- Security & Compliance
NIS2 compliance under KSC Act – from gap analysis to a working security system
Poland’s amended National Cybersecurity System Act (the KSC Act) implements the NIS2 Directive and has applied since 3 April 2026. If your company is an essential or important entity, you have until 3 April 2027 to put an information security management system and the required measures in place. Responsibility for this lies with the management board (the Act calls it the “head of the entity”). Tenesys takes your company through the whole process: from gap analysis, through technical safeguards, to keeping you compliant on an ongoing basis.
The KSC Act at a glance – what applies and when
- The Act: amendment to the National Cybersecurity System Act of 23 January 2026 (Journal of Laws 2026, item 252), in force since 3 April 2026. It implements the NIS2 Directive in Poland.
- Registration as an essential or important entity: the deadline passed on 3 October 2026. Companies that meet the criteria later have 6 months from that date.
- Implementing the obligations: by 3 April 2027, i.e. 12 months after meeting the criteria.
- First security audit (essential entities): by 3 April 2028, then at least every 3 years.
- Penalties: up to EUR 10 million or 2% of total worldwide annual turnover for an essential entity. Members of the management board personally: up to 300% of their remuneration. Penalties can be imposed from 3 April 2028, but the obligations and the board’s accountability already apply.
We act as your comprehensive partner, translating complex legal requirements into understandable language and designing and implementing all necessary measures to ensure your company’s full compliance and resilience.
Is your company covered by NIS2 and KSC Act?
The Act works on self-identification: no authority will write to tell you that you are an essential entity. A company is covered when it meets both of the following conditions.
You operate in a sector listed in Annex 1 or 2
Energy (including renewable generation), transport and logistics, manufacturing, food, chemicals, healthcare, water and waste management, postal and courier services, digital infrastructure, ICT services and more. What counts is the activity you actually carry out, not just your PKD code (the Polish business activity classification).
You are at least a medium-sized enterprise
50 or more employees, or more than EUR 10 million in both turnover and balance sheet total, counting linked and partner enterprises. A large company in an Annex 1 sector is, as a rule, an essential entity. A medium-sized one, or one operating in an Annex 2 sector, is an important entity.
Or you fall under an exception
Regardless of size, the Act covers, among others, DNS service providers, qualified trust service providers, public entities and critical entities. Managed security service providers are essential entities from the size of a small enterprise upwards.
Missed the 3 October registration deadline?
Submit your application in the S46 system (wykaz-ksc.gov.pl) as soon as possible. Every week of delay is a week less for implementation, and the obligation does not go away.
Operating in the financial sector? Banking and financial market infrastructure are governed primarily by DORA: See how we help with DORA compliance →
Operating in another EU country? NIS2 is implemented through national law in each member state, with its own deadlines. The dates on this page refer to Poland. Our technical scope (gap analysis, safeguards, SOC, ongoing compliance) works the same way across the EU.
What usually holds up KSC Act implementation
Registration is a formality. The hard part starts when the Act has to be turned into specific tasks, a budget and people.
You know you’re covered, but not exactly what to implement
The Act describes the obligations in general terms: an information security management system, risk analysis, incident handling, supply chain security. It does not say which safeguards are a priority for your company or how long they will take. Impact: the project stalls while the clock runs down to 3 April 2027.
Accountability sits with the board, not the IT department
The head of the entity is responsible for meeting the obligations of the Act (Art. 8c). They must complete documented training once a year (Art. 8e) and genuinely oversee implementation. From 3 April 2028, they face a personal penalty of up to 300% of their remuneration, on top of any penalty for the company. Impact: the board signs off on something it cannot verify itself.
IT can’t handle it after hours
Implementation needs legal, technical and audit expertise at the same time. The IT team has its day-to-day work and rarely has a risk management specialist. In manufacturing plants there are also OT networks that cannot be stopped for changes. Impact: compliance on paper that won’t survive an audit or the first serious incident.
The documents exist, the safeguards don’t
Policies and procedures can be written in a few weeks. Backups that can actually be restored, multi-factor authentication, event monitoring and a process for reporting an incident within 24 hours have to be implemented and tested. Impact: gaps that an auditor or an attacker will find first.
Transport company compliant with NIS2 and the KSC Act three months ahead of the deadline
Client:
A transportation industry company subject to the NIS2 Directive.
Challenge:
The company had to adapt its processes and technology to the new, rigorous requirements in a short time. They lacked the resources to conduct risk analysis and implement the required measures.
Solution:
We conducted a comprehensive Gap Analysis in relation to NIS2. We created a roadmap and then implemented key measures, including security policies, a business continuity plan, and an incident management process.
Results:
Achieving full NIS2 audit readiness 3 months ahead of the deadline.
Implementation of 18 security measures required by the directive.
Building a solid foundation for further development of the cybersecurity program.
Your company can also go through this process smoothly and stress-free. Let us discuss how we can help you with this.
Logistics platform operating in several EU countries
As part of our CISO as a Service, we carried out a risk assessment, prepared a NIS2 roadmap, implemented an ISMS and reported progress directly to the board. Result: key NIS2 requirements met within 6 months, and new contracts won thanks to documented security maturity.
Efekt:
Najważniejsze wymogi NIS2 spełnione w 6 miesięcy i nowe kontrakty dzięki udokumentowanej dojrzałości bezpieczeństwa.
NIS2 implementation, from gap analysis to evidence for the auditor
We run the whole compliance project, or step in where you lack expertise or people. At every stage you get a concrete deliverable you can show to the board and the authority.
Gap analysis and maturity assessment
We compare your company’s current state with the requirements of the KSC Act: documentation, processes, technical safeguards and supplier contracts. We start from what you already have. After 2–4 weeks you get a report with gaps ranked by risk, a cost estimate and a schedule.
Information security management system (ISMS)
We build or tidy up the ISMS required by Art. 8: risk analysis, policies, a business continuity plan, incident handling procedures and change management rules. The documentation describes how your company actually works, not a generic template.
Technical safeguards
We implement the safeguards your risk analysis calls for: backup and disaster recovery, identity management and multi-factor authentication, penetration testing and vulnerability management, monitoring in our 24/7 SOC. In manufacturing plants we also cover the interface between IT and OT networks.
Incident handling and reporting
We establish who in your company classifies an incident, who reports it and how fast. We set up the process for an early warning within 24 hours and an incident notification within 72 hours, and test it in an exercise before a real incident happens.
Supply chain security
We assess the risk of your most important ICT suppliers and help you write security requirements into contracts. If you are the supplier to a company covered by the KSC Act, we will prepare you for your customer’s questionnaires and audits.
Board readiness and audit preparation
We deliver the annual management training required by Art. 8e, with documented attendance. We gather evidence for the auditor and the competent authority. The statutory audit under Art. 15 must be carried out by an independent auditor. We will prepare you for it and support you during it.
A technology company, not a law firm
A law firm will tell you what the law says. We’ll do the same, and then configure the systems that meet it.
1.
We implement, not just write documents
You come away with working backups, monitoring and an incident handling process, not just a legal opinion and a binder of procedures.
2.
We’ve been through it ourselves
Tenesys is certified to ISO/IEC 27001:2022, so we know an information security management system from daily practice, not just from the standard.
3.
Your IT team stays in control
We step in where you lack people or specialist knowledge. The infrastructure stays yours; we bring the methodology and the execution.
2.
One partner for implementation and maintenance
The team that implemented the safeguards can then run the programme as your CISO as a Service and monitor your environment in our 24/7 SOC.
Your path to KSC Act compliance
Four stages. After each one, you know what has been done and what comes next.
1.
Diagnosis
Find your gaps. A free call establishes whether and how the Act applies to you. The gap analysis (2–4 weeks) shows what is missing against the requirements and what is most urgent.
2.
Plan and budget
Get a roadmap your board will approve. A schedule up to 3 April 2027, priorities ranked by risk and a budget broken down into stages. The board knows what it is paying for and what it will get.
3.
Implementation
Close the gaps in processes and technology. We implement the ISMS, technical safeguards and procedures, usually within 3–9 months, depending on the scale of the gaps. We collect documentation as we go, in a form ready for the auditor.
4.
Maintenance
Stay compliant without a full-time CISO. After implementation, our CISO keeps the programme running: updates the risk analysis, prepares the annual board training and the audit, and reports on the state of security.
Your obligations don’t end on 3 April 2027
The KSC Act is not a project with an end date. Compliance has to be maintained, and someone has to own it day to day.
- annual, documented management training (Art. 8e)
- updating the risk analysis after every significant change in the company and its environment
- handling and reporting incidents within the statutory deadlines
- overseeing suppliers and the requirements in their contracts
- a security audit at least every 3 years (essential entities)
Hiring an experienced CISO costs EUR 8,000–15,000 a month, plus months of recruitment. With CISO as a Service, you get the same expertise in a scope that fits your company. Our CISO knows your programme because they implemented it. They report to the board in the language of risk and money, lead your IT team and have Tenesys engineers and our 24/7 SOC behind them.
The board’s accountability under the KSC Act cannot be passed on to an outside company: the Act assigns it to the head of the entity. A CISO gives the board what it needs for real oversight: regular reports, recommended decisions and documentation it can show to the authority.
Frequently asked questions about NIS2 compliance
A law firm interprets the law; we also implement it in your systems. We carry out the gap analysis and roadmap, then configure backup and recovery, 24/7 SOC monitoring, identity management and the incident handling process. You end up with a working system and documentation that describes it, not just a legal opinion.
The cost depends on the size of your gaps, the number of systems and locations, not on the Act itself. That’s why we start with a free 60-minute call, after which we quote for the gap analysis. The gap analysis report includes an implementation budget broken down into stages, so the board approves specific amounts, not a rough guess.
The gap analysis usually takes 2–4 weeks and implementation itself 3 to 9 months. The shorter end applies to companies with partial documentation and isolated gaps, the longer end to organisations building risk management from scratch. If there is less time left than full implementation needs, we start with the highest-risk measures and document the plan for the rest.
No. The Act assigns responsibility for meeting the obligations to the head of the entity (Art. 8c), even when someone else carries out the tasks. An outside company, such as our CISO as a Service, can run the programme and give the board reports, recommendations and documentation that make oversight real rather than a formality.
No, but it’s a good starting point. The Act does not recognise the certificate as proof of compliance and adds requirements beyond the standard, such as statutory incident reporting deadlines, management obligations and detailed supply chain requirements. In the gap analysis we build on your existing ISMS and only add what is missing.
