Proposed Specification of a Software Application for Risk Management under the New Cybersecurity Act

This thesis addresses the issue of asset inventory, risk documentation, and security controls in accordance with the requirements of the new Cybersecurity Act for organizations subject to the higher obligations’ regime. The aim of the thesis is to propose a methodology for recording assets, assessing risks, recording incidents, and managing security measures, and to use this methodology as a basis for drafting a specification for a software application that will enable organizations to systematically fulfill their legislative obligations. The proposed solution is based on an analysis of legal requirements, recommendations issued by the National Cyber and Information Security Agency (NÚKIB), and interviews with cybersecurity experts. The thesis also includes validation of the proposed methodology and the software specification through consultations with the expert community and potential users. The main outcome and contribution of this work is a comprehensive solution design that helps organizations effectively manage cyber risks, enhance their digital resilience, and at the same time simplify the administrative processes related to the new legislation.