Czech Republic to participate in Cyber Europe 2026, Europe’s largest cyber crisis exercise

Cyber Europe 2026, Europe's largest exercise focused on testing the readiness of organizations and government institutions to respond to large-scale cyber incidents and crises, begins today. The exercise will last two days and involve dozens of organizations from European Union member states and EFTA countries, which will test their coordination, communication, and cooperation in managing serious cyber incidents affecting critical infrastructure and the functioning of society.

This year’s scenario focuses on the railway sector. In the Czech Republic, participants will include the national railway carrier České dráhy, the railway infrastructure operator Správa železnic, ministries, crisis management authorities, the National Cyber and Information Security Agency (NÚKIB), and other key organizations responsible for ensuring the functioning of the state and protecting critical infrastructure. The entire exercise is coordinated by the European Union Agency for Cybersecurity (ENISA) from its headquarters in Athens.

National coordination of the exercise in the Czech Republic is ensured by the CZ.NIC Association through the CSIRT.CZ team. CZ.NIC has been involved in organizing the Cyber Europe exercise since 2012, when the Czech Republic participated in the first annual event. This year’s exercise is thus the eighth European exercise that CZ.NIC has coordinated at the national level.

“The Cyber Europe exercise is a unique opportunity to test the most demanding communication and coordination in a completely safe environment. Participants can verify their procedures, processes, and cooperation with other entities without the risk of real-world consequences. This makes them much better prepared to handle real incidents, as they know which processes to activate, what their legal obligations are, whom to contact for coordination and assistance, and what their strengths and weaknesses are when working under the intense pressure that the exercise actually creates for participants,” says Věra Mikušová, security analyst at the CZ.NIC Association and national coordinator of the Cyber Europe exercise for the Czech Republic, who, together with NÚKIB representative Lucie Katolická and other coordinators from member states, will oversee the exercise directly at ENISA headquarters in Athens.

During both days of the exercise, experts from the CSIRT.CZ team will gather at the CZ.NIC headquarters and the CZ.NIC Academy in Prague, from where they will support the resolution of simulated incidents, information sharing, and international cooperation. Their role will also include providing technical expertise, coordinating communication with participating entities, and supporting the exchange of information between the national and European levels.

“I participated in the first Cyber Europe exercise back in 2012. A year later, we faced large-scale DDoS attacks in the Czech Republic that affected a number of major organizations. It was the experience gained during the exercise that helped me at the time, particularly in the areas of coordination, information sharing, and communication between organizations. When the real crisis hit, we had a much better idea of how to proceed and with whom to cooperate. That is the value Cyber Europe offers its participants,” says Michal Prokop, a member of the CSIRT.CZ team and its coordinator on behalf of the CZ.NIC Association.

Due to the fact that, under the new cyber security law, all participating organizations are subject to a higher level of obligations, NÚKIB will bear primary responsibility for coordinating incident response and crisis communication through the government CERT team it operates. This will allow participants to test the newly established processes, roles, and obligations arising from the new legislation—both toward constituent organizations and vice versa—in a practical setting within the NÚKIB framework. The exercise will also test the mechanisms of international cooperation within the CSIRTs Network and EU-CyCLONe, which ensure the coordination of both technical and strategic responses to large-scale cross-border cyber incidents.

ENISA holds the Cyber Europe exercise regularly every two years. Its goal is to strengthen the ability of European organizations to cooperate in addressing large-scale cyber incidents, test crisis procedures, and increase the resilience of critical infrastructure across Europe.