NIS 2 Status in Slovakia
What the directive requires, how Slovakia transposes it, and where NBÚ sits in the picture.
Overview
The NIS 2 Directive is the EU layer. It binds every Member State, including Slovakia, to a single minimum level of cybersecurity for essential and important entities. Slovakia has to write that level into Slovak law and supervise under it.
Slovakia transposes NIS 2 by amending its existing 2018 Cybersecurity Act. The vehicle is Act No. 366/2024 Z.z., which amends Act No. 69/2018 Z.z. on cybersecurity. It was adopted by the National Council on 28 November 2024, published in the Collection of Laws on 19 December 2024 and entered into force on 1 January 2025. Slovakia missed the 17 October 2024 EU deadline by about two and a half months, which puts it in the group of Member States the Commission addressed via infringement letters before full transposition was notified.
The Národný bezpečnostný úrad (NBÚ, National Security Authority) is the lead competent authority and single point of contact. SK-CERT, operated inside NBÚ, is the national CSIRT. Registration, incident reporting and most regulatory exchanges run through JISKB, the Jednotný informačný systém kybernetickej bezpečnosti.
EU Directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. It defines the obligations every Member State has to transpose, including the size and sector test for essential and important entities.
EU Implementation
Implementing Regulation (EU) 2024/2690
Technical and methodological requirements for DNS providers, TLD registries, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers. Directly applicable in Slovakia, no national transposition needed.
Slovak transposition
Act No. 366/2024 Z.z. (amendment to Act No. 69/2018 Z.z. on cybersecurity), in force 1 January 2025
The Slovak NIS 2 transposition. It rewrites the 2018 Cybersecurity Act rather than replacing it. Instead of the old threshold criteria, section 17(1) now lists who must be entered in the register of operators of essential services, for example any at least medium-sized entity active in a sector of Annex 1 or Annex 2. It adds the supervisory powers and reporting duties required by NIS 2. NBÚ decrees, such as 226/2025 on reporting and 227/2025 on security measures, fill in the operational detail.
Act No. 366/2024 Z.z.
Brings the NIS 2 obligations into Slovak law by amending the 2018 Cybersecurity Act. Slovakia keeps its own terms: every regulated entity is an operator of an essential service (prevádzkovateľ základnej služby), and the higher tier is an operator of a critical essential service. The act also sets NBÚ's supervisory powers, the incident reporting timetable and the sanctions regime. Operational detail is set in NBÚ decrees and guidance.
NBÚ as supervisor and SK-CERT operator
NBÚ is the lead competent authority and single point of contact under NIS 2. It runs supervision, audits and sanction procedures, operates SK-CERT as the national CSIRT, and runs JISKB as the central registration and reporting portal. Sector regulators keep their role where lex specialis applies, in particular for the financial sector under DORA.
Registration and reporting
An entity that falls under section 17(1) must notify NBÚ within 60 days of starting the activity, and report changes within 14 days through JISKB. Significant incidents are reported through JISKB: early warning within 24 hours, notification within 72 hours, final report no later than one month after the notification. Only a report through JISKB counts as meeting the legal duty.
In Slovakia, Slovak law applies
Activities on Slovak territory follow the Slovak transposition. A German managing director with a Slovak subsidiary reads Act 366/2024 (amending Act 69/2018) for that subsidiary, not the BSIG. The directive-level obligations are identical. The procedure, the portal and the sanctions live in Slovak law.
Slovakia cannot fall below the EU level
The directive is minimum harmonisation. Slovakia may go stricter, in particular for sectors it identified as critical under its older framework. Slovakia may not fall below the directive, neither on the obligations for essential and important entities, nor on reporting deadlines, nor on management body accountability.
NBÚ
Národný bezpečnostný úrad. Lead competent authority and single point of contact under NIS 2. Runs supervision, issues implementing decrees and guidance, maintains the register of operators of essential services, and operates JISKB. The point of contact for any cross-border NIS 2 case involving Slovakia.
SK-CERT
The national CSIRT, operated inside NBÚ. Receives incident notifications, coordinates with sectoral and governmental CSIRTs, and exchanges with the CSIRTs network at EU level. Reachable 24/7. The technical counterpart to NBÚ's regulatory role.
ENISA
The EU cybersecurity agency. Publishes guidance, runs the European vulnerability database and coordinates cross-border. Not a supervisor for Slovak entities. That role sits with NBÚ.
Slovak NIS 2 obligations are the same text as the German BSIG, so the German guidance is enough.
The directive-level obligations are identical, but the procedural layer is not. Slovakia keeps its 2018 Cybersecurity Act structure, with NBÚ instead of BSI, SK-CERT instead of CERT-Bund, JISKB instead of the German registration portal, and Slovak deadlines and sanction figures. A Slovak entity that reads only BSIG guidance will file in the wrong place and quote the wrong articles.
There is no registration portal yet, so we can wait.
Slovakia runs JISKB (Jednotný informačný systém kybernetickej bezpečnosti) for registration, notifications and incident reporting. It is operated by NBÚ and is the channel regulated operators use to identify themselves to the authority. Waiting for a separate portal that does not exist is the most common reason Slovak entities miss the registration window.
Only operators identified under the old threshold criteria are in scope.
Act 366/2024 replaced the old threshold criteria with a statutory list in section 17(1) of the amended Cybersecurity Act. That list builds on the sector annexes: any entity of at least medium size in an Annex 1 or Annex 2 sector is in, plus state bodies, critical entities and several size-independent categories. The result is a substantially larger population of regulated entities. The applicability check has to be redone case by case.
Most Slovak mid-market operators we meet still treat NIS 2 as a small update to the 2018 Cybersecurity Act. The amendment is more than that. The scope of regulated entities is broader, the management body now carries personal accountability for approving risk treatment and for its own training, and the reporting timetable is harder than what the old regime asked for.
The practical step is the same as everywhere in the EU: run the applicability check against the directive, register through the national portal (here JISKB), set up the four continuous obligations (keeping registration data current, incident reporting, supply chain risk, supervision by the management body), and document the minimum. The existing 2018 Cybersecurity Act process helps, but it does not replace documenting the NIS 2 measures themselves.
- Directive (EU) 2022/2555 (NIS 2), EUR-Lex
- Implementing Regulation (EU) 2024/2690
- Act No. 366/2024 Z.z. amending Act No. 69/2018 Z.z. on cybersecurity, Slov-Lex
- Act No. 69/2018 Z.z. on cybersecurity (consolidated text), Slov-Lex
- Národný bezpečnostný úrad (NBÚ), official site
- SK-CERT, national Computer Security Incident Response Team
- JISKB, Jednotný informačný systém kybernetickej bezpečnosti, operated by NBÚ
- European Commission, NIS 2 implementation page for Slovakia
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
