How to obtain a Polish industrial security certificate – step by step

When a company needs the certificate

The certificate is required when a company intends to perform a contract or task involving access to information classified as „poufne” (CONFIDENTIAL), „tajne” (SECRET) or „ściśle tajne” (TOP SECRET). The requirement most often arises in defence and security procurement – the contracting authority may require the certificate already when qualifying contractors.

Step 1. Determine the classification level and certificate level

First, determine the classification of the information the company will access and how it will process it. This determines the certificate level:

• Level I – full capacity to protect classified information, including processing in the company's own premises and ICT systems;
• Level II – without processing in the company's own ICT systems;
• Level III – without processing in premises used by the company.

Step 2. Set up the security organisation

The company should appoint a classified information protection officer reporting directly to the head of the company. The officer must hold a personnel security clearance appropriate to the classification level and a training certificate. For SECRET or TOP SECRET information, a secret registry is also required.

Step 3. Documentation and security measures

Before applying, it is advisable to prepare the classified information protection documentation: risk assessment, protection plan, document circulation procedures and, for a level I certificate, documentation of the premises and – where information is to be processed electronically – of the ICT system. This makes it easier to demonstrate in the proceedings that the company is actually able to protect classified information.

Step 4. Application and industrial security questionnaire

The industrial security proceedings are conducted by the Internal Security Agency (ABW) or the Military Counter-Intelligence Service (SKW). The company submits an industrial security questionnaire with the required annexes. The proceedings examine the company's situation and the persons in key positions, including the head of the company and the protection officer.

Step 5. Course of the proceedings and decision

The service may request additional documents and explanations. A complete and consistent questionnaire shortens the proceedings. At the end, the company receives the certificate or a refusal, which may be challenged by the remedy provided for in the Act.

Step 6. Obligations after the certificate is issued

The certificate is issued for 5 years for TOP SECRET, 7 years for SECRET and 10 years for CONFIDENTIAL. While it is valid, the company must maintain the protection conditions and notify the competent service of changes to the data covered by the questionnaire. An application for a new certificate should be filed well before the expiry date.

Other services

• Industrial Security Certificate
• Defence tenders
• Documentation