Critical Infrastructure in Practice: Obligations and Procedures for Critical Entities

Act No. 367/2024 Coll. on Critical Infrastructure sets out the basic obligations and the deadlines by which a critical entity must fulfil them. However, moving from identification to practical resilience requires more than preparing documentation. The entity must know which assets its essential service depends on, what could threaten it, and what steps it will take if the service is disrupted.

The following overview explains the individual steps in the order in which they follow on from one another.

1. Assign responsibilities after receiving the notification

The first step is to review the notification identifying the entity as critical and specifying the sector and subsector to which it belongs. It is important to identify precisely which essential service and which critical infrastructure the obligations apply to.

The entity’s management should promptly appoint the people responsible for coordinating compliance with the legal requirements. The process should involve, in particular, staff responsible for security, operations, risk management, crisis management, human resources, and information technology.

The Act also requires the designation of a contact person and an authorised person for the critical entity. The contact person is responsible for communication with the relevant central government authority, the Ministry of the Interior of the Slovak Republic, and other critical entities. The authorised person performs the tasks necessary to ensure the resilience of critical infrastructure and has access to the entity’s premises, its critical infrastructure, and restricted information.

TIP: Set up an internal team, assign responsibilities, and establish how decisions and communications will be handled. Without a clear division of tasks, it will be difficult to fulfil the subsequent obligations in a coordinated manner.

2. Conduct a risk assessment - within nine months at the latest

A critical entity must conduct its own risk assessment within nine months of receiving the notification identifying it as critical.

The aim is not merely to compile a list of possible threats. The entity must assess which events could disrupt the provision of its essential service, how likely they are to occur, and what consequences they would have for operations.

The assessment must take into account, in particular:

• natural hazards and risks caused by human activity;
• accidents, natural disasters, and threats to public health;
• hybrid and other intentional threats, including terrorism;
• cross-border and cross-sector risks;
• dependencies on other sectors, services, and entities, including foreign suppliers;
• the possible consequences of a disruption to the essential service for other sectors and the public.

The risk assessment must also draw on relevant information and assessments made available to the critical entity by the relevant central government authority. Existing risk analyses, such as those relating to cybersecurity, and other relevant materials should also be taken into account.

TIP: The risk assessment should reflect the entity’s actual operations. A general threat analysis is not enough. The entity needs to identify specific vulnerabilities, dependencies, and scenarios that could lead to an interruption of its essential service.

3. Prepare a security plan based on the risks - within ten months at the latest

The security plan follows from the risk assessment. A critical entity must adopt it within ten months of receiving the identification notification and must then comply with it.

The security plan must describe the critical infrastructure and its location, including GPS coordinates, and set out a range of technical, organisational, personnel, and control measures.

The Act identifies six main areas that the plan must cover:

• Incident prevention — measures to reduce the likelihood of incidents, including consideration of disaster risk and adaptation to climate change.
• Physical protection — appropriate security for sites and infrastructure, mechanical barriers, and technical security systems.
• Incident response — procedures for handling incidents, crisis management, security alerts, and mitigation of consequences.
• Operational recovery — measures to restore the provision of the essential service, ensure business continuity, and identify alternative supply chains.
• Personnel security — management of the security of employees and external workers, access authorisations, and designation of people permitted to enter protected areas or work with restricted information.
• Awareness and training — informing employees about security measures, training, information materials, and exercises.

The security plan should not be a merely formal document. It must reflect the results of the risk assessment and describe measures that the entity has actually implemented or intends to implement.

The Act also allows entities to use documents and measures they have already prepared or adopted under other legislation. However, using them does not automatically mean that the requirements of the Critical Infrastructure Act have been met. The relevant central government authority decides whether they are fully or partially compliant.

TIP: Before preparing new documents, map your existing security, crisis-management, and operational plans. Identify which requirements they already cover and where the gaps are. This will help you avoid unnecessary duplication.

4. Put the measures into day-to-day practice

Adopting a security plan does not bring the entity’s obligations to an end. A critical entity must ensure that the adopted measures are applied in practice.

The Act expressly requires the entity to:

• maintain the technologies that protect and support the proper functioning of its critical infrastructure;
• inform employees about the security plan to the extent necessary;
• follow the security plan when there is a risk of disruption to or destruction of critical infrastructure;
• ensure the restoration of continuity in the provision of the essential service;
• provide the relevant authorities with the required cooperation.

Particular attention should be paid to suppliers and external services. An outage affecting an energy supplier, telecommunications services, information systems, spare parts, or other inputs may also threaten an entity whose own infrastructure is technically well protected.

TIP: Prepare an overview of critical suppliers and dependencies, including indirect ones, and identify an alternative for each. Check that the measures in the plan work in day-to-day operations, not just on paper.

5. Prepare for incidents and regularly practise procedures

The security plan must include procedures for managing incidents and restoring the provision of the essential service. These procedures need to be tested in practice.

A critical entity must conduct an exercise, in accordance with its security plan, simulating a threat to the disruption or destruction of its critical infrastructure and the provision of its essential service at least once every four years. The exercise should be more than a formal fulfilment of an obligation. It should test whether employees know their roles, whether communication works, whether decision-making authority is clear, and whether the entity can ensure the continuation or restoration of the essential service.

It is equally important to establish an internal incident-reporting process. A critical entity must notify the relevant central government authority of every incident that meets the specified thresholds. The notification must be submitted electronically using the method designated and published by the relevant central government authority.

The thresholds take into account, in particular, the number of affected users, the duration of the disruption, and the geographical extent of its consequences. The entity should therefore know who will assess an incident, who will decide whether it must be reported, and who will communicate with the relevant authority.

TIP: Plan the exercise around a specific scenario and assign roles in advance so that it tests decision-making and communication, not merely attendance. Also decide in advance who will assess an incident, who will decide whether it must be reported, and who will communicate with the central government authority.

6. Regularly update documentation and measures

Neither the risk assessment nor the security plan is a one-off document.

A critical entity must update its risk assessment as necessary, and at least once every four years. It must also review the security plan as necessary, at least once every four years, and update the adopted measures based on the results. An update is also required if the relevant central government authority makes new or updated information about risks in the sector available and sets a deadline for revising the security plan.

The entity is also required to notify the relevant central government authority of certain changes that may affect its identification as critical or the provision of its essential service. Examples include a change in the entity’s business activities or the transfer of critical infrastructure to another entity. The Act sets a 30-day deadline for these notification obligations.

Compliance may be inspected by the relevant central government authority. If there is reasonable suspicion that obligations are not being met, the authority may conduct or order an audit. Breaches of certain obligations may result in an administrative fine.

TIP: Add review deadlines to your calendar and establish triggers for updates outside the four-year cycle as well. Report changes such as a transfer of infrastructure or a change in business activities within 30 days.

How can the Critical Infrastructure Association of the Slovak Republic help a critical entity?

Meeting the requirements of the Act calls for expertise in several areas — from risk management and physical protection to cybersecurity, crisis management, energy, and supply chains. Not every critical entity has all of this expertise available in-house.

The Critical Infrastructure Association of the Slovak Republic (AKI SR) can help its members by giving them access to expert information, experience, and contacts needed to address specific tasks.

Membership in AKI SR offers, in particular:

• Expert guidance on requirements: information about legislative changes, methodological guidance, and current issues in critical infrastructure protection.
• Opportunities to discuss specific issues: sharing experience in risk assessments, preparation of security plans, infrastructure protection, and ensuring the continuity of essential services.
• Access to specialist and technology partners: contacts with member companies and experts working in physical and cybersecurity, energy, monitoring, and communications technologies.
• Participation in professional meetings: opportunities to discuss practical challenges with other critical entities, experts, government representatives, and academia.

AKI SR does not replace a critical entity’s responsibility to fulfil its legal obligations or the remit of the relevant public authorities. It does, however, provide a professional environment where its members can obtain information, discuss procedures, and seek solutions alongside organisations facing similar challenges.



For a critical entity, membership in AKI SR is an opportunity not to face its new obligations alone — and to gain access to expertise, experience, and partners who can help turn legal requirements into practical measures.