NIS2: technical analysis

Czech Act No. 264/2025 Coll. on Cybersecurity, which implements NIS2, and its implementing decrees place obligations on thousands of Czech companies. A large share of them concern technical infrastructure: access, logging, backups, vulnerability management, secure development and suppliers.

CZK 120,000

3 to 4 weeks, up to 10 systems, the technical side without legal advice. Excl. VAT.

Book a consultation

What we offer

We go through your cloud and DevOps infrastructure against these requirements. We show what is met and what is missing, and build a remediation plan with effort and prices. We do not rely on questionnaires alone: we verify the configuration directly in your environment, read-only.

This is a technical analysis. Legal interpretation, assessing whether the law applies to you, and building an ISMS are not included.

We do not write applications. We work only on infrastructure, cloud and DevOps.

When it makes sense

You know the law applies to you and need to find out where you stand technically.
Your cybersecurity manager needs verified technical data, not estimates.
An audit or inspection is coming and you want to know the gaps in advance.
You need a basis for the remediation budget.

What you get

A verified overview of which technical requirements you meet and which you do not.
Priorities by risk, not by the order in the law.
A remediation plan with effort, prices and the order of steps.
An evidence template you can keep filling in for the audit.

What exactly we do

We analyse ten technical areas and rate every requirement as met, partly met, not met, or not verified. We fit the analysis to the obligation regime that applies to you. For the higher obligations regime we work from Decree No. 409/2025 Coll. You, or your legal adviser, determine the regime.

Asset management: Inventory of systems and data in the cloud, their owners and classification.
Identities and access: MFA, privileged accounts, least privilege, regular access reviews.
Logging and detection: What is logged, for how long, who watches the logs and how security events are detected.
Backup and continuity: Backups, verified restore, RTO and RPO, disaster recovery.
Vulnerabilities and patching: Scanning, patch deadlines, how current the versions are.
Secure development and change: CI/CD, change management, environment separation, code and dependency checks.
Network security: Segmentation, firewall, services exposed to the internet.
Cryptography: Encryption of data at rest and in transit, key and certificate management.
ICT suppliers: The technical side: supplier access, its logging and restrictions.
Incidents from a technical view: Detection, escalation and the inputs for reporting to NÚKIB, the Czech cybersecurity authority.

Who works on it

Three people work on the analysis. It is led by a senior with cloud security experience.

Senior, project lead
5 days

Responsible for
Interpreting the technical requirements, interviews with security and IT, gap analysis, priorities, remediation plan, readout.

What you get from them
Main contact, gap analysis, remediation plan
Middle
4 days

Responsible for
Technical verification of configuration: identities, logging, backups, encryption, network, CI/CD.

What you get from them
Verified technical findings
Junior
3 days

Responsible for
Inventory of systems, evidence collection, checklists, preparation of the evidence template.

What you get from them
Inventory, evidence, template

We assign work by complexity: juniors do routine work from templates, the middle takes the harder parts, and the senior owns the design, quality control and risk decisions. You do not need to decide who does what. The effort in days is indicative and only explains the price. The price is fixed and does not depend on the days actually worked.

How the project runs

The analysis has four phases and takes 3 to 4 weeks, depending on when people are available for interviews.

Week 1: kick-off and scope
Goal: Set the systems in scope and the obligation regime.
- Kick-off with the cybersecurity manager and IT.
- Choice of up to 10 systems in scope.
- Confirmation of the obligation regime.
- Collection of existing documentation (policies, previous audits, risk analysis).
- Read-only access.
Output: Confirmed scope and regime. Who: senior, junior on the inventory
Weeks 1 and 2: evidence collection
Goal: Verify the real state directly in the environment.
- Technical configuration check in the ten areas.
- Interviews with IT, operations and security.
- Evidence collection: configuration exports, screenshots, documents.
Output: Evidence for every area. Who: middle on the technical check, junior on evidence, senior on interviews
Weeks 2 and 3: gap analysis
Goal: Compare the findings with the requirements and set priorities.
- Mapping requirements to findings.
- Rating every requirement.
- Priorities by risk and impact.
Output: Gap analysis. Who: senior
Week 4: remediation plan and readout
Goal: Turn the gaps into a plan.
- Remediation measures with effort, price and order.
- An evidence template to keep filling in.
- Readout for management and security.
Output: Remediation plan, evidence template, handover. Who: senior, junior on the template

How we work together

Main contact: The project lead (a senior). Accountable for the result, deadlines, risks and decisions. Day to day you can talk to anyone on the team directly.
Communication: A shared Slack or Teams channel and a ticketing system of your choice. Every question and change leaves a trail.
Kick-off: At the start we confirm the scope, access, contacts and the dates of the key milestones.
Weekly status: A short 15 to 30 minute sync: what is done, what is next, what we need from you and which risks we see.
Final readout: We present the results to your team and management and go through the next steps.
Escalation: Junior → middle → project lead. If a deadline or a major risk is at stake, the project lead contacts you the same day.
Working hours: Working days, 8:00 to 17:00 Central European Time. Production changes happen in a window you choose, always through your change management.

What we need from you

The timeline holds if we have the following. If something is delayed, the schedule moves by the same time and we tell you straight away.

A contact for the cybersecurity manager or the person responsible for NIS2.
The determined obligation regime (lower or higher).
The list of systems in scope (up to 10).
Read-only access to the cloud, CI/CD and monitoring.
Existing security documentation.
People from IT and security for interviews.

Access and security

Every team member has their own named account. We do not use shared accounts.
We ask only for the permissions a phase needs. Where read access is enough, we work read-only.
We do not take data out of your environment. Our documents contain only the summaries the result needs.
When the project ends, you remove our access, or we remove it on request and confirm it.
If you wish, we sign an NDA before the kick-off.

What is included and what is not

Included in the price

Technical analysis of up to 10 systems in ten areas
Configuration verified directly in the environment
Gap analysis with priorities
Remediation plan with effort and prices
Evidence template and readout

Not included: priced separately or on your side

Legal interpretation of the law and assessing whether it applies to you
ISMS, security policies and certification documentation
Infrastructure outside cloud and DevOps (office network, OT), unless agreed in advance
Carrying out the remediation (quoted separately)
Analysis of DORA requirements

If we find during the project that reality differs from what we assumed, we tell you before we work outside the scope. We send a short estimate of the impact on price and timeline and continue only once you agree.

Deliverables and acceptance

Deliverable	Contents	Form
Gap analysis	Rating of the requirements in ten areas, with evidence	PDF and Excel
Remediation plan	Measures, priorities, effort, prices, order	Document
Evidence template	A structure for adding evidence over time	Excel
Readout	Presentation for management and security	Meeting and PDF

The project is done when:

We have handed over the gap analysis, the remediation plan and the evidence template.
The readout has taken place.
We have incorporated your comments from one round.

We hand over the deliverables and go through them with you. We incorporate comments in one round within 5 working days of receiving them.

Risks and how we handle them

Risk	How we handle it
The obligation regime is not determined	We work to the higher obligations regime and mark the requirements that apply only to it.
Some evidence is not available	We mark the requirement as not verified and state what needs to be shown.
The interpretation of the law is still evolving	We work from the regulations in force on the day of the analysis and state that date in the document.
There are more than 10 systems	We price the extra systems individually, in advance.

Price and terms

CZK 120,000 excl. VAT, fixed price (up to 10 systems, more than 10 priced individually).

Duration: 3 to 4 weeks.
Prices exclude VAT, invoiced in CZK or EUR.
Work outside the scope: a separate quote, always in advance.

What can follow

Next steps

1A short 30 minute call: we look at your environment and check that the service fits what you need.
2We confirm the scope, the start date and the contact people.
3We send the contract and the list of access we need to start.

Frequently asked questions

Does NIS2 apply to us?

That is a legal question. You can answer it with a self-assessment under the NÚKIB methodology or with a lawyer. We deal with the technical side.

Is the result a certification?

No. It is a technical analysis and a remediation plan you can use as input for an audit.

Why verify the configuration when we have filled in questionnaires?

A questionnaire shows what we believe. The configuration shows how things really are. The difference is usually significant.

Tell us what you are working on.

Thirty minutes, free. We reply within one working day.