ESTIMATED INCREASE IN THE NUMBER OF IMPORTANT INFORMATION SYSTEMS DUE TO THE AMENDMENT OF THE DECREE ON IMPORTANT INFORMATION SYSTEMS period number of newly implemented systems 2021 360 2022 260 2023 80 Total 700 corrections and amendments to legal provisions At the beginning of 2020, the ACS was amended with respect to the provisions related to offences and fines resulting from them. The amendment corrected a condition that had persisted since 2017 when some offences overlapped and some lacked any possibility of imposition of a fine. NUMBER OF OBLIGED ENTITIES BY THE END OF 2020: 52 120 85 177 56 61 entities: administrators and operators of critical information infrastructure information and communication systems critical information infrastructure information and communication systems THE NÚKIB’S SUPERVISORY ACTIVITIES IN 2020 Regarding control and audit activities, 2020 was negatively affected by the pandemic, which resulted in a lower number of controls and audits performed. In 2019, the NÚKIB performed 15 controls under the ACS, whereas in 2020 it only performed 8 controls and audits under the ACS, or Decree No 82/2018, on cyber security (hereinafter the ‘DCS’). Controls and audits at obliged entities under the ACS verify that the obligations resulting from the ACS and DCS have been fulfilled. There are about 150 check points within each control or audit. The NÚKIB’s priority in the area of controls and audits was the healthcare sector, particularly in the second half of 2020. AREAS OF INSUFFICIENCIES MOST FREQUENTLY IDENTIFIED DURING THE CONTROL AND AUDITING ACTIVITIES: The set cyber security system does not cover all parties involved Subjects manage the assets and risks associated with cyber security inadequately The security policy and documentation are often not applied in practice or are not updated Subjects manage the supplier-associated risks inadequately Use of obsolete hardware and software no longer supported by the manufacturer entities: administrators and operators of important information systems Lack of cyber security experts important information systems Inappropriate network segmentation entities: administrators and operators of essential services information systems essential services information systems Insufficient internal network monitoring Too short log storage period Dysfunctional system ensuring the continuity of activities Measures 28