Protection of Soft Targets in the Czech Republic Still Lacks a Functional System. Waiting for the State May Not Be Enough

9. 2. 2026

What happened

The Czech Supreme Audit Office (NKÚ) has published a report stating that even after eight years, the Ministry of the Interior has not established a fully functioning national system for the protection of so-called “soft targets” — such as schools, hospitals, cultural institutions, shopping centres, and other publicly accessible spaces.

According to the audit, not all planned pillars of the system were implemented. Long-term coordination was missing, there was no clear methodology for identifying the highest-risk locations, and funding was not set up in a sustainable way. Activity increased significantly only after the tragic attack at Charles University’s Faculty of Arts in 2023.

The audit covered the period 2021–2025 and involved several ministries. The conclusion is uncomfortable: protection of soft targets remains fragmented and systemically incomplete.

Analysis of weaknesses

Unclear coordination and ownership

Without a clearly defined owner and long-term management structure, a system remains more of a strategic document than an operational mechanism.

No structured prioritization of high-risk locations

Without a clear methodology for identifying and ranking risks, resources cannot be allocated effectively. Protection efforts then tend to be reactive or inconsistent.

Gaps in training and preparedness

Educational and preparedness activities were interrupted in 2022–2023. Security readiness, however, cannot depend on reacting only after a major incident.

Incomplete warning and notification mechanisms

Systematic early warning and direct communication with selected institutions were not fully implemented. Without fast information flow, response capability is limited.

What this means for organizations

The key lesson is straightforward: relying solely on a centralized system is not enough. Every publicly accessible institution must take active responsibility for its own security framework.

At a minimum, this should include:

A realistic risk assessment of the specific facility — including entry points, movement of people, crisis scenarios, and weak spots.
Clearly defined minimum security standards — access control rules, visitor management procedures, and crisis response protocols.
Regular testing of preparedness — leadership and staff must know what to do in the first critical minutes of an incident.
Functional crisis communication plans — both internal and external.
Continuous monitoring and rapid response mechanisms- the first 30–60 seconds often determine the scale of consequences.

Takeaway

The SAO report is not only a critique of the state. It is a reminder that prevention cannot be a one-time reaction to tragedy.
Protecting soft targets is not about a single project or subsidy. It is a long-term process that connects governance, technology, and the human factor.
Organizations that start building a systematic approach before becoming part of the headlines will always have an advantage.