ISMS: what it is and why not to build it only in Excel

An ISMS (information security management system) is a set of goals, rules, roles and records a firm uses to manage the protection of its data, and Decree No. 409/2025 Coll. defines it as the part of running a firm that is built on working with risk. Excel makes sense mainly in the lower regime, where Decree No. 410/2025 Coll. asks only for an overview of security measures. In the higher regime the decree asks for things a workbook cannot handle without a lot of extra work. Which regime you are in is set by Act No. 264/2025 Coll., in effect since 1 November 2025.

What an ISMS is and what it consists of

Section 2(g) of Decree No. 409/2025 Coll. says a firm establishes, introduces, operates, monitors, reviews, maintains and improves its ISMS. So it is a cycle, not a document. The firm sets goals, assesses risks, introduces security measures, checks that they work, and comes back to it a year later.

In practice this produces a handful of concrete outputs. A security policy. A risk assessment report. A risk treatment plan. A review report. The decree wants the firm to review them regularly and to name the person who is responsible for the review (Section 6(3) and (4)).

Who must have one and who can get by with a table

Under Section 8 of Act No. 264/2025 Coll. there are two regimes and each has its own decree. The higher-obligations regime applies to a provider that, because of its size, number of users, impact on its sector or the riskiness of its operation, is considerably significant for the Czech Republic. The lower regime applies to every other provider of a regulated service. Who falls under the act is shown in the article on NIS2 and the new act.

What exactly the higher regime has to maintain

This is where the things that are hard to do in Excel begin. Under Section 8 of Decree No. 409/2025 Coll. the firm:

• sets a method for how it identifies and assesses risks, including the criteria for when a risk is acceptable,
• assesses risks at least once a year and after significant changes, taking into account incidents, audit results, penetration test and vulnerability scan results and the annual check of whether the ISMS works,
• writes a risk assessment report and a list of which measures in the decree apply and which do not, with a reason for every measure it did not introduce (Section 8(1)(f)),
• writes a risk treatment plan with seven items: description of the measures, goals and benefits, responsible person, resources, deadline, links between risks and measures, and the concrete procedure.

On top of that come the annual check of whether the ISMS works under Section 3 with seven inputs, a review report, and an audit at least once every 2 years under Section 16. Penetration test results thus feed straight into the risk assessment, as the article on the retest after a penetration test describes.

Why Excel is not enough, and where it is

The following four points are our judgement, not the text of the decree. The decree does not prescribe a tool, it only says what the documents must meet.

1. Links. The decree wants links between assets recorded (Section 7(f)) and, in the risk treatment plan, links between risks and measures. A workbook holds that as long as one careful person maintains it. But errors in spreadsheets are well documented: a 2008 study by Powell, Lawson and Baker found errors in 0.8 to 1.8% of formula cells in 50 operational spreadsheets. According to the authors many errors have no impact, some do.
2. Records. Section 3(i) asks for activities around the ISMS and risk management to be recorded. Try it on your own workbook: can you tell from it a year later who changed what and why?
3. Protecting documents. Under Section 6(5) documents must be protected against leaks, unauthorised change and unavailability, and at the same time complete, legible, easy to identify and easy to find. A workbook on a shared drive that anyone can edit meets this only with extra rules.
4. Roles. Under Section 5 the manager must not run the operation of technical assets. Who may edit what is hard to set up in a plain table.

In the lower regime it is different. The overview of security measures under Section 3(2) of Decree No. 410/2025 Coll. is by its shape a list, and a table suits it. For a firm of twenty people in this regime it is an honest choice, as long as it follows the rules below.

What to do in a firm of twenty people

If you are in the lower regime, set up a table with the columns the decree prescribes:

• Measures you already have. For each, a description of how it is introduced.
• Measures you will introduce. For each, a deadline, a priority and the name of the responsible person.
• Measures you will not introduce. For each, a reason.
• Update the overview once a year and document the change. Keep old versions for at least 4 years.

The overview should have one owner and a separate file for each year, do not overwrite the old one. The decree does not prescribe the form, but you must keep the individual overviews and their newer versions, so an overwritten file is the worst option for you.

If you fall in the higher regime, start with a list of assets and their owners and with a risk assessment. Only then does it pay to pick a tool that holds the links between assets, risks and measures. For preparing for ISO 27001 certification there is the ISO 27001 page. It says this is an international standard for an ISMS and that the certificate is issued by an accredited certification body. The decree itself does not mention ISO 27001.

Mistakes that keep repeating

• A list of what applies and what does not, with no reasons. Every measure you do not introduce needs a reason.
• A risk plan without a name and a deadline. The decree wants a responsible person and a required deadline for every measure.
• A risk assessment done once and never again. It is to be done at least once a year and after significant changes.
• ISMS as an IT matter. Top management must complete training and provide resources, and the administrator will not do that for them.
• Exceptions without a process. Whoever makes exceptions to the policy must have a described way of approving them (Section 3(j)).

Sources

• Decree No. 409/2025 Coll., in force from 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-409
• Decree No. 410/2025 Coll., in force from 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-410
• Act No. 264/2025 Coll., version in force from 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-264
• S. G. Powell, B. Lawson, K. R. Baker, Impact of Errors in Operational Spreadsheets, arXiv:0801.0715, 4 Jan 2008: https://arxiv.org/abs/0801.0715
• Lumenax, Preparing for ISO 27001, viewed 25 Oct 2026: https://www.lumenax.cz/iso-27001