As a generally binding legal regulation, the Cybersecurity Act has an unprecedented impact on the legal status of regulated entities compared to previous regulations. The status of a regulated entity needs to be reflected both internally, within your organization in relation to your employees and legal processes, and externally when dealing with the regulator and your suppliers or contractual partners.

From a legal services perspective, it is crucial that all efforts to comply with the Cybersecurity Act formally meet the legal requirements. At the same time, due diligence and the obligation of senior management to comply also come into play – failure to meet those requirements may be considered a violation. Organizations may have the best processes in place, but if they are not aligned with the measures required by law, they may be irrelevant to the regulator. Therefore, when preparing clients for the Cybersecurity Act and implementing processes, we always work closely with cybersecurity experts, to ensure that all measures are done in accordance with the legal requirements. Our services include:

• Legal impact analysis: We will assess whether and how the Cybersecurity Act affects your business and recommend what steps to take to ensure that your organization adapts quickly and effectively to the requirements.
• Legal advice: We will provide you with legal advice related to the Cybersecurity Act, including coverage of the basic requirements that apply to your business environment, and propose procedures for meeting them.
• Legal assistance in resolving cybersecurity incidents: We will provide immediate legal support in the event of a cyberattack or other security incident. We will help you minimize legal risks and ensure compliance with regulatory requirements during a crisis.
• Grant consulting: We will assess the possibilities of using funds provided to support measures to increase cybersecurity within the EU or at the national level, including legal services in the area of assessing the funds provided from the perspective of public support regulations and preparing and submitting applications for financial support.
• Contractual documentation: We will create or update your contracts with suppliers, customers, and partners and prepare other necessary documentation required to protect critical information infrastructures and comply with the requirements of the Cybersecurity Act. This process is similar to that used when concluding data processing agreements (DPAs) in relation to GDPR.
• Training and compliance: We will design and implement comprehensive cybersecurity training programs for your employees, management, and statutory bodies. We will focus on the practical aspects of the Cybersecurity Act and their application in your organization.
• Legal support in the development of security products and services: We will provide legal support in the area of cybersecurity certification for companies developing security solutions.
• Representation before NÚKIB and other authorities: In the event of inspections, administrative proceedings, or other interactions with NÚKIB or other regulatory authorities, we will represent you and defend your interests. We will help you navigate complex regulatory processes and minimize potential penalties.

Implementing new legal requirements into business practice often involves aligning regulations with company processes, organizational structures, staffing, and technological infrastructure. In similar implementations, the following approach has proven highly effective. As part of our analyses, we use our own proven tools that enable us to efficiently identify gaps and prioritize steps. Examples include the Deloitte NIS2 Maturity Assessment Tool and the ZoKB Maturity Assessment Tool, designed directly with the Cybersecurity Acts requirements in mind, which we offer to our clients as part of our services.

• Analysis of existing processes: We will analyze existing processes, applications, and staffing in the context of the requirements of the Cybersecurity Act.
• Technology: We will conduct IT, business, and financial assessments of your considered options.
• Changes: We will propose specific changes at the organizational level and within individual domains, and validate these proposals with you.
• Implementation roadmap: We will prepare a detailed implementation plan that considers your company’s technological, process, and organizational readiness. On the technological side, we often recommend using cloud services in combination with traditional enterprise ICT (e.g., a mix of AWS, MS Azure, M365 with on-premises infrastructure).

Together, we will plan the scope and depth of our involvement according to your needs and expectations. We will map your organization, the reasons for introducing the Cybersecurity Act requirements into the company, as well as the personnel, financial, and technical context, and determine the final scope of our activities and expected deliverables accordingly.

• Information gathering: We will collect information about cybersecurity in your company, specifically regarding ICT assets, related threats, job roles and procedures, and other variables.
• Security risks: We will identify cybersecurity risks relevant to your company.
• Gap analysis: We will conduct a gap analysis comparing your current cybersecurity state with the desired target state – in this case, full compliance with the Cybersecurity Act.
• Security measures: We will propose and implement security measures to mitigate identified cybersecurity risks.
• Regular follow-up: We will fine-tune the measures and capture lessons learned. We will ensure the measures are sustainable and subject to regular review.