitoring and cyber-threat detection and response on its technology network, with the contract valued at about EUR 930,050. TEDted.europa.euCzech Television cybersecurity — network security monitoring and threat detection gear (another site)Czech Television is tendering network equipment for security monitoring and cyber-threat detection and response on its technology network, with the contract valued at about EUR 930,050. The listing carries a near-term deadline for this 2026 cybersecurity procurement.In the source’s words“Czechia – Network components – Dodávka zařízení pro bezpečnostní monitoring technologické sítě ČT, detekci a reakci kybernetických hrozeb 2026 — 930050 EUR”
- €367k
- A town of 7,000 signed about 9M CZK for municipal cyber security. Registr smluvsmlouvy.gov.czRegistr smluv — Český Brod (~9M CZK) (another site)A town of 7,000 signed ~9M CZK for municipal cyber security — one of 341 cyber contracts in the contract registry since June 2026.
- €216k
- The National Institute of Public Health tendered an endpoint-security system at EPP/EDR/XDR level, valued at approximately EUR 216,121. TEDted.europa.euNational Institute of Public Health endpoint security — EPP/EDR/XDR tender (another site)The National Institute of Public Health tendered an endpoint-security system at EPP/EDR/XDR level, valued at approximately EUR 216,121. The recurrence indicates an ongoing cybersecurity procurement.In the source’s words“Czechia – Security software package – Dodávka systému pro zabezpečení koncových zařízení na úrovni EPP/EDR/XDR — 5403031 CZK”
- €4k
- A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later. Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. TEDted.europa.euMendel University cybersecurity manager — repeat procurement procedure (another site)Mendel University in Brno is procuring cybersecurity manager services under a repeated tender procedure. The notice was posted to the EU's TED procurement portal on 26 August 2026 under the govtech sector.In the source’s words“Czechia – Safety consultancy services – Zajištění služeb manažera kybernetické bezpečnosti (MKB) – opakované řízení”
- €100M
- 2.44bn CZK (about €99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. IROPirop.gov.czIROP call 120 — Kybernetická bezpečnost II (another site)2.44bn CZK (~€99.6M) at a 50% support rate for municipalities, regions and hospitals regulated under Act 264/2025. Applications 30 Apr – 17 Dec 2026.
- €56M
- EU money for building security tooling itself. ECCCcybersecurity-centre.europa.euHORIZON — ECCC cybersecurity calls (€56.2M) (another site)EU money for building security tooling itself — consortia, Czech firms eligible, deadline 15 Sep 2026. Funds the vendors, not the obligated buyers.
- €5k
- Towns pay consultants just to write their IROP cyber-security subsidy applications. Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
Validated abroad
3/3 · Proven in 2+ markets
Two funded European companies sell software that automates security compliance.2 sourcesVestbeevestbee.comSecfix (another site)Berlin, €10.2M Series A (Feb 2026) for AI-driven security-compliance automation for SMEs — the closest funded template for a productised NIS2 offer.Vestbeevestbee.comCopla (another site)Vilnius, €6M Series A (Feb 2026) for real-time compliance monitoring — a second funded compliance-automation player next door, covering NIS2, DORA and ISO 27001.
- Secfix (another site)Based in Germany
- Copla (another site)Based in Lithuania
- Netsec (another site)Based in France
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Validated abroad
About this section
- What this shows
- Companies abroad that already sell a solution, and how far along they are.
- Why it matters to a builder
- Established companies selling it in other markets show that buyers will pay, so you are not betting on an untested idea.
- How to read the score
- 3/3 means established in two or more markets, one of them near Czechia. 2/3 is one established company, 1/3 only early players.
Two funded European companies sell software that automates security compliance.2 sourcesVestbeevestbee.comSecfix (another site)Berlin, €10.2M Series A (Feb 2026) for AI-driven security-compliance automation for SMEs — the closest funded template for a productised NIS2 offer.Vestbeevestbee.comCopla (another site)Vilnius, €6M Series A (Feb 2026) for real-time compliance monitoring — a second funded compliance-automation player next door, covering NIS2, DORA and ISO 27001.
- Vestbeevestbee.comSecfix (another site)Berlin, €10.2M Series A (Feb 2026) for AI-driven security-compliance automation for SMEs — the closest funded template for a productised NIS2 offer.
Raised €10.2M in a Series A round, Feb 2026 (Vestbee); hundreds of small-business customers in 15+ European countries (Tech Funding News, 2026)
- Vestbeevestbee.comCopla (another site)Vilnius, €6M Series A (Feb 2026) for real-time compliance monitoring — a second funded compliance-automation player next door, covering NIS2, DORA and ISO 27001.
Raised €6M in a Series A round, Feb 2026, after a €2.5M seed round, Nov 2024 (Vestbee); software that automates compliance with EU security rules (NIS2, DORA) and the ISO 27001 standard, formerly called CyberUpgrade (EU-Startups, 2026)
- EU-Startupseu-startups.comNetsec (another site)A French-Italian start-up founded in 2025 that runs a mid-size firm's IT and security operations, NIS2 evidence included, for a fee per employee; about €8.9M raised in October 2026.In the source’s words“Interestingly, the service is delivered through Slack or Microsoft Teams and priced per employee per month, starting from €19, rather than billed by the ticket or by the hour.”
Raised about €8.9M ($10M) led by Partech, October 2026 (EU-Startups, 2026); runs a mid-size firm's whole IT and security operation as a service, round-the-clock detection and response and NIS2, DORA and ISO 27001 evidence included, from €19 per employee a month; "thousands of endpoints" after a year of activity
A third, younger one does the security work itself as a service: a French-Italian start-up founded in 2025 runs a mid-size firm's monitoring, attack response and NIS2 evidence from €19 per employee a month, and raised about €8.9M in October 2026.EU-Startupseu-startups.comNetsec (another site)A French-Italian start-up founded in 2025 that runs a mid-size firm's IT and security operations, NIS2 evidence included, for a fee per employee; about €8.9M raised in October 2026.In the source’s words“Interestingly, the service is delivered through Slack or Microsoft Teams and priced per employee per month, starting from €19, rather than billed by the ticket or by the hour.”
Market gap
0/2 · Crowded
Established Czech security firms already do this work for small towns and care homes, and one also writes their EU grant applications.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
New, selling this: Lexnova Technology (since 2024), Lexnova Energy (since 2025), NIS2 Doku (since 2025), NIS2 Průvodce (since 2025), Compligen (since 2026). Established, selling this: Aricoma Systems (since 2017), Next Generation Security Solutions (since 2017), Blue Partners (since 2020), Equica (since 2021). New, selling something nearby: Sec4good (since 2023), Guardians. Established, selling something nearby: ANECT (since 1996), ICZ Risk*Guide (since 1997), Liberecká IS (since 2002), Integra Czech Republic (since 2012), Storage One (since 2013), Zymestic Solutions (since 2019).
- EarlySells this · since 2024Lexnova Technology (another site)A sister company of Lexnova Energy that sells the same fixed-price NIS2 package to care homes: an audit, the required documents, training and, for Domov pro seniory Chodov, registration with the national cyber-security agency.Sources and the full note are in Read more.
- EarlySells this · since 2025Lexnova Energy (another site)A ready-made "NIS 2 package" for public buyers, with repeat orders in the state contracts register.Sources and the full note are in Read more.
- EarlySells this · since 2025NIS2 Doku (another site)A pack of ready-made compliance documents.Sources and the full note are in Read more.
- EarlySells this · since 2025NIS2 Průvodce (another site)A Czech compliance platform, sold by monthly subscription per company.Sources and the full note are in Read more.
- EarlySells this · since 2026Compligen (another site)An online tool that generates the documents the law requires.Sources and the full note are in Read more.
- EstablishedSells this · since 2017Aricoma Systems (another site)A large IT systems house that also sells this job to small public bodies.Sources and the full note are in Read more.
- EstablishedSells this · since 2017Next Generation Security Solutions (another site)A Prague security firm that sells compliance with the cyber-security law end to end: a gap analysis, the required documents, technical measures, and help through the agency's inspection.Sources and the full note are in Read more.
- EstablishedSells this · since 2020Blue Partners (another site)A Prague security firm that does the work the new law requires for small public bodies, at a price fixed item by item.Sources and the full note are in Read more.
- EstablishedSells this · since 2021Equica (another site)A grant and public-sector consultancy that sells towns both halves of the job.Sources and the full note are in Read more.
- EarlySells something nearby · since 2023Sec4good (another site)A Prague consultancy that sells a NIS2 gap analysis, priced from 4,000 EUR before VAT and taking about four weeks.Sources and the full note are in Read more.
- EarlySells something nearbyGuardians (another site)A Czech security newsletter that, with a law firm, sells Verief, a gap analysis against the new law and NIS2.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 1996ANECT (another site)Sells large firms and institutions round-the-clock security monitoring and response from its own centre in Brno, plus help reaching compliance with the cyber-security law.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 1997ICZ Risk*Guide (another site)A security and risk-management platform, bought as a large project.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2002Liberecká IS (another site)The city of Liberec's own IT company, founded by the city to serve it and its organisations.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2012Integra Czech Republic (another site)A security consultancy that sells the check, not the work: gap analyses against the law, penetration tests, and the closing audits towns must buy for grant-funded cyber projects, such as Tábor in October 2025 and Vyškov in February 2026.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2013Storage One (another site)A storage and backup supplier to public bodies that also sells NIS2 HealthCheck, a short gap analysis for small and mid-sized firms: a review of their documents and a few interviews, scored against each section of the decree, with recommendations.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2019Zymestic Solutions (another site)A security firm that sells NIS2 gap analyses, security audits, penetration tests and security software, mostly to ministries and universities.Sources and the full note are in Read more.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Market gap
About this section
- What this shows
- Czech companies that already sell this, and firms nearby that sell something else.
- Why it matters to a builder
- A mature Czech seller means taking customers from an incumbent. Firms nearby still matter: the buyer may already pay them.
- How to read the score
- More points mean a more open field. 2/2 means no Czech company sells this, 1/2 only early ones do, 0/2 a mature one does.
Established Czech security firms already do this work for small towns and care homes, and one also writes their EU grant applications.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
New, selling this: Lexnova Technology (since 2024), Lexnova Energy (since 2025), NIS2 Doku (since 2025), NIS2 Průvodce (since 2025), Compligen (since 2026). Established, selling this: Aricoma Systems (since 2017), Next Generation Security Solutions (since 2017), Blue Partners (since 2020), Equica (since 2021). New, selling something nearby: Sec4good (since 2023), Guardians. Established, selling something nearby: ANECT (since 1996), ICZ Risk*Guide (since 1997), Liberecká IS (since 2002), Integra Czech Republic (since 2012), Storage One (since 2013), Zymestic Solutions (since 2019).
- EarlySells this · since 2024Lexnova Technology (another site)A sister company of Lexnova Energy that sells the same fixed-price NIS2 package to care homes: an audit, the required documents, training and, for Domov pro seniory Chodov, registration with the national cyber-security agency.Sources and the full note are in Read more.
- EarlySells this · since 2025Lexnova Energy (another site)A ready-made "NIS 2 package" for public buyers, with repeat orders in the state contracts register.Sources and the full note are in Read more.
- EarlySells this · since 2025NIS2 Doku (another site)A pack of ready-made compliance documents.Sources and the full note are in Read more.
- EarlySells this · since 2025NIS2 Průvodce (another site)A Czech compliance platform, sold by monthly subscription per company.Sources and the full note are in Read more.
- EarlySells this · since 2026Compligen (another site)An online tool that generates the documents the law requires.Sources and the full note are in Read more.
- EstablishedSells this · since 2017Aricoma Systems (another site)A large IT systems house that also sells this job to small public bodies.Sources and the full note are in Read more.
- EstablishedSells this · since 2017Next Generation Security Solutions (another site)A Prague security firm that sells compliance with the cyber-security law end to end: a gap analysis, the required documents, technical measures, and help through the agency's inspection.Sources and the full note are in Read more.
- EstablishedSells this · since 2020Blue Partners (another site)A Prague security firm that does the work the new law requires for small public bodies, at a price fixed item by item.Sources and the full note are in Read more.
- EstablishedSells this · since 2021Equica (another site)A grant and public-sector consultancy that sells towns both halves of the job.Sources and the full note are in Read more.
- EarlySells something nearby · since 2023Sec4good (another site)A Prague consultancy that sells a NIS2 gap analysis, priced from 4,000 EUR before VAT and taking about four weeks.Sources and the full note are in Read more.
- EarlySells something nearbyGuardians (another site)A Czech security newsletter that, with a law firm, sells Verief, a gap analysis against the new law and NIS2.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 1996ANECT (another site)Sells large firms and institutions round-the-clock security monitoring and response from its own centre in Brno, plus help reaching compliance with the cyber-security law.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 1997ICZ Risk*Guide (another site)A security and risk-management platform, bought as a large project.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2002Liberecká IS (another site)The city of Liberec's own IT company, founded by the city to serve it and its organisations.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2012Integra Czech Republic (another site)A security consultancy that sells the check, not the work: gap analyses against the law, penetration tests, and the closing audits towns must buy for grant-funded cyber projects, such as Tábor in October 2025 and Vyškov in February 2026.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2013Storage One (another site)A storage and backup supplier to public bodies that also sells NIS2 HealthCheck, a short gap analysis for small and mid-sized firms: a review of their documents and a few interviews, scored against each section of the decree, with recommendations.Sources and the full note are in Read more.
- EstablishedSells something nearby · since 2019Zymestic Solutions (another site)A security firm that sells NIS2 gap analyses, security audits, penetration tests and security software, mostly to ministries and universities.Sources and the full note are in Read more.
Sells this 9
- Early: NIS2 Průvodce (another site)2 sourcesMarket checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.nis2pruvodce.czNIS2 Průvodce — the Czech subscription (another site)An obligated Czech company pays 3,000 CZK a month for the Czech compliance platform, one subscription per company number, after a seven-day free trial.
A Czech compliance platform, sold by monthly subscription per company. Twelve modules cover both decrees that set out the security measures (vyhláška 409/2025 and 410/2025): an asset register, a 52-item risk catalogue, a supplier register linked to the state business register, incident reports to the national cyber-security agency within its 24- and 72-hour deadlines, training, and an AI assistant that answers questions about the law. One person, Ondřej Šitler, runs it. He is not VAT-registered, the law it sells against only took effect in November 2025, and no buyer is named.
- Early: Compligen (another site)Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.
An online tool that generates the documents the law requires. It produces 20+ documents for organisations under the lighter set of rules (vyhláška 410/2025), for 29,900 CZK one-off before VAT, and has a page aimed at towns. It claims more than 30 firms and towns as clients. But founder Lukáš Vencálek publishes no company number, no company of that trade name is in the state business register, and the product still shows a Q3 2026 roadmap.
Found by the register’s market check
- Early: NIS2 Doku (another site)Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.
A pack of ready-made compliance documents. It holds 10+ documents for the lighter set of rules (vyhláška 410/2025), plus Excel tools for assets, incidents and suppliers, at 4,900 CZK (Start) or 11,900 CZK (Pro), one-off before VAT. It is sold by David Mikulec, and no buyer is named.
Found by the register’s market check
- 2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.Registr smluvsmlouvy.gov.czLexnova — the packaged order (another site)A care home paid about 91,000 CZK for a packaged cyber-security compliance order, and a second order of the same package followed within weeks.
A ready-made "NIS 2 package" for public buyers, with repeat orders in the state contracts register. Lexnova Energy s.r.o. was founded in January 2025, and its sister company Lexnova Services s.r.o. in July 2026.
- Established: Aricoma Systems (another site)Registr smluvsmlouvy.gov.czRegistr smluv — Třebíč hospital buys the kit for the same project (~52.3M CZK) (another site)Two days after the region's loan, the hospital signed about 52.3M CZK for the project's hardware and software, installed and supported for five years.In the source’s words“Dodávka hardware a software IT infrastruktury včetně montáže, instalace a jejich implementace a poskytování servisní a provozní podpory. — 63256380.0”
A large IT systems house that also sells this job to small public bodies. In December 2025 the Olomouc region signed with it to set up the information-security management system at OLÚ Paseka, a small regional sanatorium, and in December 2023, under its former name AUTOCONT, it wrote the security documents the cyber-security law requires for Povodí Ohře, a state water company. Most of what it sells the public sector is kit and support, such as Třebíč hospital's hardware and software with five years of support.Registr smluvsmlouvy.gov.czRegistr smluv — Třebíč hospital buys the kit for the same project (~52.3M CZK) (another site)Two days after the region's loan, the hospital signed about 52.3M CZK for the project's hardware and software, installed and supported for five years.In the source’s words“Dodávka hardware a software IT infrastruktury včetně montáže, instalace a jejich implementace a poskytování servisní a provozní podpory. — 63256380.0” Aricoma Systems a.s. was registered in November 2017, and has 10 distinct public buyers in the contracts register.
- Established: Equica (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A grant and public-sector consultancy that sells towns both halves of the job. It wrote Lovosice's EU-funded cyber-security project in October 2021, wrote the security documents for Lysá nad Labem in December 2025 and Přelouč's NIS2 documents in February 2026, and since May 2026 has held the outsourced role in charge of cyber security for Brandýs nad Labem-Stará Boleslav; it was the Ústí region's outside security manager from November 2022. Named customers include these towns and the region, all in the state contracts register. Equica, a.s. has traded since November 2001.
Found by the register’s market check
- Established: Blue Partners (another site)2 sourcesMarket checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A Prague security firm that does the work the new law requires for small public bodies, at a price fixed item by item. It set up the security management system for the town of Lanškroun under NIS2 (contract published January 2026), delivered the measures decree 410/2025 asks of the town of Holice in March 2026, and in September 2026 signed to bring a Uherské Hradiště social-services provider into line with Act 264/2025 and decree 409/2025: documents, risk analysis, recovery and continuity plans, and staff training. Its NIS2 page also offers help with grants. Named customers include these buyers and Prague 4, whose IT security it assessed in March 2020. Blue Partners s.r.o. has traded since August 2005.
Found by the register’s market check
- Established: Next Generation Security Solutions (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A Prague security firm that sells compliance with the cyber-security law end to end: a gap analysis, the required documents, technical measures, and help through the agency's inspection. In May 2026 Prague 9, a city district, signed with it to put in place the security measures Act 264/2025 sets for the lower-obligations regime, and the town of Břeclav and regional ambulance services also buy its cyber-security work. Named customers include Fakultní nemocnice Ostrava and Lesy hl. m. Prahy. Next Generation Security Solutions s.r.o. has traded since July 2017.
Found by the register’s market check
- 2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.Registr smluvsmlouvy.gov.czLexnova — the packaged order (another site)A care home paid about 91,000 CZK for a packaged cyber-security compliance order, and a second order of the same package followed within weeks.
A sister company of Lexnova Energy that sells the same fixed-price NIS2 package to care homes: an audit, the required documents, training and, for Domov pro seniory Chodov, registration with the national cyber-security agency. The state contracts register shows dozens of such orders since October 2025, and in July 2026 Domov sociálních služeb Slatiňany signed a larger contract for its expert security services. Lexnova Technology s.r.o. was founded in December 2024, so it has sold for less than three years.
Sells something nearby 8
- Established: ICZ Risk*Guide (another site)Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies.
A security and risk-management platform, bought as a large project. It is deployed at the state digital agency, the police presidium and the Plzeň city IT authority. Ministries, regions, towns and large organisations buy it with one to three months of setup and a 24/7 advisory service, not as the fixed-price product a small organisation buys off a web page. ICZ a.s. has traded since July 1997, and the product is now sold by the group company ICZ.Services a.s. (IČO 22183809, founded October 2024).
Found by the register’s market check
- Established: ANECT (another site)No source on file
Sells large firms and institutions round-the-clock security monitoring and response from its own centre in Brno, plus help reaching compliance with the cyber-security law. It claims 180+ customers, names the oil-pipeline operator MERO ČR among its references, and ANECT a.s. has traded since October 1996. Its own pages say it serves "velkým firmám a institucím", and its one contract in the state contracts register is with Komerční banka: no receipt shows it selling to a town, a care home or a small firm, the buyers this job is for.
- Established: Integra Czech Republic (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A security consultancy that sells the check, not the work: gap analyses against the law, penetration tests, and the closing audits towns must buy for grant-funded cyber projects, such as Tábor in October 2025 and Vyškov in February 2026. Its page offers to carry out some of the recommended steps on request, but no order for the security work itself was found. Named customers include Tábor, Vyškov and the Czech environmental inspectorate. Integra Czech Republic, s.r.o. has traded since February 2012.
Found by the register’s market check
- Established: Liberecká IS (another site)Registr smluvsmlouvy.gov.czRegistr smluv — Liberec hands its security measures to its own IT company (~60M CZK) (another site)Liberec, covered by the law since January 2026 and due to have the security measures in place by January 2027, pays its own city IT company about 841,000 CZK a month to run its systems and those measures.In the source’s words“Zabezpečení informačního systému SML - II — 60068759.63”
The city of Liberec's own IT company, founded by the city to serve it and its organisations. From October 2026 it runs the city's systems and the security measures the law requires, under a contract signed without a tender because the city owns it.Registr smluvsmlouvy.gov.czRegistr smluv — Liberec hands its security measures to its own IT company (~60M CZK) (another site)Liberec, covered by the law since January 2026 and due to have the security measures in place by January 2027, pays its own city IT company about 841,000 CZK a month to run its systems and those measures.In the source’s words“Zabezpečení informačního systému SML - II — 60068759.63” It does this work only for its owner, so an outside provider cannot win it. Named customer: the city of Liberec. Liberecká IS, a.s. has traded since June 2002.
- Established: Storage One (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A storage and backup supplier to public bodies that also sells NIS2 HealthCheck, a short gap analysis for small and mid-sized firms: a review of their documents and a few interviews, scored against each section of the decree, with recommendations. It sells the check, not the security work. Named customers include ČVUT and Správa státních hmotných rezerv. STORAGE ONE, a.s. has traded since November 2013.
Found by the register’s market check
- Established: Zymestic Solutions (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A security firm that sells NIS2 gap analyses, security audits, penetration tests and security software, mostly to ministries and universities; no order from a town or a care home was found. Named customers include the labour ministry, the defence ministry and Palacký University Olomouc. Zymestic Solutions, a.s. was founded in April 2019.
Found by the register’s market check
- Early: Sec4good (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A Prague consultancy that sells a NIS2 gap analysis, priced from 4,000 EUR before VAT and taking about four weeks. It sells the check, not the security work, and names no customers. Sec4good, s.r.o. was founded in January 2023.
Found by the register’s market check
- Early: Guardians (another site)Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
A Czech security newsletter that, with a law firm, sells Verief, a gap analysis against the new law and NIS2. It sells the check, not the security work. The pages read publish no company number and name no customers.
Found by the register’s market check
- A care provider bought the whole job at a fixed price in 2026.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
- Small towns such as Holice bought the security measures, not just documents.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
- One grant consultancy writes towns' grant projects and their security documents.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
The care provider is a social-services organisation in Uherské Hradiště, and its September 2026 contract covers the documents, a risk analysis, recovery and continuity plans, and staff training.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications. The town of Lanškroun bought the same set-up of its security management.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications. The grant consultancy wrote a town's EU cyber-security project in 2021, and now also acts as the outside security manager for towns.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
Four younger Czech sellers offer the paperwork the law requires, as ready-made packs or online tools, and do not put the security measures in place.2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies. That work is what the public contracts under Who pays buy.2 sourcesRegistr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.Market checknis2pruvodce.czCzech NIS2 vendor scan (another site)Czech products now sell the obligation directly to the mid-market — NIS2 Průvodce at 3,000 CZK a month, Compligen at 29,900 CZK once, NIS2 Doku from 4,900 CZK — so the field is no longer only consultancies. Other firms sell single pieces of the job:
- Institut kybernetické bezpečnosti sells scope analysis: whether the law applies, and what is owed.Registr smluvsmlouvy.gov.czRegistr smluv — Lexnova 'NIS 2 package' (~91k CZK) (another site)A care home bought a productised NIS2 package off the shelf, with a repeat order weeks later — the smallest obligated tier pays ~91k CZK a time for packaged compliance.
- enovation writes the EU grant applications that towns pay for.Registr smluvsmlouvy.gov.czRegistr smluv — Boskovice grant application (~121k CZK) (another site)Towns pay consultants just to write their IROP cyber-security subsidy applications — a queue forms before the compliance work even starts.
- Several security firms sell only the first check, a gap analysis of what the law still requires.Market checksmlouvy.gov.czCzech security firms already doing the work (another site)Established Czech firms already sell towns and care homes the security work the law requires, and one also writes their EU grant applications.
Execution difficulty
1/3 · Hard
Makes it easier
- The law's deadlines push towns and firms to buy now.
- An EU grant pays half for towns.
- No licence is needed to do the work.
Makes it harder
- The buyers are public bodies.
- They want references a new provider does not have yet.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Execution difficulty
About this section
- What this shows
- What stands between you and the first sale: who buys, what permission selling needs, what it must plug into, and whether it needs outside money.
- Why it matters to a builder
- It tells you whether a small team can start selling soon, or needs a licence, a certification or funding first.
- How to read the score
- More points mean easier to enter: 3/3 is easy, 0/3 very hard. It is not added to the Opportunity total, and local competition does not count here: that is Market gap.
Hard
Makes it easier
- The law's deadlines push towns and firms to buy now.
- An EU grant pays half for towns.
- No licence is needed to do the work.
Makes it harder
- The buyers are public bodies, so each sale goes through their slow purchasing rules and tenders.
- They want references a new provider does not have yet.
Local competition does not change this level. It is covered under Market gap.
Suggested first moves
- Build a simple, fixed-price check that tells a small town exactly what the new cybersecurity law requires of it and by when.
- Call the directors of care homes and small towns that are already paying for help with this law, and offer them the check.
- For each town that can get the EU grant, write its grant application, so the EU pays half of the security work that follows.
P-0008 · 6,000 Czech towns and firms have months left to meet a new cybersecurity law
Suggested first moves
About this section
- What this shows
- A few concrete steps to start with.
- Why it matters to a builder
- They are cheap ways to learn whether buyers will pay, before you build much.
- Build a simple, fixed-price check that tells a small town exactly what the new cybersecurity law requires of it and by when. The check answers three questions. First, does the new law cover the town at all? Second, has the town registered, meaning told the national cyber-security agency that it runs a covered service, which is the step that starts its one-year clock? Third, which security measures is it still missing? The measures are the concrete steps the law's decrees set out, such as a list of the town's computers and data, a risk assessment, supplier checks, staff training and reporting an attack quickly; they are listed under The opportunity. The town gets a short report: what is done, what is missing, and the date each missing piece is due, before its deadline. Give it one price agreed up front, because the smallest buyers already choose ready-made packages, as Willing to pay shows.
- Call the directors of care homes and small towns that are already paying for help with this law, and offer them the check. They are easy to find, because public bodies must publish their contracts in the state contracts register. Start with the care homes, social-care services and small towns listed under Willing to pay, which bought ready-made packages or paid just to learn whether the law applies to them. These people have already shown they will spend money on this, and their deadline is close, as Why now explains. Ask each one what they have done so far and what worries them, and use the answers to improve the check.
- For each town that can get the EU grant, write its grant application, so the EU pays half of the security work that follows. The grant is EU money for towns, regions and hospitals covered by the law, described under Willing to pay. Towns already pay consultants a fee just to write this application, as Why now shows. If you write it as part of your price, the town saves that fee and deals with one provider instead of two. Start early, because the grant stops taking applications on a fixed date, also under Why now.
- Do the security work the check found missing, rather than only writing the documents that describe it. The work means putting the measures in place for real: making the list of computers and data, setting up supplier checks, training the staff, and being ready to report an attack in time. Established Czech firms already do this work for towns and care homes, so a new provider competes with them on price, speed and doing the whole job at once; see Market gap. The public contracts pay for the work, and even a small town has signed a large contract for it; see Willing to pay. Hiring their own person is hard, too, since one university had to run its tender for an outside security manager again, as Why now tells. So one provider that does the check, the application and the work, at a fixed price, saves the buyer from buying three times.
- Once a customer trusts you, check whether the state named it under a second law, on critical infrastructure, and if so, help with that too. That law is the Czech version of the EU's rules for critical entities. It binds only the operators the state names, in fields such as energy, health care, transport and communications, and some of them are covered by the cybersecurity law as well; a town or care home falls under it only if the state names it. It asks the named operators to write resilience plans, meaning how they keep their essential services running through physical threats, and to report serious incidents. Its dates and costs are under Why now. Where a customer is on that list, you already know it and its systems, so this is the natural next job to offer it.