Cybersecurity documentation – Polish KSC Act and NIS2
We prepare the documentation required by the amended Polish Act on the National Cybersecurity System – from the entity status analysis and register application to security policies and procedures.
Scope of documentation
- Status analysis – whether the organisation is an essential or important entity, taking into account sector and size.
- Application for entry in the register of essential and important entities.
- Information system security policy and detailed policies.
- Access management, business continuity, backup and incident handling procedures.
- Roles and responsibilities, including management obligations.
- Document register and review plan.
Why now
The amendment entered into force on 3 April 2026 and the adaptation period ends on 3 April 2027. In an inspection or audit, documentation shows that the required measures are in place.
Frequently asked questions
Does the documentation have to be written from scratch?
Not always. Where the organisation already has security policies, e.g. aligned with ISO/IEC 27001 or the GDPR, we extend them with the KSC requirements instead of creating new documents.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.