NIS2 compliance audit

What is NIS2?

Who does it apply to?

The NIS2 requirements apply to specific entities operating in the sectors listed in the legislation, in principle medium-sized and large enterprises. Qualification depends on the type of activity, the size of the enterprise and specific statutory criteria. In some cases, the obligations also cover smaller entities.

Supply chain

NIS2 requires key and important entities to take into account risks related to supply chain security. Merely supplying products or services to such entities does not automatically make a supplier subject to KSC obligations. Suppliers may, however, be subject to additional security requirements imposed by their business partners.

When does it take effect in Poland?

The NIS2 Directive has been implemented in Poland through an amendment to the Act on the National Cybersecurity System (KSC). The Act of 23 January 2026 (Journal of Laws of 2026, item 252) entered into force on 3 April 2026.

Adjustment periods

The deadline for self-registration in the KSC Register expired on 3 October 2026 for entities subject to this obligation since the Act entered into force. The deadline for implementing the requirements is 3 April 2027, while most financial penalties may be imposed from 3 April 2028. Deadlines may vary depending on the entity’s status and the date on which it meets the statutory criteria.

Key and important entities

The sector and role in the economy matter more than the legal form. Polish branches of corporations in regulated industries must comply with the Polish KSC/NIS2 Act.

Key entities — Critical areas

Energy

Transport

Banking

Financial Market Infrastructure

Healthcare

Drinking Water

Wastewater

Digital Infrastructure

ICT Service Management

Public Administration

Outer Space

Important entities

Postal & Courier Services

Waste Management

Chemical Industry

Food Production

Manufacturing & Technology

Digital Services

Scientific Research

Board responsibility and sanctions

Obligations and responsibility rest with the management / board of the entity — including financial responsibility.

Board responsibility

Direct oversight: The board is responsible for implementing and ensuring the effectiveness of cybersecurity measures.

Formal obligations: Approval of IT policies, risk analysis and mandatory training for management.

Personal risk: Possibility of imposing financial penalties directly on managers for gross negligence.

Sanctions

Financial penalties: Up to €10 million or 2% of global turnover (for key entities).

Authority powers: Ability to impose orders, prohibitions and conduct ad-hoc audits.

Business consequences: Civil liability towards contractors and risk of reputational damage and supply chain contract loss.

Risk management measures

The NIS2 Directive requires the implementation of comprehensive cybersecurity risk management measures.

IT security policy and risk analysis

Development and implementation of an IT security policy and methods, procedures and tools for assessing and managing cyber risk, e.g. in accordance with ISO/IEC 27005.

IT incident handling

A set of actions and procedures for responding to security incidents — from detection to reporting and remediation. For significant incidents, an early warning is required within 24 hours, followed, as a rule, by an incident notification within 72 hours of detection, subject to statutory exceptions.

Business continuity and crisis management

Business Continuity Plan (BCP) and IT Disaster Recovery Plan (DRP). Daily backups, test restore from backup.

Supply chain security

Managing risk arising from the use of subcontractor and IT supplier services. Supplier security audits, certificates (e.g. ISO 27001).

Network and IT systems security

Security throughout the entire lifecycle of IT systems — procurement, development, updating, maintenance, decommissioning. “Security by Design”.

Assessment of risk management effectiveness

Internal and external audits, penetration tests, benchmarking against standards (ISO 27001, CIS Benchmark). Reporting to management.

Cyber hygiene and training

Strong passwords and MFA, cybersecurity training, phishing simulations, principle of least privilege, awareness campaigns.

Cryptography and encryption

Encryption of data at rest (BitLocker) and in transit (TLS 1.3, VPN). Cryptographic key management (KMS). Digital signatures and PKI.

Human resources security, access control and asset management

Multi-factor authentication (MFA), RBAC, IT asset inventory, data classification, asset lifecycle monitoring, DLP.