A risk analysis is the procedure in which a company finds out what it protects in its information systems, what threatens it and which measure comes first. Under Decree No. 409/2025 Coll., providers in the higher-obligations regime must do it at least once a year, and ISO/IEC 27001:2022 asks for the same thing in a different form. This guide walks you through seven steps and shows an example for a 50-person manufacturer.
A risk analysis is a systematic way to identify assets, threats and vulnerabilities, rate likelihood and impact, and decide what to do with each risk: reduce it, accept it, avoid it or transfer it. The result is not a nice document for a drawer, but a ranked list of what to fix first.
What the decree and ISO 27001 require from a risk analysis
The Czech Act on Cybersecurity (No. 264/2025 Coll.) has applied since 1 November 2025, together with its implementing decrees. For the higher-obligations regime that is Decree No. 409/2025 Coll., for the lower-obligations regime Decree No. 410/2025 Coll. Detailed risk management is described in the first one, in sections 7 and 8 and in annexes 3 and 4. The second has no separate chapter on risk management, but ISO 27001 will ask you for it anyway.
| Topic | Decree No. 409/2025 Coll. | ISO/IEC 27001:2022 |
|---|---|---|
| Method and criteria | A method for identifying and assessing risks, including acceptability criteria (section 8) | A risk assessment process with criteria (6.1.2) |
| Assets | A method for identifying and assessing assets, asset guardians, links between assets (section 7) | Assets and risk owners within 6.1.2, asset inventory in Annex A (5.9) |
| Threats and vulnerabilities | For every asset, at least by the categories in annex 3 | Risk identification within 6.1.2 |
| Repetition | At least once a year and after significant changes (section 8) | At planned intervals and after significant changes (8.2) |
| Risk treatment | A risk treatment plan with measures, responsible persons, resources and deadlines (section 8) | A risk treatment plan and its implementation (6.1.3, 8.3) |
| Statement of applicability | Mandatory, with reasons for measures not applied (section 8) | Statement of Applicability (6.1.3) |
We have covered the NIS2 basics and who the law applies to elsewhere, see the NIS2 page and the article NIS2 and the new Act on Cybersecurity. Here we stick to risk analysis.
How a risk analysis works, step by step
- Set the scope. Which systems, sites, processes and people are in. For a regulated service the scope follows from the service; for ISO 27001 you set it yourself.
- List the assets. Data, applications, servers, devices, suppliers and people. Every asset has a guardian, meaning the name of a specific person.
- Rate the assets. For primary assets the decree asks you to rate confidentiality, integrity and availability. A four-level scale is enough: low, medium, high, critical.
- Find threats and vulnerabilities. A threat is what can happen (ransomware, a lost laptop). A vulnerability is why it could succeed (no two-factor authentication, an unpatched system).
- Calculate the risk. Annex 4 of the decree gives the formula risk = asset value × threat × vulnerability with four-level scales. In ISO 27001 likelihood × impact is more common. Both are fine as long as you write the method down in advance and stick to it.
- Decide on treatment. The decree lists acceptance, reduction, elimination, avoidance and transfer of the risk. Every risk above the acceptability line gets a measure, an owner and a deadline.
- Write the outputs and repeat. A risk assessment report, a risk treatment plan and a statement of applicability. Then schedule the next round.
Asset register: where to start
An asset register is a table (or an application in a system) where every asset appears once, with a guardian and a rating. Most companies make the same mistake here: they start with servers. Start with information and processes, and only then attach the technical equipment they run on. The decree says it directly: supporting assets are rated mainly through their links to the primary ones.
- Primary assets: invoicing, production documentation, employee personal data, customer data.
- Supporting assets: servers, cloud services, laptops, network devices, production control systems.
- Links: accounting depends on the ERP, the ERP on a server and a backup, the backup on a storage supplier.
Example: risk analysis in a manufacturer with 50 people
Below is an illustrative table. The numbers are made up for this example, not measured at a real company. Both likelihood and impact use a 1 to 5 scale and the risk is their product. The bands (up to 6 low, 8 to 12 medium, from 15 high) are only an example, you set yours in the method.
| Asset | Threat and vulnerability | Likelihood | Impact | Risk | Measure (Annex A) |
|---|---|---|---|---|---|
| ERP and accounting | Ransomware, admin accounts without two-factor authentication | 3 | 5 | 15 (high) | Secure authentication (8.5), restricted permissions (5.15) |
| Drawings server | Data leak, folder permissions too broad | 3 | 4 | 12 (medium) | Access control (5.15), network segregation (8.22) |
| Phishing, staff with little training | 4 | 3 | 12 (medium) | Awareness training (6.3), protection against malware (8.7) | |
| Line control system | Old operating system without patches | 2 | 5 | 10 (medium) | Technical vulnerability management (8.8), separate network (8.22) |
| Sales reps' laptops | Loss or theft, unencrypted disk | 3 | 3 | 9 (medium) | User endpoint devices (8.1), cryptography (8.24) |
| Backups | Backup on the same network as the data, never tested | 2 | 5 | 10 (medium) | Information backup (8.13), continuity (5.30) |
The first row has a clear priority. You turn on two-factor authentication for admins and split the permissions, and likelihood drops from 3 to 2, so the residual risk is 10. Residual risk is what remains after the measure, and ISO 27001 wants the risk owner to accept it explicitly.
NIS2 and ISO 27001 risk analysis: treatment plan and statement of applicability
The analysis produces two documents that both the decree and ISO 27001 require. The risk treatment plan says what you will do, who answers for it, what it costs and by when. Decree No. 409/2025 Coll. also wants the link between a risk and a measure in the plan, not just a wish list.
The Statement of Applicability is a list of all measures, each with information on whether you use it, why and how. ISO/IEC 27001:2022 has 93 controls in Annex A in four themes: organizational (37), people (8), physical (14) and technological (34). You don't have to implement all 93, but every omission must be justified by risk.
How often to repeat a risk analysis
The minimum in the higher-obligations regime is once a year and always after a significant change, such as a new system, an incident or a merger. The decree also names the inputs: incidents, results of audits, penetration tests and vulnerability scans. That is why it makes sense to schedule a penetration test shortly before the annual round of the analysis, not after it.
Where xOffice fits
xOffice is the Lumenax ERP system built on open source Odoo 19. It includes an ISMS module with records for policies, risks, assets, security incidents and corrective actions, so you don't have to keep the asset register, risks and treatment plan in Excel and chase them over e-mail. The base is from 137 EUR a month, a full user from 10.99 EUR. More about the system is on the xOffice ERP page, and about audit preparation on the ISO 27001 page.
We prepare the system and the processes for an audit, but the certificate is issued by an accredited certification body. Lumenax is not an auditor. You can try the module in the demo after entering a code from an e-mail, or talk it over with a cybersecurity manager.
Frequently asked questions
Does a small company have to do a risk analysis without NIS2?
By law only if it provides a regulated service. If you want to certify against ISO 27001, risk assessment is a mandatory part of the standard (6.1.2), and without it you won't get the certificate.
Which risk assessment method should we use?
One you write down, approve and repeat. Annex 4 of Decree No. 409/2025 Coll. offers four-level scales and a formula, and the decree also allows another method of the same or a higher standard.
How often is a risk analysis repeated?
In the higher-obligations regime at least once a year and after significant changes. ISO 27001 speaks of planned intervals and significant changes (8.2), and you set the specific interval in the method.
Is an asset register mandatory?
In the higher-obligations regime yes, Decree No. 409/2025 Coll. requires a method for identifying assets, their guardians and the links between them. In ISO 27001 an asset inventory is one of the Annex A controls (5.9).
Can we do the risk analysis ourselves, or do we need an outside expert?
You can do it yourselves if someone on your side understands both the systems and the processes. An outside expert helps with the method and brings distance, but the risks belong to your people and you appoint the risk owners.
Sources
- Decree No. 409/2025 Coll. on security measures of a regulated service provider in the higher-obligations regime
- Decree No. 410/2025 Coll. on security measures of a regulated service provider in the lower-obligations regime
- Právní prostor: the new Act on Cybersecurity
- ISMS.online: ISO 27001:2022 Annex A
- Overview of ISO 27001 clauses 4 to 10
PHP2Shell vulnerability: does it affect your website and what to do
Free CRM: when it's enough and when it costs more than a paid one
Ollama: how to run local AI over your own company data
