The organization must establish and maintain clear procedures for reporting cyber security incidents to the relevant national authorities, such as the National Cyber and Information Security Agency (NUKIB) in the Czech Republic, as mandated by the Cyber Security Act.
These procedures must specify the primary and alternative communication channels to be used:
- Primary channel: The designated Authority's Portal (e.g., NUKIB Portal) should be used for all incident reports.
- Alternative channels: If the primary portal is unavailable, alternative reporting methods must be used.
- Regime-specific reporting: The procedures must differentiate between reporting channels for higher obligation regime providers (e.g., Authority's designated e-mail address or data box) and lower obligation regime providers (e.g., National CERT data box or e-mail).
Personnel involved in incident management and reporting must be trained on these procedures and the correct use of communication channels to ensure timely and compliant incident reporting.
