The National Cyber and Information Security Agency (NÚKIB) sent the draft proposal of the new Act on Cyber Security to the Government Legislative Council at the end of December 2023. The postponement of the original deadline – which was expected to be at the end of November - was due to our efforts to minimize the number of conflicting comments we have received from relevant stakeholders during the consultation procedure.
The new law aims primarily to strengthen the Czech Republic's cyber security. The draft proposal also introduces new processes and tools while simplifying and clarifying the legislation. "The Czech Republic will not be able to cope in the future without high-quality and modern legislation in the field of cyber security. The work associated with the preparation of the new law was demanding. We have raised the standard to ensure higher protection for our state and its citizens," explains Lukáš Kintr, Director of NÚKIB.
Global developments in cyber security have shown the necessity of creating a new law. The European Union, therefore, approved a new security directive, the so-called NIS2, in December 2022. Its incorporation into the Czech legal system is one of the main tasks of the forthcoming law. The proposal assumes that the number of regulated entities will expanded significantly. This number is expected to rise from the current 400 to more than 6,000 entities (providers). These entities will then be divided into two categories - providers under the higher obligation regime and providers under the lower obligation regime. This division will also affect, for example, the obligation to report cyber incidents. The conditions will be softened for providers in the lower obligation regime, while for the higher ones, they will remain as they are now.
The law also includes a new supply chain security mechanism for assessment of suppliers into the strategic infrastructure of State in the field of information and communication technologies. NÚKIB was tasked to prepare such mechanism by the National Security Council. The new legislation allows the state to reduce its dependence on suppliers which pose a strategic threat. "The screening of supply chains will affect only a limited group of providers under the regime of higher obligations, the so-called providers of strategically important services. In fact about 150 entities," adds Lukáš Kintr.
NÚKIB will also create new portal as the primary communication tool between providers and NÚKIB. Thanks to its self-service and automation, it will contribute to a large extent to the elimination of the administrative burden for both regulated entities and NÚKIB.
The inter-ministerial consultation procedure
Regarding the new proposed law on cybersecurity, 886 comments were received from 51 commenting parties. Such higher number of comments is not entirely unusual in the case of similar proposals with a societal impact and broad scope. Approximately one-third of comments were not accepted. Around two-thirds were either accepted, partially accepted, or clarified. Those not accepted were mostly comments on the new supply chain security mechanism. The proposed and suggested modifications would make the mechanism non-functional. The background information on the inter-ministerial consultation procedure can be found here.
"Apart from some of the disagreements with the Ministries of Finance and Transport and the Czech Telecommunication Office, which concern partial issues within the framework of setting up a supply chain security mechanism, we have managed to resolve all the comments from the state administration. Indeed, we conducted the negotiations until the last moment. Even though this caused a delay in the deadline for sending the material to the Government Legislative Council, we managed to resolve a large part of the initial discrepancies," said Kintr, Director of the NÚKIB, about the inter-ministerial comment procedure.
According to EU requirements, the NIS2 Directive should be incorporated into Czech legislation by October 2024 at the latest. Since the beginning of the drafting of the new law, NÚKIB has been doing everything possible to meet this transposition deadline. Although the deadline has not been within its control since a certain stage of the legislative process, particularly regarding the length of the discussion of the law in the Chamber of Deputies of the Czech Republic, NÚKIB is still doing everything possible to meet the deadline. All information regarding the pending legislation can be found on the website nis2.nukib.gov.cz, which has been set up in English as well and is continuously updated.