NIS2 implementation · NIS2-compliant cybersecurity

Comply with NIS2 in Poland before 3 April 2027

We establish whether Poland's KSC applies to you, design your information security management system (SZBI) and get controls, continuity and incident reporting working, with evidence at every step.

Check for free whether NIS2 applies to you

30 minutes · free of charge · we'll be in touch to schedule

Key deadline Implementation and use of the S46 system: 3 April 2027
  1. 3 Oct 2026NIS2 registration deadline passedInitial general registration deadline for entities that already met the criteria when the amended KSC Act came into force on 3 April 2026.
  2. 3 Apr 2027General NIS2 deadlineGeneral deadline for implementing the obligations and using the S46 system.
  3. 3 Apr 2028NIS2 audits and finesFirst audit for certain essential entities, and the general start of financial penalties.
Not sure whether NIS2 applies to you? Check in 2 minutes

From "does this apply to us?" to evidence of compliance

Today
With HolaPolska!
You don't know whether you are an essential, important or out-of-scope entity, and the 3 October 2026 registration deadline has passed.
A formal classification by activity and category, with your entry in the KSC register reviewed or regularised.
You have security tools, but no policies, no owners and no proof that they work.
An SZBI with assessed risks, owners approved by management and evidence for every control.
When a serious incident hits, nobody knows who decides, what gets reported or by when.
A tested procedure to give early warning within 24 hours, notify within 72 and file the final report within a month via S46.

What you gain from a methodical implementation

24 h · 72 h · 1 month

Reporting without improvising

Your team knows how to detect, classify and report a serious incident within the legal deadlines, through S46.

Documented diligence

Management accountability

The KSC requires management to decide, allocate resources and oversee. We record their decisions and their annual training.

Confident customers

Answers ready for your customers

With documented controls, you answer the security questionnaires sent by regulated customers with confidence.

Deliverables

What you get

Everything is set out in writing in the proposal: scope, deliverables, owners and acceptance criteria.

Check for free whether NIS2 applies to you

Proposal · NIS2 implementation

  • Regulatory classification Whether you are an essential, important or out-of-scope entity, for which activity and under which category.
  • Assessment report and compliance matrix An inventory of systems, dependencies and suppliers, assessed risks and gaps against the KSC.
  • SZBI and risk treatment plan Policies, responsibilities, risk criteria, controls and procedures required by the KSC.
  • Working controls with evidence Hardened access, MFA, backups, documented suppliers and trained staff, with a record of each control in action.
  • Continuity and recovery plans BCP and DRP with defined RTO and RPO targets for your critical systems.
  • Incident and S46 procedure Detection, classification and reporting at 24 h, 72 h and one month, with named contact persons.
  • Testing and remediation plan Exercises, recovery tests and prioritised findings well before the deadline.
  • Requirements for your suppliers Security, incident notification, audit and exit clauses to review in your contracts.

How we work

Five phases to verifiable compliance

  1. 01 Immediate priority

    Assessment and classification

    We define the scope of your obligations and identify assets, dependencies, risks and gaps. Outcome: assessment report and compliance matrix.

  2. 02

    Management system design

    We define policies, responsibilities, risk criteria, controls and procedures. Outcome: a designed SZBI and a risk treatment plan.

  3. 03

    Operational implementation

    We configure tools, harden access, organise backups, document suppliers and train staff. Outcome: working controls and their evidence.

  4. 04 Before 3 April 2027

    Validation

    We test recovery, run incident simulations and review compliance. Outcome: test results, findings and a remediation plan.

  5. 05 Ongoing

    Operation and continuous improvement

    We monitor risks, handle incidents, review suppliers and keep controls up to date.

Who it is for

We implement; the statutory audit is independent

We leave your controls working and documented so you can demonstrate them. The audit required by the KSC is carried out by an independent, qualified auditor, and legal questions are validated with your lawyer.

  • Essential entitiesEnergy, transport, banking, health, water, digital infrastructure and other activities in Annex 1 to the KSC.
  • Important entitiesPostal services, waste, chemicals, food, certain manufacturing and digital service providers.
  • Managed IT providersMSPs, MSSPs, cloud and data centres, with specific requirements under Regulation (EU) 2024/2690.
  • DNS and domain registrarsThey are essential entities whatever their size, as are TLD registries.
  • Unregistered companiesYou were due to register by 3 October 2026 and have not yet done so.
  • Suppliers to regulated customersYou receive security questionnaires and need to answer with documented controls.

Frequently asked questions

Before you decide

Straight answers to the questions we are usually asked. If anything is still unclear, write to us.

It depends on your activity, your size and how critical your services are. The KSC annexes do not cover every company in a sector, and there are exceptions: DNS providers, TLD registries and domain registrars are in scope whatever their size. In the free assessment, we review your activity and tell you whether you need a formal classification.

Act now: the adjustment period running to April 2027 does not extend the registration deadline. We confirm your classification, help you regularise your entry in the KSC system and prioritise the highest-risk controls.

There is no official rate. With simple infrastructure, the initial project can be completed in a few months; with many legacy systems, sites or suppliers, it takes longer. The budget is sized to your real risks and obligations, not to the number of tools. After the assessment, you receive a timeline with owners, deliverables and acceptance criteria.

Up to EUR 10 million or 2% of turnover for essential entities, and up to EUR 7 million or 1.4% for important ones, plus possible personal penalties for management. These are statutory maximums, not automatic fines. Most financial penalties can be imposed from April 2028, but registration and implementation have their own deadlines.

A named owner on the management side, information about your systems and suppliers, and time from your technical team for the inventory and testing. The law does not require ISO 27001 certification or a dedicated CISO post: it asks for clear roles and responsibilities, which can be shared between your team and external support.

Want to dig deeper before deciding? Read the guide

Find out today whether NIS2 applies to you and how far you have to go

In 30 minutes, we review your activity, your registration status and your current controls. You leave with a clear view of your starting point.

Check for free whether NIS2 applies to you