Cybersecurity Act

What it means

The Cybersecurity Act is the Slovak law transposing the EU NIS2 Directive. It requires selected companies and institutions to implement security measures, report serious cyber incidents and submit to state supervision.

The act applies to operators of essential and important services in sectors such as energy, transport, banking, healthcare, digital infrastructure and public administration, as well as manufacturing, food production and postal and courier services. The entity's size and sector are decisive.

The central authority for cybersecurity is the National Security Authority, which keeps the register of operators, receives incident reports, issues guidance and checks compliance. NIS2 considerably widened the range of obliged entities compared with the previous rules.

How it works in practice

Obliged entities must introduce risk management and security measures, such as a security policy, access management, backups, encryption, supply chain security and an incident response plan. Measures should be proportionate to the risks and size of the entity.

Serious incidents must be reported within short statutory deadlines, first with an early warning and then a more detailed notification. The company should therefore have a procedure ready for who assesses an incident, who reports it and how it communicates with customers and authorities.

The act also emphasises management accountability: management must approve security measures and oversee their implementation. Regular security training for staff and management is part of this, since the human factor is a frequent cause of incidents.

What to watch out for

Breaches can lead to heavy fines, which may also be linked to the company's turnover, and management can be held accountable. Companies should check whether the act applies to them and, if so, register in time and start meeting their obligations.

Even companies not directly covered may be affected indirectly if they supply obliged entities, which increasingly require suppliers to demonstrate security measures. Cyber insurance can provide additional protection.