Nearly 90% of the respondents from the healthcare sector believe that the level of cyber security in their organisations has improved. Nevertheless, the NÚKIB’s activities in several healthcare facilities in 2020 indicate that the overall level of cyber security is still insuffi­ cient. Similarly to previous years, three-quarters of the respondents consider the funding allocated to cyber security to be deficient. In 2019, almost half the healthcare organisations questioned would increase their cyber security budgets by more than 100%, com­ pared to only one-third speaking in favour of an increase of 50% in 2020. As in previous years, salaries have remained the crucial factor discouraging cyber security job applicants for almost three-quarters of the respondents. Compared to last year, there has been some positive development as the percentage of unoccupied posts has decreased in almost all categories (Chart 28). It can be concluded from the respondents’ answers that cyber security has come to the forefront of the budget priorities, but in most cases the respondents could only increase their budgets thanks to the 10th Call of the EU’s Integrated Regional Operational Programme for Cyber Security. Chart 28: Unoccupied cyber security jobs in hospitals in 2019 and 2020 (% of respondents) 2019 2020 0–10% 27% 57% 10–20% 13% 3% 20–30% 7% 13% 30–40% 40–50% 7% 6% JINÉ 7% 24% 20 In reaction to the ongoing COVID-19 pandemic and the cyberattacks on the Czech hospitals, the Decree on Providers of Essential Services was amended last year in relation to the healthcare sector. The goal of the amendment was to include a greater number of hospitals among the essential service operators and to ensure their better regional distribution in order to ensure nationwide coverage. The amendment takes account of the specifics of some health services as well as of the capacity of health service providers whose substitutability in the case of outage due to a cyber incident would be difficult, and ensures connection to the integrated rescue and emergency system. The amendment took effect from 1 January 2021 and supposes that, based on the new criteria, about 30 additional hospitals should be regulated in 2021 on top of the original number of 16 most important hospitals. The complete wording of the amended Decree is available at aplikace.mvcr.cz/sbirka-zakonu EDUCATION: INCREASING CYBERATTACKS Czech academic institutions have become the targets of ransomware attacks more and more often. Throughout 2020, universities and colleges repeatedly warned against harmful practices in cyberspace targeted at their institutions. Prague University of Economics and Business faced a ransomware attack,xviii Masaryk University in Brno detected new malware aimed at its users via a targeted phishing campaignxix, and Palacký University Olomouc detected a previously unknown form of ransomware that encrypted all data upon a computer restart.xx The increase in attacks against Czech educational institutions mimics the global trend. As in the previous year, the most serious cyberat­ tacks in absolute figures according to the educational institutions were phishing campaigns – from simple, widespread ransom e-mails to sophisticated and spe­ cifically targeted scam e-mails, in which the attackers pre­tended to be employees of the university. One-fifth of the respondents ranked ransomware second of the most serious threats. 33% 3% THE AMENDMENT TO THE DECREE ON PROVIDERS OF ESSENTIAL SERVICES IN HEALTHCARE 40 One way in which the institutions can diminish the threat of a successful phishing attack is by training their employees in cyber security. Although three-quarters of Targets of Cyberattacks 24 0