| B1 | NIS2 Scope Determination | Čl. 2, 3, Annex I/II | Příprava | Spadáme pod NIS2? Jaký režim? (Essential/Important) |
| B1.1 | – Kategorizace služby | Čl. 3, Annex I/II | Příprava | Cloud computing, ICT service, DNS, email, nebo jiné? |
| B1.2 | – Size threshold analýza | Čl. 2(1) | Příprava | Počet zaměstnanců, obrat (medium/large enterprise) |
| B1.3 | – Registrace NÚKIB | Čl. 3(4) | Příprava | Zaregistrovat se u NÚKIB (pokud applicable) |
| B2 | GAP Analýza | Čl. 21 | Analýza | Posouzení současného stavu vs. NIS2 požadavky |
| B2.1 | – Current state assessment | Čl. 21 | Analýza | Audit současných bezpečnostních opatření |
| B2.2 | – Gap identification | Čl. 21(2) | Analýza | Identifikace mezer vs. 10 základních opatření |
| B2.3 | – Remediation roadmap | Čl. 21 | Analýza | Plán nápravy s prioritami |
| B3 | Governance & Management | Čl. 20 | Governance | Odpovědnost managementu za kybernetickou bezpečnost |
| B3.1 | – Management accountability | Čl. 20(1) | Governance | Schválení bezpečnostní politiky boardem |
| B3.2 | – Management training | Čl. 20(2) | Governance | Školení managementu v kybernetické bezpečnosti |
| B3.3 | – Security committee | Čl. 20 | Governance | Bezpečnostní výbor s pravidelným reportingem |
| B4 | ISMS Setup | Čl. 21 | Implementace | Zavedení řízení bezpečnosti dle NIS2 + ISO 27001 |
| B4.1 | – Security policy | Čl. 21(2)(a) | Implementace | Politika bezpečnosti informací |
| B4.2 | – Asset Inventory | Čl. 21(2)(a) | Implementace | Inventura: HW, SW, data, sítě – co je kritické? |
| B4.3 | – Risk Assessment | Čl. 21(2)(a) | Implementace | Risk assessment dle NIS2 metodologie |
| B4.4 | – Risk Treatment Plan | Čl. 21(2)(a) | Implementace | Mitigate/Avoid/Accept/Transfer + timeline |
| B5 | Technical Controls (10 opatření) | Čl. 21(2) | Implementace | Implementace 10 základních bezpečnostních opatření |
| B5.1 | – Risk management policies | Čl. 21(2)(a) | Implementace | Politiky a postupy pro řízení rizik |
| B5.2 | – Incident handling | Čl. 21(2)(b) | Implementace | Procesy pro řešení incidentů |
| B5.3 | – Business continuity | Čl. 21(2)(c) | Implementace | BCP, DRP, crisis management |
| B5.4 | – Supply chain security | Čl. 21(2)(d) | Implementace | Bezpečnost dodavatelského řetězce |
| B5.5 | – Network security | Čl. 21(2)(e) | Implementace | Zabezpečení sítí a informačních systémů |
| B5.6 | – Vulnerability handling | Čl. 21(2)(e) | Implementace | Vulnerability management, disclosure |
| B5.7 | – Security effectiveness | Čl. 21(2)(f) | Implementace | Měření efektivity bezpečnostních opatření |
| B5.8 | – Cyber hygiene & training | Čl. 21(2)(g) | Implementace | Základní kybernetická hygiena, školení |
| B5.9 | – Cryptography | Čl. 21(2)(h) | Implementace | Politiky pro kryptografii a šifrování |
| B5.10 | – HR security | Čl. 21(2)(i) | Implementace | Bezpečnost lidských zdrojů, access control |
| B5.11 | – MFA & secure auth | Čl. 21(2)(j) | Implementace | Vícefaktorové ověřování, secure comms |
| B6 | Technical Controls Detail | Čl. 21(2) | Implementace | Specifické technické kontroly |
| B6.1 | – Encryption at rest | Čl. 21(2)(h) | Implementace | AES-256 pro data at rest |
| B6.2 | – Encryption in transit | Čl. 21(2)(h) | Implementace | TLS 1.3 pro data in transit |
| B6.3 | – Access Control (MFA + RBAC) | Čl. 21(2)(i,j) | Implementace | MFA pro všechny admin účty, RBAC |
| B6.4 | – Patch Management | Čl. 21(2)(e) | Implementace | Patch SLA <30 dní pro kritické |
| B6.5 | – Monitoring & Logging (SIEM) | Čl. 21(2)(b) | Implementace | SIEM, 1 rok retention |
| B6.6 | – Backup & Recovery | Čl. 21(2)(c) | Implementace | 3-2-1 backup, testováno čtvrtletně |
| B6.7 | – Firewall & IDS/IPS | Čl. 21(2)(e) | Implementace | Perimeter a internal firewall, IDS/IPS |
| B6.8 | – Endpoint protection | Čl. 21(2)(e) | Implementace | EDR/XDR na všech endpoints |
| B6.9 | – Network segmentation | Čl. 21(2)(e) | Implementace | Segmentace sítí, microsegmentation |
| B7 | Incident Response | Čl. 21(2)(b), 23 | Implementace | Incident Response Plan a procesy |
| B7.1 | – Incident Response Plan | Čl. 21(2)(b) | Implementace | Dokumentovaný IRP |
| B7.2 | – Incident Response Team | Čl. 21(2)(b) | Implementace | Definovaný IRT s rolemi |
| B7.3 | – On-call rotace | Čl. 21(2)(b) | Implementace | 24/7 dostupnost pro kritické incidenty |
| B7.4 | – Incident classification | Čl. 23(3) | Implementace | Klasifikace závažnosti incidentů |
| B7.5 | – Evidence preservation | Čl. 21(2)(b) | Implementace | Forensics, chain of custody |
| B8 | Incident Reporting (NÚKIB) | Čl. 23 | Reporting | Hlášení incidentů dle NIS2 timeline |
| B8.1 | – Early warning (24h) | Čl. 23(4)(a) | Reporting | Předběžné hlášení do 24 hodin |
| B8.2 | – Incident notification (72h) | Čl. 23(4)(b) | Reporting | Hlášení incidentu do 72 hodin |
| B8.3 | – Final report (1 měsíc) | Čl. 23(4)(d) | Reporting | Závěrečná zpráva do 1 měsíce |
| B8.4 | – NÚKIB contact established | Čl. 23 | Reporting | Kontakt na NÚKIB, registrace v portálu |
| B9 | Business Continuity | Čl. 21(2)(c) | Implementace | BCM/DRP plány |
| B9.1 | – Business Impact Analysis | Čl. 21(2)(c) | Implementace | BIA pro kritické služby |
| B9.2 | – Business Continuity Plan | Čl. 21(2)(c) | Implementace | BCP dokumentace |
| B9.3 | – Disaster Recovery Plan | Čl. 21(2)(c) | Implementace | DRP s RTO/RPO |
| B9.4 | – RTO/RPO definovány | Čl. 21(2)(c) | Implementace | RTO <4h, RPO <1h pro critical |
| B9.5 | – DR testing (annual) | Čl. 21(2)(c) | Testování | Roční testování DR plánů |
| B10 | Supply Chain Security | Čl. 21(2)(d) | Implementace | Bezpečnost dodavatelů a třetích stran |
| B10.1 | – Vendor risk assessment | Čl. 21(2)(d) | Implementace | Risk assessment pro všechny kritické vendors |
| B10.2 | – Security questionnaire | Čl. 21(2)(d) | Implementace | Standardizovaný security questionnaire |
| B10.3 | – Vendor certifikace (ISO/SOC) | Čl. 21(2)(d) | Implementace | Požadavek na ISO 27001 / SOC 2 |
| B10.4 | – Vendor access control | Čl. 21(2)(d) | Implementace | Řízení přístupu vendorů, JIT access |
| B10.5 | – Vendor monitoring | Čl. 21(2)(d) | Implementace | Průběžný monitoring vendorů |
| B11 | Vulnerability Management | Čl. 21(2)(e) | Testování | Správa zranitelností |
| B11.1 | – Vulnerability scanning | Čl. 21(2)(e) | Testování | Měsíční vulnerability scanning |
| B11.2 | – Penetration testing | Čl. 21(2)(e) | Testování | Roční penetrační testy |
| B11.3 | – Patch SLA defined | Čl. 21(2)(e) | Implementace | Critical <7d, High <30d, Medium <90d |
| B11.4 | – Vulnerability disclosure | Čl. 21(2)(e) | Governance | Coordinated vulnerability disclosure policy |
| B12 | Training & Awareness | Čl. 21(2)(g) | Training | Školení zaměstnanců v kybernetické bezpečnosti |
| B12.1 | – Security awareness program | Čl. 21(2)(g) | Training | Pravidelné awareness školení |
| B12.2 | – Phishing simulations | Čl. 21(2)(g) | Training | Čtvrtletní phishing testy |
| B12.3 | – Role-specific training | Čl. 21(2)(g) | Training | Specializované školení pro IT, developers |
| B12.4 | – Training records | Čl. 21(2)(g) | Training | Evidence absolvovaných školení |
| B13 | Continuous Monitoring (SOC) | Čl. 21(2)(b,e) | Monitoring | 24/7 monitoring bezpečnosti |
| B13.1 | – SOC capability | Čl. 21(2)(b) | Monitoring | Interní SOC nebo managed SOC |
| B13.2 | – Threat detection | Čl. 21(2)(b) | Monitoring | Detekce hrozeb (SIEM, EDR, NDR) |
| B13.3 | – Security metrics | Čl. 21(2)(f) | Monitoring | KPIs pro bezpečnost |
| B13.4 | – Threat intelligence | Čl. 21(2)(b) | Monitoring | Integrace threat intelligence feeds |
| B14 | Security Audits | Čl. 21(2)(f) | Audit | Interní a externí audity |
| B14.1 | – Internal audits | Čl. 21(2)(f) | Audit | Měsíční interní audity |
| B14.2 | – External audits | Čl. 21(2)(f) | Audit | Pololetní externí audity |
| B14.3 | – Audit findings tracking | Čl. 21(2)(f) | Audit | Sledování nálezů a nápravy |
| B15 | ISO 27001 Certification | Doporučeno | Certifikace | Formální certifikace (silně doporučeno) |
| B15.1 | – ISO 27001 gap analysis | ISO 27001 | Certifikace | GAP analýza vs. ISO 27001 |
| B15.2 | – ISO 27001 Stage 1 audit | ISO 27001 | Certifikace | Dokumentační audit |
| B15.3 | – ISO 27001 Stage 2 audit | ISO 27001 | Certifikace | Implementační audit |
| B15.4 | – Certifikace | ISO 27001 | Certifikace | Získání certifikátu |
%3btext-align:center%3b%7d%23mermaid-0 .edgeLabel p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .edgeLabel rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .labelBkg%7bbackground-color:rgba(232%2c 232%2c 232%2c 0.5)%3b%7d%23mermaid-0 .cluster rect%7bfill:%23ffffde%3bstroke:%23aaaa33%3bstroke-width:1px%3b%7d%23mermaid-0 .cluster text%7bfill:%23333%3b%7d%23mermaid-0 .cluster span%7bcolor:%23333%3b%7d%23mermaid-0 div.mermaidTooltip%7bposition:absolute%3btext-align:center%3bmax-width:200px%3bpadding:2px%3bfont-family:arial%2csans-serif%3bfont-size:12px%3bbackground:hsl(80%2c 100%25%2c 96.2745098039%25)%3bborder:1px solid %23aaaa33%3bborder-radius:2px%3bpointer-events:none%3bz-index:100%3b%7d%23mermaid-0 .flowchartTitleText%7btext-anchor:middle%3bfont-size:18px%3bfill:%23333%3b%7d%23mermaid-0 rect.text%7bfill:none%3bstroke-width:0%3b%7d%23mermaid-0 .icon-shape%2c%23mermaid-0 .image-shape%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3btext-align:center%3b%7d%23mermaid-0 .icon-shape p%2c%23mermaid-0 .image-shape p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bpadding:2px%3b%7d%23mermaid-0 .icon-shape .label rect%2c%23mermaid-0 .image-shape .label rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .label-icon%7bdisplay:inline-block%3bheight:1em%3boverflow:visible%3bvertical-align:-0.125em%3b%7d%23mermaid-0 .node .label-icon path%7bfill:currentColor%3bstroke:revert%3bstroke-width:revert%3b%7d%23mermaid-0 :root%7b--mermaid-font-family:arial%2csans-serif%3b%7d%3c/style%3e%3cg%3e%3cmarker id='mermaid-0_flowchart-v2-pointEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 0 L 10 5 L 0 10 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-pointStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='4.5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 5 L 10 10 L 10 0 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='11' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='-1' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossEnd' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='12' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossStart' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='-1' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cg class='root'%3e%3cg class='clusters'/%3e%3cg class='edgePaths'%3e%3cpath d='M200.172%2c388L200.172%2c392.167C200.172%2c396.333%2c200.172%2c404.667%2c200.172%2c412.333C200.172%2c420%2c200.172%2c427%2c200.172%2c430.5L200.172%2c434' id='L_F1_F2_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F1_F2_0' data-points='W3sieCI6MjAwLjE3MTg3NSwieSI6Mzg4fSx7IngiOjIwMC4xNzE4NzUsInkiOjQxM30seyJ4IjoyMDAuMTcxODc1LCJ5Ijo0Mzh9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M200.172%2c794L200.172%2c798.167C200.172%2c802.333%2c200.172%2c810.667%2c200.172%2c818.333C200.172%2c826%2c200.172%2c833%2c200.172%2c836.5L200.172%2c840' id='L_F2_F3_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F2_F3_0' data-points='W3sieCI6MjAwLjE3MTg3NSwieSI6Nzk0fSx7IngiOjIwMC4xNzE4NzUsInkiOjgxOX0seyJ4IjoyMDAuMTcxODc1LCJ5Ijo4NDR9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M200.172%2c1224L200.172%2c1228.167C200.172%2c1232.333%2c200.172%2c1240.667%2c200.172%2c1248.333C200.172%2c1256%2c200.172%2c1263%2c200.172%2c1266.5L200.172%2c1270' id='L_F3_F4_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F3_F4_0' data-points='W3sieCI6MjAwLjE3MTg3NSwieSI6MTIyNH0seyJ4IjoyMDAuMTcxODc1LCJ5IjoxMjQ5fSx7IngiOjIwMC4xNzE4NzUsInkiOjEyNzR9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M200.172%2c1654L200.172%2c1658.167C200.172%2c1662.333%2c200.172%2c1670.667%2c200.172%2c1678.333C200.172%2c1686%2c200.172%2c1693%2c200.172%2c1696.5L200.172%2c1700' id='L_F4_F5_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F4_F5_0' data-points='W3sieCI6MjAwLjE3MTg3NSwieSI6MTY1NH0seyJ4IjoyMDAuMTcxODc1LCJ5IjoxNjc5fSx7IngiOjIwMC4xNzE4NzUsInkiOjE3MDR9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3c/g%3e%3cg class='edgeLabels'%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F1_F2_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F2_F3_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F3_F4_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F4_F5_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='nodes'%3e%3cg class='root' transform='translate(24.671875%2c 1696)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F5' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='356'/%3e%3cg class='cluster-label' transform='translate(25.96875%2c 8)'%3e%3cforeignObject width='299.0625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 5: TRAINING %26amp%3b AUDIT %e2%80%94 Pr%c5%afb%c4%9b%c5%ben%c4%9b%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-B12-12' transform='translate(175.5%2c 70)'%3e%3crect class='basic label-container' style='' x='-125.9140625' y='-27' width='251.828125' height='54'/%3e%3cg class='label' style='' transform='translate(-95.9140625%2c -12)'%3e%3crect/%3e%3cforeignObject width='191.828125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB12: Training %26amp%3b Awareness%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B14-13' transform='translate(175.5%2c 174)'%3e%3crect class='basic label-container' style='' x='-101.59375' y='-27' width='203.1875' height='54'/%3e%3cg class='label' style='' transform='translate(-71.59375%2c -12)'%3e%3crect/%3e%3cforeignObject width='143.1875' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB14: Security Audits%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B15-14' transform='translate(175.5%2c 290)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB15: ISO 27001 Certification%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(24.671875%2c 1266)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F4' data-look='classic'%3e%3crect style='' x='-16.671875' y='8' width='384.34375' height='380'/%3e%3cg class='cluster-label' transform='translate(-12.671875%2c 8)'%3e%3cforeignObject width='376.34375' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 4: KONTINUITA %26amp%3b MONITORING %e2%80%94 M%c4%9bs%c3%adc 4-6%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-B9-9' transform='translate(175.5%2c 70)'%3e%3crect class='basic label-container' style='' x='-114.4921875' y='-27' width='228.984375' height='54'/%3e%3cg class='label' style='' transform='translate(-84.4921875%2c -12)'%3e%3crect/%3e%3cforeignObject width='168.984375' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB9: Business Continuity%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B11-10' transform='translate(175.5%2c 186)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB11: Vulnerability Management%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B13-11' transform='translate(175.5%2c 314)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB13: Continuous Monitoring %e2%80%94 SOC%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(24.671875%2c 836)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F3' data-look='classic'%3e%3crect style='' x='0.796875' y='8' width='349.40625' height='380'/%3e%3cg class='cluster-label' transform='translate(4.796875%2c 8)'%3e%3cforeignObject width='341.40625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 3: TECHNICK%c3%89 KONTROLY %e2%80%94 M%c4%9bs%c3%adc 3-6%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-B5-6' transform='translate(175.5%2c 82)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB5: Technical Controls %e2%80%94 10 opat%c5%99en%c3%ad%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B6-7' transform='translate(175.5%2c 210)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB6: Technical Controls Detail%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B10-8' transform='translate(175.5%2c 326)'%3e%3crect class='basic label-container' style='' x='-127.390625' y='-27' width='254.78125' height='54'/%3e%3cg class='label' style='' transform='translate(-97.390625%2c -12)'%3e%3crect/%3e%3cforeignObject width='194.78125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB10: Supply Chain Security%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(24.671875%2c 430)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F2' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='356'/%3e%3cg class='cluster-label' transform='translate(38.2734375%2c 8)'%3e%3cforeignObject width='274.453125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 2: Z%c3%81KLADY ISMS %e2%80%94 M%c4%9bs%c3%adc 2-4%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-B4-3' transform='translate(175.5%2c 70)'%3e%3crect class='basic label-container' style='' x='-86.921875' y='-27' width='173.84375' height='54'/%3e%3cg class='label' style='' transform='translate(-56.921875%2c -12)'%3e%3crect/%3e%3cforeignObject width='113.84375' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB4: ISMS Setup%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B7-4' transform='translate(175.5%2c 174)'%3e%3crect class='basic label-container' style='' x='-110.5' y='-27' width='221' height='54'/%3e%3cg class='label' style='' transform='translate(-80.5%2c -12)'%3e%3crect/%3e%3cforeignObject width='161' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB7: Incident Response%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B8-5' transform='translate(175.5%2c 290)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB8: Incident Reporting %e2%80%94 N%c3%9aKIB%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(24.671875%2c 0)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F1' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='380'/%3e%3cg class='cluster-label' transform='translate(57.5390625%2c 8)'%3e%3cforeignObject width='235.921875' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 1: P%c5%98%c3%8dPRAVA %e2%80%94 M%c4%9bs%c3%adc 1-2%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-B1-0' transform='translate(175.5%2c 82)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB1: NIS2 Scope Determination%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B2-1' transform='translate(175.5%2c 198)'%3e%3crect class='basic label-container' style='' x='-91.2265625' y='-27' width='182.453125' height='54'/%3e%3cg class='label' style='' transform='translate(-61.2265625%2c -12)'%3e%3crect/%3e%3cforeignObject width='122.453125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB2: GAP Anal%c3%bdza%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-B3-2' transform='translate(175.5%2c 314)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eB3: Governance %26amp%3b Management%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)