Cybersecurity
Legal support for companies and institutions covered by the amended Polish Act on the National Cybersecurity System – from status assessment and registration, through documentation and procedures, to audits and management liability.
Legal basis: Polish Act of 5 July 2018 on the National Cybersecurity System as amended to implement Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2).
Scope of services
Cybersecurity documentation
Policies, procedures, register application
More
Security management system
Risk analysis, safeguards
More
Incident reporting
Procedures, deadlines, CSIRT contact
More
ICT supply chain
Vendor contracts, security requirements
More
Audit and management liability
Audit readiness, board obligations
More
Cybersecurity training
Board, managers, staff
MorePricing
- Cybersecurity documentationindividual quote
- Security management system and risk analysisindividual quote
- Incident reporting procedureindividual quote
- Review of contracts with ICT vendorsdepending on contract complexity
- Ongoing cybersecurity supportnegotiable
Prices are indicative. The final quote depends on the scope of the matter and is agreed after the first conversation. Ask for a quote →
Who is covered
The amendment replaced operators of essential services with two categories: essential and important entities. The rules cover, among others, energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, public administration, waste management, chemicals and food production and selected manufacturing. Requirements also reach the suppliers of these entities.
Organisational and regulatory obligations
- Status assessment and application for entry in the register.
- Security management system, risk assessment and safeguards.
- Procedures for handling and reporting significant incidents.
- ICT supply chain security management.
- Management oversight and training, security audits.
Timeline
The KSC amendment entered into force on 3 April 2026. Entities meeting the criteria must implement their obligations by 3 April 2027. From 3 April 2028 administrative fines apply to most obligations, and some essential entities must complete their first audit by that date.
Insights