The Polish act on the national cybersecurity system (KSC), which implements the NIS2 directive, imposes specific obligations: from an information security management system, through monitoring and incident handling, to supply chain and personnel security.

We have aligned our offer with the legal requirements. It is split into 10 areas, each described by concrete actions and the evidence the auditor will see.

ISMS documentation: normative and operational policies and procedures
Risk analysis and risk treatment plan
Continuous monitoring (SIEM) and vulnerability management
Incident handling and CSIRT reporting via the S46 system
Business continuity, backups and restore tests
Supplier assessment, personnel vetting and audit preparation

Scope

10 compliance areas

Each area is a set of concrete tasks performed by our engineers, with an example.

Information Security Management System (ISMS)

Developing, implementing and periodically reviewing documentation and procedures that ensure the confidentiality, integrity and availability of data.

Example: Preparing a full set of policies (e.g. a password policy) and technical instructions for administrators, followed by an annual review of their effectiveness against changes in the infrastructure.

Risk assessment and management

Regular identification of threats to business processes, analysis of their impact and selection of proportionate technical measures.

Example: A full risk analysis for a critical ERP system, threat scenarios (e.g. ransomware, storage array failure) and implementation of missing safeguards.

Continuous security monitoring

Real-time oversight of information systems to detect anomalies and incidents.

Example: Deploying and running a SIEM system that analyses logs from servers and workstations and alerts an engineer on an attempt of unauthorised database access.

Vulnerability management

Systematic collection of information about software and hardware flaws and prompt remediation.

Example: Weekly automated vulnerability scans of the entire infrastructure, prioritisation of critical patches (e.g. for zero-day flaws) and installation in a maintenance window.

Patch management

Regular deployment of security patches after analysing their impact on service continuity.

Example: Testing a critical operating-system patch against business applications in a test environment before production rollout.

Incident handling and CSIRT reporting

Detecting, recording and analysing incidents and statutory communication with the competent CSIRT via the S46 system.

Example: After detecting a breach: containing the threat, preparing and submitting a serious-incident report to CSIRT via S46 within the required deadline.

Business continuity (BCP) and disaster recovery (DR)

Developing and testing plans for continuous service delivery and recovery instructions.

Example: A Disaster Recovery plan for a key database and an annual restore test from backup on new infrastructure, verifying the recovery time (RTO).

Supply chain security

Monitoring and assessing the security of ICT products and services supplied by subcontractors.

Example: Auditing the security procedures of a new cloud provider and verifying that a software vendor is not on the list of high-risk suppliers.

Personnel security

Ensuring that people performing cybersecurity tasks have the right permissions and no convictions for offences against information protection.

Example: Collecting and verifying current National Criminal Register certificates for engineers with administrative access before they start work.

Support in statutory KSC audits

Preparing for the mandatory external audit (every 3 years for essential entities) and providing evidence of ISMS implementation.

Example: Preparing operational documentation (logs, scan reports, BCP test records) and taking part in clarification sessions with the auditor.

Matrix

Obligations and IT services matrix

How our services map to KSC obligations and what evidence the auditor receives.

Area	Task / IT service	Legal basis	Evidence for the auditor
Risk management	Systematic incident risk assessment and management	Art. 8(1)(1)	Risk analysis report, risk treatment plan
Monitoring	Continuous infrastructure monitoring	Art. 8(1)(2)(g)	System logs, alerts from SIEM/SOC systems
Vulnerabilities	Collecting information about flaws (vulnerability management)	Art. 8(1)(3)	Scan reports, register of detected flaws
Updates	Patch analysis and deployment (patch management)	Art. 8(1)(5)(b)	Change log, pre-deployment test evidence
Flaw mitigation	Prompt action after a vulnerability is found	Art. 8(1)(5)(d)	Incident reports, configuration change confirmations
Documentation	Developing and updating ISMS documentation	Art. 10(1-3)	Policies and procedures (normative and operational)
Incidents	Incident handling and CSIRT reporting (S46)	Art. 11(1)	Incident register, CSIRT submission confirmations
Supply chain	Security management of direct suppliers	Art. 8(1)(2)(e)	Supplier assessments, cybersecurity clauses in contracts
Personnel	Criminal record and permission checks of specialists	Art. 8f	National Criminal Register certificates
Backup	Backups and restore tests	Annex 4	Backup schedules, recovery test records

Provisions of the Polish act on the national cybersecurity system.

Glossary

Legal basis in brief

An explanation of the provisions listed in the matrix.

Art. 8(1)(1)

The obligation to implement an information security management system providing systematic assessment and management of incident risk.

Art. 8(1)(2)(g)

The requirement to cover the information system used to provide the service with continuous monitoring.

Art. 8(1)(3)

The obligation to collect information about cyber threats and the information system’s vulnerability to incidents.

Art. 8(1)(5)(b)

The obligation to apply measures limiting the impact of incidents, including keeping software up to date.

Art. 8f

Personnel requirements: a person performing cybersecurity tasks provides a National Criminal Register certificate of no convictions for offences against information protection.

Art. 10(1-3)

The obligation to develop and apply normative documentation (policies, processes) and operational documentation (records proving activities were performed) on system security.

Art. 11

Incident handling obligations, including classifying incidents as serious and reporting them to the competent CSIRT.

Annex 4

Detailed requirements for the information security management system of an important entity that is a public body, including ICT product inventory and access control rules.

Blog