Cybersecurity as a management task: what the Act imposes on statutory bodies

The NIS2 Directive moved cybersecurity from the technical agenda into management decision-making. Slovak Act No. 69/2018 Coll. on Cybersecurity does not do so with a single sentence about the personal liability of a statutory representative. It imposes on an essential service operator a series of duties that cannot be discharged without the management: approving measures, providing regular information, allocating resources and designating responsible persons. This article is for managing directors and board members of companies entered in the register of the National Security Authority, or preparing to be.

What the Act imposes directly on management

The first duty is that the management should learn about cyber risks at all. The operator must create and implement an effective mechanism for informing the statutory body and the responsible senior employees in good time about threats, vulnerabilities, incidents, near misses, the results of risk analysis and the state of risk treatment (Section 19(6)(h)). It is therefore not enough that the IT department knows about a problem. The Act requires the information to reach those who decide, demonstrably.

The second duty is to determine who is responsible for what. The minimum security measures include designating a specific person or persons responsible for approving security measures, for oversight, control and audit, for securing adequate resources for cybersecurity management, and for training (Section 20(4)(h)). NBÚ Decree No. 227/2025 Coll. builds on that person: the results of the risk analysis and the proposed security measures must be approved by them in a demonstrable manner (Section 5(7) of the Decree). The security documentation must contain the approved cybersecurity strategy and the approved security policies (Section 4(1)(a) and (b) of the Decree).

The third duty concerns people. The operator must assign tasks, roles and responsibilities and provide adequate training and retraining for all roles established (Section 20(4)(g) and (i)). The Slovak Act does not formulate a separate duty to train statutory representatives expressly and leaves the details of training to the authority’s implementing regulation (Section 32(1)(h)). If it is the management that approves the measures, however, it is in its interest to understand what it is signing. Finally, the appointment of, or a change in, the statutory body must also be notified to the authority, unless it is reference data (Section 19(6)(i)).

The cybersecurity manager does not replace management

The Act requires a cybersecurity manager who, in designing, adopting and enforcing measures, is independent of the management structure for IT operations and development and meets the knowledge standards (Section 20(4)(a)). That is an important role, but it is a different role from approval and resource allocation. The manager proposes and enforces; the person the company designates under Section 20(4)(h) approves and funds. If that line is not clearly drawn in the internal rules, it is hard to prove on inspection who decided to accept a risk.

When the duties are not met

The principal addressee of penalties is the company. For breach of most duties under Section 19(6), including the mechanism for informing management, the authority may impose on the operator a fine of up to EUR 7,000,000 or 1.4% of worldwide annual turnover, and for a critical essential service up to EUR 10,000,000 or 2% of turnover (Section 31(2) and (3)). An individual who has not acted in accordance with the technical, organisational or personnel measures adopted commits a minor offence carrying a fine of EUR 100 to EUR 5,000 (Section 30(1)(d) and (2)).

For an operator of a critical essential service, the Act goes further and reaches the individuals in management directly:

If an essential service operator that operates a critical essential service fails to fulfil the duty under paragraph 1(a) or (b), even within the additional period specified in the authority’s notice, the authority may, according to the seriousness, extent, duration, consequences and nature of the shortcomings identified, prohibit the statutory body of the essential service operator or a member of the statutory body of the essential service operator, its senior employee at the highest level of management responsible for the relevant activity, or an authorised representative entrusted with carrying out that activity, from performing their office, employment or activity with the essential service operator, until those duties are fulfilled.

— Section 29j(4) of Act No. 69/2018 Coll. (unofficial English translation)

The duties referred to are the cybersecurity audit and the remedial measures imposed by the authority. The prohibition therefore does not come without warning, but after a failure to comply with the authority’s notice even within the additional period.

Liability towards the company itself

Alongside the public-law penalties, company law applies as well. A managing director of an s. r. o. must exercise their powers with professional care, obtain and take into account in their decision-making all available information, and compensate the company for loss caused by breaching their duties (Section 135a(1) and (2) of the Commercial Code). If the company suffers loss, for instance from an operational outage after an incident, the managing director escapes liability only by proving that they acted with professional care and in good faith that they were acting in the company’s interest (Section 135a(3)). Agreements excluding or limiting a managing director’s liability are prohibited (Section 135a(4)). In defending a claim, therefore, the decisive point is the record showing that the management received the information, assessed the risks and decided on the measures.

Setting this up in practice

We recommend four steps in particular. First, name the person under Section 20(4)(h) in the internal rules and separate their powers from the cybersecurity manager’s role. Second, introduce regular written reporting to management, and immediate reporting for exceptional events. Third, document approvals of the risk analysis, the strategy and the policies by resolution or minutes. Fourth, reflect the allocation of tasks in the service agreement, so that it is clear which member of management is responsible for the area.

We prepare the legal part, including the allocation of responsibilities and the internal rules, through our NIS2 and cybersecurity service, and the arrangement of managing directors’ duties through our service agreement for company officers service. Related duties are discussed in cybersecurity audit and self-assessment and to whom and by when to report a cyberattack, and the contractual side in NIS2 in supplier contracts.