Vyhláška 410/2025 Sb.: the lower-obligation regime in practice

The short answer: Vyhláška č. 410/2025 Sb. sets out security measures for regulated service providers under the lower-obligation regime and has been effective since 1 November 2025, together with Zákon č. 264/2025 Sb., o kybernetické bezpečnosti. For IT teams, it translates into specific tasks: prioritising technical assets, defining the order and procedures for recovery, naming accountable individuals, regularly backing up data, configurations and settings, and segmenting the network, including separating production and backup environments. The deadlines are set by the Act, not the Decree: the service must be reported to the Office within 60 days of the company meeting the relevant conditions (§ 6 odst. 1), and the measures must be implemented no later than one year after delivery of the registration decision (§ 13 odst. 4). This article is an informational overview, not legal advice.

A typical scenario: a company director has received the results of a self-assessment stating „lower-obligation regime„. The legislation refers to „technical assets" and „communications network segmentation", while the company has one server, one NAS and an outsourced IT technician available by phone. This article therefore translates selected provisions into practical IT tasks. For an explanation of which organisations are covered by the Act, see NIS2 and Zákon 264/2025 Sb.: does it apply to your company?.

Where Vyhláška 410/2025 Sb. fits in

Zákon č. 264/2025 Sb., o kybernetické bezpečnosti has been effective since 1 November 2025, and § 72 repealed the previous Zákon č. 181/2014 Sb. However, the Act leaves the details of the measures to implementing decrees. There are two, depending on the applicable regime:

• Vyhláška č. 410/2025 Sb. — measures under the lower-obligation regime. Issued on 26 September 2025, valid from 14 October 2025 and effective from 1 November 2025. It applies to most smaller regulated entities.
• Vyhláška č. 409/2025 Sb. — measures under the higher-obligation regime, also effective from 1 November 2025.

The practical consequence is that 410/2025 Sb. is binding under the lower regime; the requirements of 409/2025 Sb. do not apply to you directly. This distinction matters when someone presents you with a proposal based on the higher regime.

Two deadlines are running: 60 days and one year

The deadlines are set by the Act, not the Decree. There are two, and it is important not to confuse them.

Notification (§ 6 odst. 1 of Zákon č. 264/2025 Sb.). A service provider that meets the conditions for registration must notify the Office—NÚKIB—no later than 60 days after meeting those conditions. The decisive date is when the conditions were met, not when the company noticed it. If you met them by crossing a size threshold or expanding your activities, the deadline runs from that change.

Implementation of measures (§ 13 odst. 4 of the Act). The obligated entity must begin implementing and carrying out the security measures no later than one year after receiving the registration decision. The deadline therefore runs neither from the notification nor from the Act’s effective date, but from delivery of the decision. Keep a record of the delivery date, as it is the starting point for the entire plan. One year is not „a year off": network segmentation and backup redesign usually take place at weekends and during maintenance windows when operations are offline, leaving only three or four realistically usable opportunities.

From legislation to practical IT tasks

The middle column is based on the wording of the legislation; the final column gives an example of a common solution and is not part of the Decree.

Backups: what the Decree requires

The wording of § 6 písm. c) of Vyhláška č. 410/2025 Sb. is more specific than it may initially appear. It refers not only to data, but to „information, data, configurations and settings of technical assets", and explicitly states the objective: restoring the regulated service in the event of a cybersecurity incident. This has three implications:

Configurations must also be backed up. Small companies often back up shared folders, accounting systems and email, but not firewall configurations, switch VLAN settings or hypervisor settings. If a server fails, the data can be restored; if a device configured three years ago by someone else fails, everything has to be rebuilt from scratch and from memory. A configuration export is usually a single file and can generally be backed up automatically.

The scope is determined by what is „necessary for restoring the service". The Decree does not say „back up everything"; it refers to assets necessary in particular for restoring the regulated service. Start with whatever must be operational for the service to function.

„In the event of an incident" means a backup that an attacker cannot reach. A backup stored on a NAS mounted as a network drive under a user account will not survive ransomware. The minimum is a copy beyond the reach of normal production operations—either offline or immutable. For more detail, see external drives and the 3-2-1 rule and ransomware in a business: the first 24 hours.

Accountable individuals and recovery order

Section § 6 písm. a) a b) of Vyhláška č. 410/2025 Sb. requires organisations to prioritise technical assets, define the order and procedures for recovery, and appoint specific accountable individuals. This can be done without investment, yet it is almost never complete in small companies. The document should answer three questions:

1. What do we start first? The order should be based on dependencies, not alphabetical order. The domain controller and DNS usually come before applications, and there is no point starting the ERP system before its database.
2. How is it restored? The procedure should explain where the backup comes from, which tool is used for recovery and how to confirm that the asset is working—one page per asset.
3. Who is personally accountable? Neither „the IT department„ nor „the supplier" is a specific person. Every role also needs a deputy because incidents do not respect holidays.

During an incident, this document may be the only thing that still works because the intranet may be unavailable. It should therefore also exist in printed form. Server data recovery shows what happens when recovery is not planned until an incident is already underway.

Network segmentation and backup separation when you have one NAS

Section § 11 písm. a) of Vyhláška č. 410/2025 Sb. requires communications network segmentation, including separation of production and backup environments. This is often the most substantial infrastructure change required under the lower regime—and the source of the question, „Do we need to buy a second NAS?" The Decree does not prescribe a technology or a number of devices; it prescribes the outcome: the production and backup environments must not be the same. In a company with one server and one NAS, four approaches can be combined:

• Network separation. Place the backup device in its own VLAN and permit access only from defined sources and only through the ports required for backups.
• Identity separation. The backup account must not be a domain administrator account, so compromising a workstation or the domain does not automatically provide access to backups.
• Transfer-direction separation. A model in which the backup server retrieves backups itself (pull) is more resilient than one in which the protected machine sends them using stored credentials.
• Separation in time. A copy that is physically disconnected or immutable for a defined period remains separated even without another network.

If your network is flat, with office devices, guest Wi-Fi and the backup NAS all in the same segment, segmentation is a project rather than an afternoon task. The one-year deadline under § 13 odst. 4 is realistic, but not generous.

What Vyhláška 410/2025 Sb. does not require

The most widespread misconception, repeated in secondary interpretations and commercial proposals, is that organisations under the lower regime must test backup recovery at a prescribed frequency. According to the wording of the legislation:

• Vyhláška č. 410/2025 Sb. (the lower regime) requires regular backups in § 6 písm. c). This provision does not explicitly require organisations to test recoverability or document the results.
• Vyhláška č. 409/2025 Sb. (the higher regime) requires regular testing of backup integrity, availability and recoverability, together with documentation of the results, in § 26 odst. 3 písm. a) a b), and separation of the backup environment in § 26 odst. 5.
• Even under the higher regime, the cited provisions do not specify a particular testing frequency. Claims such as „you must test recovery every month" therefore do not follow from them.

This leads to two recommendations. Do not buy a service merely because someone presents it as a statutory requirement under the lower regime—check the text of the Decree that applies to you and confirm that the requirement is actually there. Nevertheless, you should still test recovery: not because the lower-regime Decree expressly requires it, but because an untested backup is only an assumption. Choose a sensible interval, record the date and outcome of each test, and follow the schedule.

The same caution applies to penalties: Zákon č. 264/2025 Sb. also regulates offences, but the potential fines should be checked against the current wording of the Act, not a forwarded summary.

The provisions discussed above are not the entire Decree; they are the ones most directly affecting infrastructure. The Decree also covers other areas, including access control, incident response and documentation. We deliberately do not cite paragraph numbers for those topics here because they should be addressed using the full text available from e-Sbírka.

IT suppliers: what changes in contracts

Most smaller regulated companies do not implement the measures themselves but rely on suppliers. Under § 13 odst. 5 of Zákon č. 264/2025 Sb., an entity implementing security measures through a supplier must select that supplier in accordance with the requirements arising from the security measure and incorporate those requirements into its contracts. This has two consequences.

Selecting a supplier is no longer just a matter of price and response time. The criteria must reflect the measures you are required to implement. If a measure requires separation of the backup environment, a supplier unable to provide it does not meet the requirement.

The contract changes from a basic retainer-and-hourly-rate agreement into a document specifying who does what: what is backed up and how often, who holds access credentials and how they are transferred, how incidents are reported to you, what assistance is provided during recovery, and what happens to backups and passwords when the engagement ends. Anyone who has experienced an IT technician leaving without handing over passwords will understand why the final point matters.

Responsibility for meeting the obligations does not transfer to the supplier; it remains with the obligated entity.

How to prepare even if you are not yet regulated

Smaller companies outside regulated sectors may encounter these requirements indirectly through customers that are regulated and must manage their suppliers. A security questionnaire during a tender process is often the first sign. A practical baseline consists of the same measures:

1. An inventory of what you operate—servers, NAS devices, applications, connections and their owners.
2. Backups that include configurations, with one copy beyond the reach of normal production operations.
3. A documented recovery order and named accountable individuals, also available in printed form.
4. A separate backup environment—at least at the identity and network levels.
5. Recovery testing at an interval you choose, with the outcome recorded.
6. A contract with your IT supplier describing incident-response cooperation and the handover of access credentials.

None of this is paperwork for the authorities—it determines whether a company resumes operations one day after an incident or three weeks later.

ITHOPE helps smaller companies in Brno and the surrounding area implement these measures in practical terms: reviewing what you actually operate, building backups that include configurations, separating the backup environment from production, and documenting a recovery order and responsibilities that work during an incident and can also be demonstrated during an inspection. See IT management and backups for service details and IT for businesses for other services. We leave the interpretation of legislation to lawyers and focus on the technical side.

The practical aspects of backup and storage measures—including separate backup environments, drive replacement and monitoring—are covered by our NAS servicing and business backup services.

Sources

• Zákon č. 264/2025 Sb., o kybernetické bezpečnosti (e-Sbírka): https://www.e-sbirka.cz/sb/2025/264
• Vyhláška č. 410/2025 Sb. — opatření v režimu nižších povinností: https://www.e-sbirka.cz/sb/2025/410
• Vyhláška č. 409/2025 Sb. — opatření v režimu vyšších povinností: https://www.e-sbirka.cz/sb/2025/409
• NÚKIB — Národní úřad pro kybernetickou a informační bezpečnost: https://nukib.gov.cz/
• Portál NÚKIB (průvodce zákonem, materiály, formuláře): https://portal.nukib.gov.cz/

Where to find us

ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.

Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).