NIS2 in Poland: who is in scope, KSC deadlines and how to comply

A comprehensive guide to understanding, implementing and getting real value from NIS2 in an organisation operating in Poland.

1. Introduction: what is NIS2 and why should you care?

Imagine you run a company in Poland. You have customers, suppliers, employees, IT systems, financial data and, most likely, several technology platforms that keep your business running.

Now imagine that tomorrow you suffer a cyberattack that means:

• Your systems stop working for several days.
• Your employees lose access to the information they need to do their jobs.
• Your customers' data is exposed.
• Your suppliers cannot reach you.
• Your company loses revenue, faces claims and has to explain to the authorities how the incident happened.

NIS2 exists precisely to reduce the likelihood and the consequences of situations like these.

The NIS2 Directive (Network and Information Security Directive 2) is a piece of European Union legislation that aims to raise the level of cybersecurity in organisations providing services that matter to the economy, to society and to the functioning of the Member States.

Its purpose is not simply to make you install antivirus software, buy a firewall or acquire IT tools.

It aims to ensure your organisation is able to:

1. Identify the technology risks that could affect its operations.
2. Prevent incidents through appropriate controls.
3. Detect potential attacks and respond to them in good time.
4. Maintain or restore its services when something goes wrong.
5. Demonstrate that it manages its information security responsibly.

The core idea is that cybersecurity should stop being the sole concern of the IT department and become a business responsibility.

That involves senior management, technology leads, lawyers, accountants, HR managers and, to varying degrees, the whole organisation.

Is NIS2 already mandatory in Poland?

Yes. Poland transposed NIS2 into national law by amending the Ustawa o krajowym systemie cyberbezpieczeństwa (National Cybersecurity System Act), known as the KSC.

The amendment was passed on 23 January 2026, published on 2 March 2026 and entered into force on 3 April 2026.

Its official reference is Dz.U. 2026 poz. 252 (Journal of Laws 2026, item 252).

The President signed the act on 19 February 2026 and announced that he would ask the Constitutional Tribunal to review some of its provisions, including the penalty regime, after enactment. That review does not suspend the act, which remains in force.

In other words, this is not a legislative proposal or a law awaiting approval: it is in force, and many organisations are currently in the process of adapting to it.

Key dates

These dates reflect the official timetable, but specific rules apply depending on the category of entity, when it came into scope and its previous status.

Important: the initial registration deadline expired on 3 October 2026. If your organisation was required to register and has not yet done so, you should review its classification immediately and regularise its position. The general adjustment period running to April 2027 is not an automatic extension of the registration deadline.

2. Which companies must comply with NIS2 in Poland?

One of the first questions you are likely to ask is:

Is my company actually required to implement NIS2?

The answer depends on three key factors:

• The sector in which you operate.
• The size and characteristics of your organisation.
• How important the services you provide are.

Polish law distinguishes between two categories of organisation.

Essential entities (podmioty kluczowe)

These are organisations whose activities are particularly important to the functioning of the country, its core services or its infrastructure.

Examples include certain energy companies, financial institutions, digital infrastructure operators and healthcare organisations.

They are subject to more demanding security, supervision and audit obligations.

Important entities (podmioty ważne)

These are organisations whose activities could also have significant consequences if they suffer an incident, although their classification and supervisory regime are different.

Examples include certain manufacturers, food distributors, postal services and digital service providers.

Both categories have cybersecurity obligations. Being classified as an important entity does not mean you can do without controls; the classification mainly affects the supervisory regime and certain audit obligations.

Sectors covered by the legislation

This table is a simplification. Annexes 1 and 2 to the KSC identify specific activities and types of entity; not every company in a given sector is automatically in scope.

Does the size of your company matter?

Yes, although it is not the only criterion.

Broadly speaking, the legislation uses the EU definition of enterprise size, which takes into account headcount, turnover, balance sheet total and, in certain cases, linked or partner enterprises.

As a guide:

You should not treat this table as a definitive classification test. The Polish KSC contains significant exceptions.

For example, DNS service providers, top-level domain (TLD) name registries, entities providing domain name registration services and qualified trust service providers are essential entities regardless of their size (Article 5(1)(4) of the KSC). There are also specific rules for managed security service providers, electronic communications services and certain public entities.

In addition, classification may depend on your relationships with other companies.

What about a small technology company?

Suppose you run a company that offers web hosting, server administration, backups and cybersecurity services.

It would be wrong to assume you are automatically exempt simply because you have only five employees.

You need to check whether your activities legally fall into categories such as:

• MSP (Managed Service Provider): a provider that manages systems, networks, applications or technology infrastructure on behalf of third parties.
• MSSP (Managed Security Service Provider): a provider that manages information security services on behalf of third parties.
• Cloud provider: a provider of cloud computing services.
• DNS provider: a provider of DNS services.

These categories may be treated differently. For example, Polish law expressly addresses managed security service providers within its specific classification rules.

You should also distinguish between reselling a service, actively managing a customer's infrastructure and operating your own infrastructure. These are not always the same regulated activity.

Bottom line: before you commission any NIS2 implementation, you need to establish formally whether your company is in scope, for which activity and under which category.

A. NIS2 from the business owner's perspective

3. What does implementing NIS2 mean for your company?

From a business perspective, implementing NIS2 means putting in place an organised system to identify, prevent, manage and reduce the IT risks that could disrupt your operations.

It is not just about buying technology.

In fact, an organisation could invest heavily in information security and still be non-compliant if it lacks policies, defined responsibilities, procedures or evidence that its controls actually work.

A practical example

Imagine you run a food distribution business.

You have warehouses, employees, and inventory, ordering and invoicing systems.

Your IT infrastructure may be hosted on a third party's servers.

A ransomware attack locks up the inventory system and halts trading for three days.

Without a security strategy, you may well not know:

• Which systems were affected.
• Whether your backups work.
• Who needs to authorise the recovery.
• Which suppliers need to get involved.
• Which authorities need to be informed.
• How long it will take to restore operations.

With a proper implementation, you should have procedures in place that reduce that uncertainty.

The company would have identified its key systems, the people responsible, emergency protocols, operational fallbacks and mechanisms for restoring its services.

NIS2 aims to make your business capable of withstanding and recovering from incidents, not to have you guarantee that they will never happen.

4. What do you actually need to implement?

The KSC requires in-scope entities to establish a System Zarządzania Bezpieczeństwem Informacji, known as the SZBI (information security management system).

This is a set of policies, processes, responsibilities, controls and evidence for managing security risks on an ongoing basis.

Its main components can be summarised as follows:

These components reflect the risk management obligations in the KSC, in particular Article 8.

Do you have to build everything from scratch?

Not necessarily.

If you already use Microsoft 365, Google Workspace, an ERP system, a managed hosting provider or professional security solutions, you probably have some capabilities you can build on.

However, you will need to check:

First, whether your existing tools provide the required level of security.

Second, whether they are correctly configured.

Third, whether there are policies and procedures governing their use.

Fourth, whether you can demonstrate that those procedures are followed.

For example, having backups does not in itself prove that you can restore your operations. You need to verify that they work and define how long you can afford to be without a service.

5. What business benefits can you gain?

Although implementation is driven by a regulatory obligation, the benefits can go well beyond formal compliance.

Lower operational risk

Less exposure to attacks, human error, data loss and disruption.

Revenue protection

If your services depend on digital systems, any disruption can mean financial losses.

A continuity strategy can reduce the duration and financial impact of such disruptions.

Greater commercial trust

Whenever a large organisation buys technology, logistics or industrial services, it needs to understand the risks posed by its suppliers.

Having documented controls in place can make its assessment process easier.

A better foundation for growth

A company with defined procedures, well-organised access, documented infrastructure and verifiable controls is usually better placed to grow without its risks multiplying in an uncontrolled way.

Less reliance on specific individuals

It is common to find organisations where only one person knows the passwords, servers or key procedures.

NIS2 encourages mechanisms to reduce that dependency through documentation, clear responsibilities and operational continuity.

6. How much does NIS2 implementation cost?

There is no single official rate for implementing NIS2.

The budget will depend on the characteristics of your organisation and the current state of its security.

To estimate it, it helps to separate three elements:

For example, a company with centralised systems and mature controls may mainly need documentation, adjustments and evidence.

Another company with outdated servers, shared accounts, inadequate backups and no procedures would need a considerably larger project.

Implementation should be scoped according to real risks and obligations, not according to how many technology products someone wants to sell you.

B. NIS2 from the technical director's perspective

7. What should a CTO, CIO or head of technology assess?

Now imagine you are the head of technology.

Senior management tells you that NIS2 needs to be implemented and asks how much it will cost and how long it will take.

Your first job should not be choosing tools.

You should establish whether the organisation can meet its obligations with the infrastructure, processes and team it already has.

This is known as a feasibility assessment and gap analysis.

8. First stage: know your infrastructure

You need to identify the technology components your services depend on.

For example:

The result should be an inventory complete enough to understand the dependencies of your key services.

Example

A clinic uses:

• A medical system hosted in a cloud service.
• A patient database.
• An invoicing system.
• Reception computers.
• A wireless network for staff.
• An external provider that manages the infrastructure.

Each of these components carries different risks.

Losing access to email for thirty minutes may be tolerable, whereas losing access to medical records for several hours could have serious consequences.

NIS2 requires you to identify these differences so that you can apply proportionate controls.

9. Risk assessment: the heart of the implementation

Not all risks are equal.

Consider, for example, three scenarios:

The aim is not to eliminate every single risk, which is practically impossible.

It is to identify them, assess their likelihood and impact, put proportionate controls in place and document the decisions taken.

You also need to decide who is authorised to accept residual risk.

In a regulated organisation, that decision should not be left informally to the server administrator.

10. Recommended technical controls

The table below maps the main security areas to well-known technologies and practices.

This does not mean that each product is mandatory by name. Decisions must be grounded in the risk assessment.

Two concepts deserve particular attention.

BCP (Business Continuity Plan): the plan that explains how the business will keep running when disruption occurs.

DRP (Disaster Recovery Plan): explains how you will restore your IT systems after a major incident.

They are not the same thing.

The BCP is concerned with keeping business operations going; the DRP focuses on restoring the systems that support them.

Two key metrics

RTO (Recovery Time Objective) is the maximum time you are prepared to take to restore a system after a disruption.

RPO (Recovery Point Objective) is how much data, measured as elapsed time, you can afford to lose.

Imagine a company sets an RTO of four hours and an RPO of one hour for its ordering system.

This means it designs its recovery to resume the service within four hours and, as a target, to lose no more than one hour's worth of data.

These are targets set by the organisation, not universal values laid down by NIS2.

11. Can you implement NIS2 using external providers?

Yes.

In fact, you do not necessarily need to build a full in-house cybersecurity department.

Polish law allows entities either to set up internal structures responsible for cybersecurity or to engage managed security service providers to carry out certain functions.

This makes several models possible:

• In-house model: your own team manages the controls, infrastructure and procedures.
• Outsourced model: contracted specialists carry out technical and security activities.
• Hybrid model: you keep governance, decision-making and oversight in-house while delegating certain operational activities.

For many medium-sized organisations, the hybrid model can be a practical choice.

However, there is a fundamental distinction:

Outsourcing technical activities does not remove your organisation's obligations or legal liability.

Contracts must set out what each provider does, how incidents are reported, what evidence the provider supplies, how it manages access and how services are restored.

This becomes particularly important when you engage providers based outside Poland.

Can cybersecurity be managed from another country?

In principle, certain technical functions can be delivered remotely from another Member State or from outside the European Union, provided the model meets the applicable obligations.

Among other things, you need to review data protection, access to sensitive information, contractual terms, availability to respond to incidents and any sector-specific restrictions.

There is no general rule requiring all of an NIS2 provider's technical staff to be physically located in Poland.

That said, specific requirements may still apply to particular sectors, contracts or systems.

12. ISO 27001, NIST and other standards: are they mandatory?

You have probably heard of ISO/IEC 27001.

It is an international standard that sets out the requirements for an information security management system.

There are also other useful frameworks:

The key question is:

Do you need ISO 27001 certification to comply with NIS2?

There is no general obligation to obtain that certification simply because you fall within the scope of the KSC.

However, using ISO 27001 as a management framework can make it much easier to organise and document the project.

On 10 September 2026, the Polish Ministry of Digital Affairs published an updated set of reference standards to help organisations implement the SZBI. It expressly stated that the list is for guidance only and does not automatically turn each standard on it into a legal obligation.

What about technology service providers?

Here there is an additional requirement.

Commission Implementing Regulation (EU) 2024/2690 lays down specific technical and methodological requirements for categories such as cloud computing service providers, data centre service providers, DNS service providers, managed service providers and managed security service providers.

Polish law expressly refers to that regulation for the relevant categories.

This is why handing every customer exactly the same NIS2 documentation pack would not be enough.

A manufacturing company and a managed service provider may need different controls and assessment criteria.

13. Incident detection and reporting

Another fundamental component is the obligation to identify and report certain significant incidents.

The legislation sets out distinct stages.

General reporting sequence for a significant incident

Under the KSC, the early warning and the notification run from the moment the incident is detected, and the final report from the date of the notification. Specific rules apply to certain providers (for example, trust service providers must report a serious incident within 24 hours) and public entities.

The Polish operational mechanism is the S46 Cyber Hub, which is used to report and follow up incidents with the relevant CSIRT teams.

Not every IT alert automatically constitutes a reportable significant incident. You need to apply the legal criteria and the relevant sector thresholds.

Why does this matter to the technical director?

Because having a reporting procedure is not enough.

You need the capability to:

Detect that something abnormal is happening, quickly determine its severity, preserve evidence, mobilise the right people and provide verifiable information.

If your company does not monitor its systems, you may discover an attack only when it is too late to respond properly.

14. What does a real implementation project look like?

A well-structured project can be divided into five phases.

How long can it take?

It depends on the complexity.

As a planning benchmark, not a guaranteed legal timeframe, an organisation with simple infrastructure could complete an initial project within a few months.

An entity with numerous legacy systems, industrial sites, multiple suppliers and international dependencies is likely to need longer.

An executive timeline should set out owners, dependencies, budget and acceptance criteria.

The general deadline of 3 April 2027 makes it especially important for in-scope entities that have not yet started to prioritise the highest-risk controls and outstanding obligations.

C. NIS2 from the legal perspective

15. Why should a legal department care about NIS2?

Because NIS2 is not just about technology.

It also changes the way companies must manage responsibilities, contracts, oversight and certain events that can have legal consequences.

From an in-house lawyer's perspective, NIS2 raises a fundamental question:

Can the organisation demonstrate that those in charge took reasonable decisions to protect the services they are responsible for?

That means compliance must be backed up by facts and documentation.

16. Liability of directors and senior management

One of the most significant aspects of the Polish amendment is management accountability.

The management of an in-scope entity must be involved in preparing, implementing and overseeing security management.

Article 8d of the KSC sets out obligations relating to decision-making, the allocation of responsibilities, financial resources and oversight.

In addition, Article 8e provides for annual documented training for management and for anyone to whom certain cybersecurity responsibilities are delegated.

And there is one particularly important point:

Engaging an external provider does not, in itself, relieve management of its responsibility.

What does this mean legally?

Imagine a company engages a provider to manage the security of its servers.

The provider makes a mistake and a significant incident occurs.

The company may have contractual claims against the provider where appropriate, but it cannot treat its regulatory obligations as fulfilled simply by showing the service invoice.

It needs to demonstrate that it selected the provider properly, defined responsibilities, put oversight controls in place and managed the relevant risks.

That is why the legal department needs to work alongside management and the technology team.

17. Supplier contracts: a critical area

Technology suppliers can pose significant risks to an organisation.

This includes hosting providers, SaaS platforms, cloud service operators, support companies, network administrators and developers with access to critical systems.

From a legal perspective, it is worth checking that contracts cover points such as:

There is no single clause that automatically makes a contract NIS2-compliant.

Commitments must be tailored to the service, the risks and the applicable legal provisions.

Example

A Polish company uses a storage platform managed from another country.

Its systems are secure and work properly.

However, it has never agreed contractually how quickly the provider must notify it of an incident.

If an attack occurs, it could lose hours waiting for information.

That delay could make it harder for the company to meet its own regulatory deadlines.

A sound contract review reduces that risk.

18. How does NIS2 relate to RODO/GDPR?

It is important to distinguish between the two.

RODO, the Polish name for the General Data Protection Regulation (GDPR), focuses on the processing and protection of personal data.

NIS2 deals with the cybersecurity and resilience of the systems and services of in-scope entities.

They can overlap, but they are not the same thing.

For example, ransomware could bring a business operation to a halt without necessarily causing a breach of personal data confidentiality.

Conversely, a limited data exposure could require an assessment under RODO even if it does not reach the NIS2 threshold for a significant incident.

Consequently, notification processes need to be coordinated, but not confused.

19. Penalties: what happens if you do not comply?

The KSC provides for substantial financial penalties.

The law also sets minimum penalties for certain infringements: PLN 20,000 for essential entities and PLN 15,000 for important entities.

These figures are statutory limits, not automatic fines. How they are applied depends on the conduct, the circumstances, the procedure and the specific provisions.

Can fines be imposed already?

Article 35 of the amendment provides that the financial penalties set out in certain provisions may be imposed for the first time only once two years have passed since entry into force, i.e. from April 2028. That provision does not mention the fine of up to PLN 100 million under Article 73(5) of the KSC.

However, this does not mean you can ignore the earlier deadlines.

The registration obligation already applies, implementation has its own timetable, and the authorities have supervisory tools that must be considered separately from the start of the financial penalty regime.

20. What can a lawyer contribute to the implementation?

A legal team can be involved from the outset, not only once an incident has occurred.

Its main contributions include establishing the company's legal scope, reviewing contracts, setting up communication procedures, allocating responsibilities, aligning the approach with data protection and checking document retention obligations.

It can also verify that staff-related processes are lawful.

For example, the KSC sets specific background check requirements for people performing certain security management and incident handling functions.

This does not mean you should indiscriminately request criminal records checks for all your employees. You must apply the relevant legal scope and protect the data processed.

The main legal benefit

Implementation creates a verifiable structure of corporate due diligence.

An organisation that can show approved decisions, assessed risks, reviewed contracts, procedures in use and documented corrective action is in a better position to respond to inspections and disputes.

This does not guarantee freedom from liability, but it does provide relevant evidence of how the organisation has been managed.

D. NIS2 from the accounting and finance perspective

21. What does an accountant have to do with cybersecurity?

More than it might seem at first.

Although NIS2 does not turn every accountancy firm into an in-scope entity, accounting and finance functions increasingly depend on digital systems.

Consider a company that uses:

• E-invoicing.
• ERP systems.
• Online banking platforms.
• Payroll systems.
• Tax document storage.
• Accounting software.
• Integrations with suppliers.

Disruption to these services can hamper collections, payments, tax filings and document retention.

That is why the finance function should be involved in managing the risks that affect those processes.

22. Direct benefits for the accounting function

Protecting financial documents

Implementing access controls, backups and recovery procedures can help protect invoices, contracts, tax documents and accounting records.

This reduces exposure to data loss or unauthorised changes.

Continuity of financial processes

The company can define procedures for operating during disruptions.

For example, if the accounting system fails temporarily, it helps to have documented how pending transactions will be recorded and how they will be reconciled once the service is restored.

Lower fraud risk

Identity controls, segregation of duties and activity logging can help detect or prevent unauthorised financial transactions.

Imagine an attacker gains access to a supplier's email account and tries to change the bank details to which payments are sent.

A procedure that requires such changes to be verified through an independent channel can significantly reduce that risk.

Stronger audit readiness

Having up-to-date documentation, identified owners and activity logs can make it easier to review certain internal controls.

It does not replace a financial audit or guarantee the integrity of the financial statements, but it can strengthen the control environment.

23. How does the finance department take part in the NIS2 project?

Polish law expressly requires management to plan adequate financial resources to meet its cybersecurity obligations.

A well-run implementation therefore requires coordination between technology and finance.

It is worth distinguishing between the following budget components:

The actual accounting and tax treatment depends on the applicable rules, the nature of each purchase and its contractual terms. NIS2 does not in itself determine how these outlays should be accounted for.

How do you assess the project financially?

You can use a cost-and-risk analysis.

For example:

A company estimates that a serious disruption to its operations could result in lost sales, recovery costs, overtime and contractual penalties.

The technical team proposes controls to reduce the likelihood of that scenario or limit its duration.

Finance compares the cost of the measures with the estimated impact and helps prioritise investment.

This does not mean you can calculate with mathematical certainty how much each control will save.

It means you can take better-informed budget decisions.

What about external accountancy firms?

An accountancy firm that is not directly subject to NIS2 may still benefit indirectly if it works with in-scope clients.

Those clients may ask for additional assurances about how information is handled, access control, continuity, incidents and the security of the services provided.

This creates an opportunity to improve the firm's services, but it may also bring new contractual requirements.

24. How does NIS2 relate to KSeF, Poland's e-invoicing system?

In Poland, it is worth distinguishing between two separate regulatory projects.

KSeF (Krajowy System e-Faktur, the National e-Invoicing System) covers the issuing and receipt of structured electronic invoices.

NIS2/KSC sets cybersecurity obligations for entities within its scope.

A company may be required to use KSeF without being directly subject to NIS2.

Likewise, an entity covered by NIS2 may use KSeF as one of its business systems.

From a technical and accounting perspective, there are important points of overlap.

If your operations depend on a KSeF integration, you should assess the security of its credentials, the availability of the integration, the protection of records and the procedures for handling failures.

However, being a KSeF user or integrator does not automatically make you an in-scope entity under NIS2.

Classification depends on the activities and criteria set out in the KSC.

25. Three business scenarios that help explain implementation

Case 1. A medium-sized food distribution company

The organisation depends on inventory, orders, warehouses and distribution.

Its main concern is that a technology incident could interrupt the flow of goods.

For this company, implementation would focus on protecting operational processes, documenting dependencies, managing technology suppliers and preparing continuity arrangements.

From a legal perspective, it would be important to review supplier responsibilities and incident notification.

From a financial perspective, the main interest would be reducing the losses caused by disruption.

Its legal classification must be verified against its specific activity and the KSC criteria.

Case 2. A web hosting and managed services provider

The company manages servers and websites for its customers.

In this case, it may be particularly important to examine whether it could be classified as a managed service provider, as digital infrastructure or under another applicable category.

Its infrastructure needs access controls, vulnerability management, continuity, monitoring and response procedures.

In addition, its customers may ask it for evidence to support their own NIS2 obligations.

The service contract becomes a cornerstone of risk management.

For certain technology categories, Implementing Regulation (EU) 2024/2690 is also directly relevant.

Case 3. A small accountancy firm

The firm handles financial information for a large number of clients.

Given its day-to-day activities and size, it may not be directly subject to the KSC, although this needs to be analysed rather than assumed.

Even so, it may receive security questionnaires from regulated clients.

By introducing multi-factor authentication, tested backups, access procedures and information handling rules, it improves its security and can respond more convincingly to those commercial requirements.

In this example, the main benefit of applying NIS2 good practice is contractual and operational, rather than necessarily meeting a direct legal obligation.

26. Frequently asked questions

Does NIS2 mean I have to hire a cybersecurity company?

Not necessarily. The organisation can combine internal and external resources depending on the scope of the functions, its obligations and its capacity.

What matters is that responsibilities are clear and controls are effective.

Can I comply with just antivirus and a firewall?

No. Those tools can form part of your controls, but risk management, continuity, documentation, oversight and incident management require additional measures.

Do I have to hire a CISO?

The legislation requires management responsibilities and capabilities, but it does not impose a general obligation on all entities to use the job title of CISO.

Whatever structure you choose must fulfil the required functions.

How many contact persons do I need to appoint?

The general Polish rule is to appoint at least two contact persons for the national cybersecurity system. There are exceptions for certain micro and small enterprises and important public entities, where one person may be sufficient.

Do I need external audits?

As a general rule, essential entities are subject to a periodic audit at least every three years.

For new essential entities covered by the transitional provisions, the first general deadline is 3 April 2028.

Important entities do not automatically have the same periodic obligation, although a competent authority may order audits in certain circumstances.

The statutory audit must meet independence and qualification requirements; it cannot necessarily be carried out by the same person who implemented and manages the controls.

Do I have to use tools made in Europe?

There is no general NIS2 rule requiring all tools or servers to come from European manufacturers.

However, specific obligations relating to suppliers, data transfers, supply chain risks and sector restrictions must be taken into account.

Can I use servers outside Poland?

In principle, yes, depending on the sector, the service, the data and the applicable rules.

But you need to assess the legal, operational and contractual risks, as well as the level of control you retain over your providers.

Does NIS2 replace RODO?

No. Both sets of rules can apply at the same time.

Does NIS2 replace DORA?

Not exactly. For certain financial entities, the DORA Regulation is a special sector-specific framework that takes precedence over some of the general NIS2 obligations.

DORA has applied since 17 January 2025. The Polish KSC expressly sets out coordination rules for the banking sector and financial market infrastructures.

Can I get a certificate stating that my company complies with NIS2?

You can obtain certain security certifications and undergo independent assessments.

However, you should not confuse a private certification, ISO 27001 certification and a KSC regulatory audit.

No generic commercial claim of "NIS2 certification" automatically replaces your legal obligations.

27. Recommended action plan for a company in Poland

If you were starting the project from scratch today, this would be a sensible roadmap.

The timeframes are indicative planning only. They should be adjusted to the organisation's current position and the applicable legal deadlines.

28. How will you know if your organisation is ready?

The best way to measure progress is to check outcomes, not simply count documents.

A reasonably well-prepared organisation should be able to answer yes, with evidence, to questions such as these:

• Do you know your classification and the legal obligations that apply?
• Have you identified your key services, systems and suppliers?
• Is there a documented risk assessment?
• Has management approved responsibilities and resources?
• Can you demonstrate that your controls are working?
• Have your backups and recovery plans been tested?
• Do you know who must act and report when an incident occurs?
• Can you demonstrate training, reviews and corrective action?
• Are your suppliers' responsibilities documented?
• Do you have a mechanism for monitoring compliance on an ongoing basis?

These questions do not replace a statutory audit, but they let you gauge your organisation's initial maturity.

29. Who in the company gains most from NIS2?

Each function benefits in a different way.

Implementation is most effective when these departments work together rather than running separate initiatives.

30. Legal framework and official resources

To go further with your implementation, these are the main references.

The Ministry of Digital Affairs also maintains self-identification materials, registration guides and references for designing the SZBI. It is worth checking the current version of the implementing acts for your sector before closing a project.

31. Conclusion: implementing NIS2 means transforming business risk management

NIS2 represents a major shift in how organisations need to think about cybersecurity.

It is no longer enough to think of security as keeping devices up to date or installing particular tools.

The company needs to understand the risks to its services, assign responsibilities, put controls in place, prepare for continuity and demonstrate that those measures work.

From a business standpoint, it is an opportunity to protect operations and strengthen commercial trust.

From a technology standpoint, it drives more controlled, better documented and more resilient infrastructure.

From a legal perspective, it demands more rigorous management of responsibilities, contracts and evidence.

And from an accounting perspective, it makes it possible to link security investment to asset protection, financial continuity and loss reduction.

The difference between formal compliance and genuine readiness matters: an organisation can have hundreds of pages of policies and still be vulnerable if its controls do not work.

That is why a proper NIS2 implementation must combine legal compliance, business management, technical security and continuous oversight.

In Poland, where the KSC amendment is already in force, the immediate priority for a potentially in-scope entity is to determine its classification correctly, check its registration status and run an adaptation project ahead of the deadlines that apply to it.

The ultimate goal should not be limited to avoiding penalties, but to building an organisation that can keep delivering its services even when it suffers a cybersecurity incident.