Two NÚKIB decrees say what your information system must be able to do under Act No. 264/2025 Coll.: Decree No. 409/2025 Coll. applies to the higher regime, Decree No. 410/2025 Coll. to the lower one. Both have been in force since 1 November 2025. An ERP covers only part of this. The security measures concern the whole network, the servers, e-mail and backups, not a single application. This text translates the technical requirements into an administrator's language and shows where the two decrees differ.
- The higher regime follows Decree 409/2025 Coll., the lower one Decree 410/2025 Coll., both in force from 1 November 2025.
- Both decrees want MFA, and passwords must have 12, 17 and 22 characters depending on the account type.
- In the higher regime logs are kept for at least 18 months, in the lower one you set the period yourself.
- In the higher regime backups must be test-restored, the lower regime does not ask for a test.
- The ERP is one of many technical assets, not the whole project.
Which decree applies to you
A provider that is highly significant for the Czech Republic is in the higher regime, other regulated firms fall into the lower one (§ 8 of the act). Which services and which firms belong where is set by Decree No. 408/2025 Coll. Who has to follow the act and how they are classified is covered in the text on NIS2 and the new act. The act repealed the old Decree No. 82/2018 Coll. (§ 72), and those who were already covered earlier keep meeting their old duties until the new deadlines run out (§ 71).
Decree No. 409/2025 Coll. has 29 sections, Decree No. 410/2025 Coll. only 15. In § 14 the act puts the technical measures of the higher regime into 11 items: from physical protection through identity management, logs and attack detection to cryptography, running the service without outages and industrial control systems. The lower regime has one list of 13 measures, where organisational and technical ones are mixed. The technical ones in it are rights and identities, detection and logs, protection of the network and of programs, and encryption.
What the decrees ask of the system
The table puts the sections side by side. Where one decree is stricter, it says so in the row.
| Topic | Higher regime (409/2025 Coll.) | Lower regime (410/2025 Coll.) |
|---|---|---|
| Access and rights | § 13 and § 20: roles or groups, only the rights needed, a separate account for the administrator, regular review of rights, rights are removed on a change of position and on leaving, everything is recorded | § 7: the same except mandatory recording and the central tool |
| MFA and passwords | § 19: MFA with at least two types of factors, passwords of 12, 17 and 22 characters, the system accepts a password of 64 characters | § 8: MFA and passwords of 12, 17 and 22 characters, no requirement for 64 characters |
| Logs | § 22: logins including failed ones, work with rights and privileged actions, central collection, keep for at least 18 months | § 9: the same fields for every event, the firm sets the retention period itself |
| Backups | § 26: regular backups, a restore test, results recorded, backups must be encrypted, a separate environment for backups | § 6(c): regular backups, the text does not ask for a restore test |
| Scans and pentest | § 24: a scan from the internal and external network at least once a year, a pentest at least once every 2 years, before launch and after a major change, a retest of findings | § 12(c): a regular scan of relevant assets, the decree does not ask for a pentest |
| Network | § 18: separate operations, backups, development, tests and administration, describe the topology, watch remote access | § 11: separate operations and backups, limit remote access to what is needed and keep a list of its users |
| Protection against malicious code | § 21: a centrally managed tool that protects continuously and automatically | § 9(1): continuous automatic protection of servers and end stations |
| Encryption | § 25: only currently resistant algorithms, secure e-mail, a tool for keys and certificates | § 13: only currently resistant algorithms, secure e-mail |
| Patches | § 24(1) and (2): supported versions, approved security patches, unsupported assets are recorded | § 12: the same, and for unsupported assets also limit their communication |
MFA and passwords: what the text says exactly
Both decrees want administrators, users and technical assets to log in with two different types of factors, for example a password and a code from a phone, or with continuous verification under a zero trust model (409 § 19(2), 410 § 8(2)). The text names no specific method. Until MFA runs, a fallback applies: keys or certificates, and only below them a password.
A password must have at least 12 characters for users, 17 for administrators and 22 for technical accounts. It must be changed at least once every 18 months and the system remembers the 12 previous ones. The higher regime also wants a list of accounts that do not meet MFA, with a reason for each (409 § 19(3)). A password for restoring access must expire no later than 24 hours after it comes into being.
Numbers worth writing down
- 18 months: the shortest log retention period in the higher regime (409 § 22(5)(c)). The lower regime sets none and the firm decides it by its own needs (410 § 9(3)).
- Once a year: at least this often a vulnerability scan from the internal and external network in the higher regime (409 § 24(4)).
- Once every 2 years: at least this often a pentest in the higher regime, and also before launch and after a significant change. If it is split into parts, the whole scope must be done within 5 years (409 § 24(5)). What to do after a test is described in the article on the retest.
- 1 year: from the day the agency delivers the decision on entering your service, you must start carrying out the security measures (§ 13(4) of the act).
What to do about your ERP supplier
If a supplier carries out the measures for you, then under § 13(5) of the act you must choose the supplier by the requirements of the measure and write the requirements into the contract. For an ERP that means asking before you sign:
- How long does the ERP keep logs and who may read them? The higher regime wants 18 months.
- How often does it back up, and when did the supplier last try to restore the data? In the higher regime this must be on record.
- Does the system support MFA for all accounts and who switches it on?
- Who sends the security patches, and how fast?
- Can the ERP keep roles and the administrator account apart from an everyday account?
The organisational side is described on the page about ISO 27001. The decrees do not mention this standard. What a test that checks the measures hold looks like is shown in the text on the penetration test.
What the xOffice page says about it
xOffice is the Lumenax ERP on open source Odoo 19. According to the xOffice page, the base includes an audit log kept for two years, daily backups with verified restore, monitoring and security patches. The system also has a password policy, an automatic session end for inactive users and a module for managing the ISMS.
That covers part of the table: the program's logs, data backups and patches. Two years of logs is more than the 18 months in Decree No. 409/2025 Coll., but it applies only to the ERP itself. The page does not mention MFA, backup encryption or central log collection, so we do not claim them for it. Ask about them whoever your supplier is.
Lumenax is not an auditor. According to the same page, an ISO 27001 certificate is issued by an accredited authority.
Mistakes that keep repeating
- The ERP as the whole project. A firm agrees MFA in the ERP and forgets the VPN, e-mail and end-user computers.
- Backups nobody tried to restore. The higher regime wants a test and a record of the result.
- One password for everything. Administrator accounts must have a password of 17 characters and a separate account.
- Logs without a retention period. The lower regime does not prescribe one, but the firm has to set it.
Common questions
Which decree applies from 1 November 2025?
Decree No. 409/2025 Coll. for the higher regime and Decree No. 410/2025 Coll. for the lower regime. The act repealed the old Decree No. 82/2018 Coll.
Is MFA mandatory?
Both decrees want it for administrators, users and technical assets. Until you have it, the fallback levels apply: keys or certificates and the password rules.
How long should logs be kept?
In the higher regime at least 18 months. In the lower one the firm sets the period itself by its own needs.
Do I have to test restoring backups?
In the higher regime yes, including recording the results (409 § 26(3)). Decree No. 410/2025 Coll. asks for regular backups and does not require a test explicitly.
Is it enough if the ERP meets the measures?
No. The measures concern all technical assets of the regulated service and the network around them. The ERP is one of them, next to servers, end-user computers and e-mail.
Sources
- Act No. 264/2025 Coll., version in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-264
- Decree No. 409/2025 Coll., in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-409
- Decree No. 410/2025 Coll., in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-410
- Decree No. 408/2025 Coll., on regulated services, in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-408
- Lumenax, xOffice ERP, verified on the page 12 October 2026, viewed 25 October 2026: https://www.lumenax.cz/erp-system
- Lumenax, Preparing for ISO 27001, viewed 25 October 2026: https://www.lumenax.cz/iso-27001
Risk analysis for NIS2 and ISO 27001: a step-by-step guide
NIS2 and the Czech cybersecurity act: who is covered and what to do
How to choose an ERP system: 7 questions before you sign
