ABOUT THE DOCUMENT At the beginning of 2021, the NÚKIB sent a question­ naire with 79 questions to entities regulated under Act No 181/2014, on cyber security and on amend­ ments to related laws (Act on Cyber Security, herein­ after the ‘ACS’), as well as to many other key institu­ tions and organisations not regulated under the ACS. The questions covered a broad range of topics such as cyber­attacks, cyber security costs, cyber security staff, users, technolo­gies, and implemented processes. The questionnaire was filled in by 222 entities, including 63 public sector institutions, 24 financial institutions, 77 healthcare facilities, 14 organisations providing digital services, 12 energy sector entities, 12 industrial enti­ ties, and 20 educational institutions. The NÚKIB drew information from these materials for the 2020 Report on Cyber Security in the Czech Republic (hereinafter the ‘2020 RCS’). All data obtained from the questionnaires were anonymised. The 2020 Report on Cyber Security in the Czech Republic does not provide an exhaustive list of cyber security activities. The goal of the document is to describe and assess the threats in cyberspace the Czech Republic faced in 2020, as well as actions taken to mitigate them. PROBABILITY EXPRESSIONS USED IN THE 2020 REPORT ON CYBER SECURITY IN THE CZECH REPUBLIC PROBABILITY EXPRESSIONS AND THEIR PERCENTAGE VALUES: expression probability Almost certain 90 – 100% Highly likely 75– 85% Likely 55 –70% Realistic possibility 25 – 50% Unlikely 15 – 20% Highly Unlikely 0 – 10% EVALUATION PROCESS The assessment of cyber security in the Czech Republic is based on an analytical process consisting of the eval­ uation of the data from the filled questionnaires, the findings of the NÚKIB, information provided by partners, and other available information from verified sources. The NÚKIB did not have the opportunity to check the data provided by the respondents or to verify the claims. The analytical conclusions contained in the report are based on the premise that the answers in the question­ naires were not distorted. The analytical assessment is described using probability expressions (see below). About the Document 8