National Security Authority

What it means

The National Security Authority is the Slovak central government body for cybersecurity, protection of classified information and trust services. It also runs the national SK-CERT centre, which acts as the national CSIRT and receives reports of cyber incidents.

In cybersecurity, the authority applies the Cybersecurity Act, which transposes the EU NIS2 directive into Slovak law. It determines which entities have obligations, supervises compliance and can impose fines.

The authority is also the supervisory body for trust services under the eIDAS regulation. It oversees providers issuing certificates for qualified electronic signatures, qualified timestamps and electronic delivery services.

How it works in practice

Companies that are regulated entities under the Cybersecurity Act must register, implement security measures and report significant incidents. Since NIS2 was transposed, the scope has widened considerably to include medium-sized companies in selected sectors.

In an incident such as a ransomware attack or a data leak, reports must be filed within strict deadlines. Besides the NBÚ, the data protection authority may need to be notified if personal data are affected. A prepared incident response procedure saves time.

Even companies not directly covered by the act can use the public guidance, warnings and methodologies published by the authority and SK-CERT. For ordinary businesses, the authority matters mainly in relation to qualified electronic signatures and checking the trustworthiness of certificates.

What to watch out for

Companies often do not realise they fall under the Cybersecurity Act, especially if they supply regulated sectors or have grown past the size thresholds. It is worth assessing in advance whether the company has become a regulated entity, because the obligations apply without any notice from the authority.

Security clearances for individuals and companies to access classified information are a separate area of the authority's work, needed mainly for defence or security contracts. The process takes a long time, so it should be started well before a tender.