organisations do not specifically allocate funds to em­ ployee training, exactly half the respondents perform it. The education sector was the most affected by budget decreases of all sectors, although 65% of respondents saw decreases (Chart 29). More than one-fifth of ed­ ucational institutions were in favour of increasing their budgets by at least 50%. Chart 29: How did the organisation’s cyber security budget change in 2020 in comparison with 2019? (%) Educa�on Average of all sectors DIGITAL SERVICES: SUFFICIENT FUNDING AND LEGAL EXPERTISE The crisis management processes of the majority of Czech institutions that provide digital services (tele­ communications, digital infrastructure, internet ser­ vices, etc.) include cyber incident response scenarios. In 2020, almost half the respondents dealt with one to five cyber incidents (Chart 30), of which DoS/DDoS at­ tacks were perceived as the most serious by one-fifth of the organisations. 50% DECREASED 65% 43% of organisations grant their suppliers no access to their networks REMAINED THE SAME 15% Exactly half the respondents do not grant their sup­ plier any remote access into their networks, whereas the other half grant them restricted access following the user’s consent. This is presumably why 57% of the respondents perceived the threat of supply chain cyber­ attacks as low or very low. 39% INCREASED 12% 20% DO NOT KNOW 0% 0 6% 20 40 60 In order to minimize the threat of successful cyberattacks on educational institutions, it is primarily desirable to identify the information systems used. On 1 January 2021, the amended Decree No 317/2014, on important information systems and their determination criteria entered into force, under which information systems of colleges and universities may also fall. More details are available in the NÚKIB supporting materials, such as the Guidebook to IIS identification on the NÚKIB website: www.nukib.cz/cs/infoservis/ dokumenty-a-publikace/podpurne-materialy In 2020, one-third of the institutions from the digital services sector spent from 5% to more than 15% of their total budget on cyber security, which is only comparable to the financial sector. Less than threequarters of the respondents consider the amount sufficient, whereas one-third plan to increase the cyber security budget next year, which corresponds to the average of respondents’ answers across the sectors. Digital service institutions, as well as industry and the energy sector, have legal expertise at a level higher than the average of all respondents. Chart 30: How many cyberattack attempts in the digital services sector resulted in a cyber incident, i.e. where confidentiality, integrity, or availability of information was breached? (%) 11�20 14% 1�10 43% 0 43% Targets of Cyberattacks 25