Neither this page nor the check result is legal advice or an assessment of legal compliance.
What NIS2 and the new Cyber Security Act are
NIS2 is an EU directive on cyber security that member states transpose into their national laws. In Czechia it was taken over by the new Cyber Security Act, in force since 1 November 2025. Supervision is carried out by the National Cyber and Information Security Agency.
Put simply: a company covered by the act should know which systems and data it uses and what threatens them, and have appropriate measures in place. It must report serious incidents, and the company's management is responsible for cyber security.
Who it affects
Previously it concerned mainly critical infrastructure and large institutions. Now the act also covers medium-sized companies, typically those with 50 or more employees, or with both annual turnover and balance sheet total above EUR 10 million, if they operate in the listed sectors. These include, for example, energy, transport, healthcare, digital services, manufacturing of selected products, food production or public administration.
The obligations go far beyond the website: they cover risk management, backups, access to systems, suppliers, training and incident reporting. Companies not subject to the act themselves often meet its requirements as suppliers to a regulated company.
What this means for the website and e-mail
The website and e-mail are only a small part of security, but they are visible from outside: anyone vetting suppliers looks there first. An unencrypted website, a domain in whose name anyone can send e-mail, or software past end of support reveal that the basics are not under control.
What WebMeter checks, and what it doesn't
In the report you will find the Cyber hygiene section with eight basics that are visible from outside:
- encrypted connection (HTTPS, TLS 1.2 and newer)
- HTTPS enforced in the browser (HSTS)
- protection of e-mail against spoofing (SPF, DKIM)
- a DMARC policy for forged e-mails
- up-to-date website software without versions past end of support
- security headers
- contact for reporting vulnerabilities (security.txt)
- signed domain (DNSSEC)
The report also shows which third-party services the website loads immediately on opening, before the visitor gives consent, and in which country their operators are based.
WebMeter does not assess whether the act applies to you or whether you comply with it. It cannot see inside the company, into internal systems, backups or suppliers. The result is therefore neither an audit nor an expert opinion.