Transposition of the NIS 2 Directive just around the corner!

On 31 May 2024, a draft legislation was published amending the existing cyber security legislation.

The draft published by the National Security Office of the Slovak Republic brings extensive changes to the current Act No. 69/2018 Coll. on cyber security and on amending and supplementing certain acts.

Are you a service provider for the critical infrastructure or at least a medium sized business providing services in the sectors listed below?

HIGH CRITICALITY LEVEL		OTHER CRITICAL SECTORS
Energy		Postal and courier services
Transport		Waste management
Banking		Manufacture and distribution of chemicals
Financial markets infrastructure		Food production, processing and distribution
Healthcare		Manufacture of medical devices, computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other means of transport
Water and atmosphere		Digital service providers*
Digital infrastructure		Research
ICT service management (business-to-business)
Public administration
Universe

If you meet the criteria, you are a Basic Service Provider! Beyond the above, the National Security Authority may also decide to classify you as a Basic Service Provider.

NEW OBLIGATIONS EFFECTIVE from 1.1.2025 - NIS 2 Directive from 18.10.2024!

Given the scope of obligations, it is high time to start preparing, especially to:

- conduct an analysis of potential cyber security risks,

- adopt and adhere to a cybersecurity strategy (i.e. adopt internal documentation),

- take appropriate and adequate technical, operational security measures (e.g. backing up all data on tangible media that is not connected to the network, regularly updating devices and anti-virus programs, using cryptography and encryption),

- undergo training (both governing bodies and staff),

- and many other duties.

BEWARE OF PENALTIES !!!

! Temporary suspension of the statutory body function in case of failure to remedy the violations of the statutory obligations !

! Enormous fines of up to 2% of turnover, maximum 10 000 000 Euros !

Are you not sure whether you classify as a Basic Service Provider? How to start preparing for your new responsibilities? Do you want to avoid sanctions?

Contact our SK Cybersecurity team at Eversheds Sutherland!

The materials on the Eversheds Sutherland website are for general information purposes only and do not constitute legal advice. While reasonable care is taken to ensure accuracy, the materials may not reflect the most current legal developments. Eversheds Sutherland disclaims liability for actions taken based on the materials. Always consult a qualified lawyer for specific legal matters. To view the full disclaimer, see our Terms and Conditions or Disclaimer section in the footer. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website.