ŠAVŠ/TAČR Digital Czechia in a Digital Europe

29

costs, such as reputational costs, which could have an adverse effect on the Czech economy in the medium term. The Czech Republic should strive to create a system of tax relief and financial incentives in order to create an environment so that cyber security companies can more easily establish and expand. There should also be projects in which such companies would provide government employees (especially those working in the ICT sectors) with professional training, internships or expert programs focused on cyber threats. Last but not least, the Czech Republic should provide financial support or relief to strategically important companies that decide to increase their cyber security. When providing cyber security, especially with regard to public institutions and ministries, it is necessary to proceed primarily in the form of protection of key functions. There is often a strong emphasis on securing the systems and information they contain. However, it is more important to preserve the ability of institutions to perform their basic functions during and immediately after a cyberattack. In segments such as healthcare, social assistance, security, etc., such disruption of functions would have very disruptive effects on the running of society. In defining and providing cyber security, state institutions must, in the first phase, primarily identify the basic functions that are key to the functioning of society and which these institutions must be able to perform under any conditions. In the second phase, it is necessary to identify the infrastructure and processes that are necessary to perform such functions. Only in the third phase is it necessary to propose measures that will focus primarily on the protection of this infrastructure. Said protection of the processes and functions of state institutions, rather than the mere protection of internal systems as such, should be the basic building block of the cyber security of the Czech Republic. Finally, key institutions and bodies must have a system of alternative solutions in case of disruption of the basic functions of ICT infrastructure and public administration services. A detailed list of recommendations for the Czech Republic in this area is found on pages 151 to 152.