Main variables	Total
F.1 % of companies that apply some ICT security measure (0)	68,13
F.1.A % of companies that apply strong password authentication as an ICT security measure (1)	86,56
F.1.B % of companies applying authentication using biometric methods as an ICT security measure (1)	26,76
F.1.C % of companies that apply authentication based on a combination of at least two authentication mechanisms as an ICT security measure (1)	30,02
F.1.D % of companies that apply encryption of data, documents or emails as an ICT security measure (1)	25,29
F.1.E % of companies that apply data backup in a separate location as an ICT security measure (1)	71,04
F.1.F % of companies that apply network access control as an ICT security measure (1)	35,38
F.1.G % of companies that apply VPN as an ICT security measure (1)	20,98
F.1.H % of companies that apply an ICT security monitoring system that allows detecting suspicious activity as an ICT security measure (1)	16,66
F.1.I % of companies that implement log file maintenance that allows analysis after ICT security incidents as an ICT security measure (1)	14,06
F.1.J % of companies implementing an ICT risk assessment as an ICT security measure (1)	11,01
F.1.K % of companies that carry out ICT security tests as an ICT security measure (1)	13,01
F.2 % of companies that make their employees aware of their ICT security obligations (1)	48,91
F.2.A % of companies offering voluntary training or providing internally available information to make their employees aware of their ICT security obligations (2)	77,16
F.2.B % of companies that require mandatory training or material viewing courses for their employees to make them aware of their ICT security obligations (2)	46,99
F.2.C % of companies that contractually make their employees aware of their ICT security obligations (2)	37,28
F.3 % of companies that experienced an ICT security incident (0)	1,54
F.3.A % of companies that, in 2025, after experiencing an ICT security incident, experienced unavailability of ICT services of ICT services due to an attack from the outside (4)	71,09
F.3.B % of companies that, in 2025, after experiencing an ICT security incident, resulted in the destruction or corruption of data due to malware infection or unauthorized intrusion (4)	45,64
F.3.C % of companies that, in 2025, after experiencing an ICT security incident, resulted in the disclosure of confidential data due to intrusions, pharming, phishing or intentional actions of the employees themselves (4)	40