On 18 June 2014, the Chamber of Deputies of the Parliament of the Czech Republic approved, at its 3rd reading, a draft law on cyber security and amending related laws (ZKB). The bill will be forwarded to the Senate of the Parliament of the Czech Republic for further discussion and approval.

The following implementing legislation is being prepared to implement the Cybersecurity Act:

  1. Decree on Security Measures, Cybersecurity Incidents, Reactive Measures and the Establishment of Submission Requirements in the Field of Cybersecurity (Cybersecurity Decree)

    The draft of this decree is being prepared by the National Security Authority. The Cybersecurity Decree was consulted with the professional public in the first quarter of this year and is now finalising the work on its final version, with its distribution to the interdepartmental consultation procedure expected in July 2014.
  2. Decree laying down important information systems and their defining criteria

    The draft of this decree is being prepared by the National Security Office in cooperation with the Ministry of the Interior and is expected to be circulated to the interdepartmental consultation procedure in September 2014.
  3. Amendment to Government Regulation No. 432/2010 Coll., on criteria for determining the critical infrastructure element

    The National Security Authority participated in the creation of part of the amendment in question, namely the establishment of sector-specific criteria for the determination of the critical infrastructure element in the area of cybersecurity. However, the proposal for this amendment is the responsibility of the Ministry of the Interior and the date of its distribution to the interdepartmental consultation procedure has not yet been fixed.

    Critical information infrastructure entities and administrators of major information systems will be identified in the course of 2015. The ZKB then lays down an annual transitional provision for these designated entities, which will start to run from the date on which the determining criteria are determined or fulfilled, in which they will prepare for fulfilling the core obligations under the ZKB.

Questions from municipalities on the Decree laying down important information systems and their defining criteria

Recently, there have been increasing queries from municipalities asking whether they will be affected by the obligations laid down by the ZKB, especially in connection with the obligation to apply security measures in the information systems managed by them.

The ZKB provides for five groups of regulated entities, with only two of these groups of regulated entities being applicable to public authorities. One of them is the administrator of the so-called important information system, the other is the administrator of the system included in the critical information infrastructure. The ZKB defines both of these administrators and the details for their designation will be determined by implementing regulations, which are currently being developed in cooperation between the National Security Authority and the Ministry of the Interior.

The National Security Authority argues that the information systems managed by the municipality will be included neither in the critical information infrastructure – that is, the critical infrastructure in the area of cybersecurity – nor in the important information systems. Standardisation under the implementing provisions of the ZKB should therefore not be mandatory for municipalities.

However, it should be noted that the requirement to ensure information security in information systems is already laid down in Act No 365/2000 on public administration information systems and amending certain other acts, as amended, and the use of newly emerging standards in the provision of information systems is also suitable for those entities that are not required to do so by law (ZKB).