Cybersecurity
I help public offices and companies prepare for NIS2 and the Polish National Cybersecurity System Act (KSC). I usually start with a gap assessment, then put in place what is missing: network security, backups, procedures and monitoring.
Compliance
Protection
Testing
Monitoring
Resilience
Start with a gap assessment. Afterwards you know where you stand against the requirements and what to do first.
How the audit worksPoland implements the NIS2 Directive through an amendment to the National Cybersecurity System Act (KSC). It covers essential and important entities, including public administration bodies. Each organisation determines for itself whether the act applies to it.
3 April 2026
The amended National Cybersecurity System Act, implementing the NIS2 Directive, comes into force.
3 October 2026
Deadline for registering in the list of essential and important entities (wykaz-ksc.gov.pl). If the act applies to an organisation that has not registered yet, it should do so as soon as possible.
3 April 2027
End of the period for adapting systems and procedures, including putting an information security management system in place.
A few typical situations and what I do about them.
“We don't know whether NIS2 applies to us.”
I look at the sector, size and type of activity. If the act applies, I help with registration and an adaptation plan. If it does not, I prepare a written justification in case anyone asks.
“We have a KRI audit or an inspection in a few months.”
I review the documentation and how work is done in practice, then point out the gaps and the order in which to fix them. That way there are no surprises during the audit.
“We have a firewall, but nobody looks at the logs.”
I collect logs from firewalls, servers and Active Directory in one place (SIEM) and set up alerts. If the organisation has no on-call staff, I suggest an external SOC that works around the clock.
“Someone clicked a link in an e-mail and we don't know what to do next.”
I help assess the scale of the incident, secure the evidence and meet the deadlines: 24 hours for an early warning to CSIRT and 72 hours to report a personal data breach to the Polish data protection authority (UODO).
“We need a penetration test before the system goes live.”
I test the application and infrastructure from the internal network and from the internet. The report with risk ratings and recommendations is ready about two weeks after testing ends.
A review of security documentation and organisation against KRI, ISO/IEC 27001 and the KSC Act. It usually takes 3 to 6 weeks.
Current state, gaps and risks written up in one report.
A schedule of actions ordered by risk and budget.
MFA, segmentation, backups, procedures and staff training.
SIEM/SOC, penetration tests and regular reviews.
Tests from the internal network and from the internet. The basic scope takes about a day, the extended scope two days, and the report is ready in about two weeks.
Everything in the basic scope, plus:
The act covers essential and important entities in the sectors it lists, including public bodies. Each organisation determines for itself whether it is covered. I can carry out this analysis and prepare a justification for the decision.
A KRI audit is a mandatory information security audit, carried out at least once a year by bodies performing public tasks in Poland. A gap assessment is the first review before any changes: it shows where the organisation stands against KRI, ISO/IEC 27001 and the KSC Act, and where to start.
Usually 3 to 6 weeks from receiving the documentation. It depends on the number of documents and on the availability of the people responsible for each area.
No. A gap assessment covers documentation and the way work is organised. Penetration tests, vulnerability scanning or a review of Active Directory and firewall configuration can be ordered separately or added to the audit.
Under NIS2 and the KSC Act: an early warning within 24 hours, a notification within 72 hours and a final report within one month. If the incident involves personal data, the breach must also be reported to the data protection authority (UODO) within 72 hours.
No. Monitoring helps detect and report incidents, but policies, risk analysis, the business continuity plan and training remain the organisation's responsibility. An auditor checks both areas.
A gap assessment shows where you stand against NIS2 and the KSC Act, what to do first and how long it will take.