Dopady nového zákona o kybernetické bezpečnosti na řízení ICT v organizaci

This thesis examines the impact of the new Cybersecurity Act on ICT management within an organization. The main objective of the thesis is to analyse the impact of the new legislation on ICT management and based on a case study of a selected organization to assess the level of compliance of the sales department with legislative requirements. The theoretical part of this thesis focuses on the legislative framework for cybersecurity in the Czech Republic, particularly on the new Cybersecurity Act and its relationship to the NIS2 Directive. The thesis also includes an analysis of the relationship between legislative requirements and selected ICT and cybersecurity management frameworks, specifically the ISO/IEC 27000 series of standards and the COBIT 2019 framework. The practical section takes the form of a case study of a selected organization. To assess the current state, a checklist based on the requirements of the new legislation was created, which was used to evaluate the organization’s level of compliance in individual areas of cybersecurity management. The analysis identified nine major shortcomings, particularly in the areas of risk management, asset management, supplier management, business continuity, and the formalization of security processes. Based on the findings, twelve organizational and procedural measures were proposed, supplemented by a recommended implementation schedule and recommendations for using the ISO/IEC 27002 standard and the COBIT 2019 framework during the implementation process. The contribution of this thesis lies in linking legislative requirements with practical principles of ICT management and developing a methodological document that provides a selected organization with a structured overview of the state of cybersecurity, identified shortcomings, and recommended steps for addressing them. The results of this thesis may provide a foundation for the systematic enhancement of cybersecurity and the advancement of ICT governance in organizations, including those that are not currently directly affected by the requirements of the new Cybersecurity Act.