Strategické sladění bezpečnostních opatření s obchodními cíli firmy

The thesis investigates the strategic alignment of security measures with business objectives in an environment regulated by the NIS2 Directive, the new Czech Cybersecurity Act and selected information security management standards, in particular ISO/IEC 27001. The primary aim is to design and illustrate, on the basis of available data, a framework that helps organisations transform regulatory requirements and a traditionally compliance-oriented view of security into a business-enabling instrument. The theoretical part is based on a systematic literature review focused on business enablement, strategic business–IT alignment, cultural and human factors of alignment, and key regulatory and normative frameworks (NIS2, the Czech Cybersecurity Act, ISO/IEC 27001, NIST IR 8286B). The empirical part uses secondary quantitative analysis of four security audits (Org A–D) performed under Act No. 181/2014 Coll. and Decree No. 82/2018 Coll., complemented by qualitative analysis of narrative comments from audit reports of six organisations (Org A–F). The results reveal recurring weaknesses in governance, risk management, use of business impact analysis, definition of service level agreements and business continuity planning, as well as communication gaps between top management, business owners, IT and security teams. Building on these findings, the thesis proposes a strategic alignment framework that links the domains of asset management, BIA and risk, SLA and architecture, operations and continuity, and management and culture with regulatory requirements and identified problem areas. The framework is complemented by an implementation roadmap for a model organisation, demonstrating how to apply it under resource constraints and how to support its long-term sustainability.