Practical guides on EU cybersecurity regulations and compliance requirements for companies operating in Poland and the European Union. We explain NIS2, the Polish KSC Act, DORA, the Cyber Resilience Act, ISO/IEC 27001, NIST Cybersecurity Framework and related obligations in a clear, business-focused way.
Does My Company Fall Under NIS2? A Simple Board-Level Test
Not every company in Poland falls directly under NIS2 and the amended KSC Act, but many organizations may be affected because of their sector, size, supply chain role or the criticality of their services. Use this simple board-level test to check whether your company should start a formal compliance assessment.
Author: CCyber Editorial Team
Your company may fall under NIS2 and the amended Polish KSC Act if it operates in a regulated sector, meets the size criteria or belongs to one of the categories covered regardless of size. Even if your company is not directly covered by NIS2, it may still be affected indirectly as a supplier to an essential or important entity.
July 2026
This test helps the board quickly assess whether the company should start a formal NIS2 and KSC compliance assessment. It does not replace legal analysis, but it helps make a practical business decision: whether the topic requires urgent action or whether monitoring and basic cybersecurity evidence are enough.
If the company operates in a high-criticality sector or another critical sector, the answer may be “yes”. This is the first and most important filter.
High-criticality sectors include:
Other critical sectors include:
If the company operates in one of these areas, continue with the next question. If not, still check the questions about suppliers, customers and the criticality of services.
NIS2 generally applies to medium-sized and large entities operating in sectors listed in the Directive. In practice, this means checking staff headcount and the company’s financial data.
According to the European Commission SME definition, a medium-sized enterprise has fewer than 250 employees and falls within specific turnover or balance sheet thresholds. A small enterprise has fewer than 50 employees and lower financial thresholds. For NIS2, it is particularly important to determine whether the organization is no longer a small or micro enterprise.
For the self-assessment, collect:
If the company is medium-sized or large and operates in a sector covered by NIS2 or KSC, the probability of being covered is high.
Some organizations may be covered by NIS2 regardless of whether they are small, medium-sized or large. This is one of the most commonly overlooked parts of the self-assessment.
Check whether the company is one of the following:
If the answer is “yes”, the company should run a formal status assessment even if it is small.
A company may not be directly covered by NIS2, but it may still be affected as a supplier. This is especially relevant for IT companies, software houses, cloud providers, maintenance providers, integrators, cybersecurity providers, infrastructure operators and companies delivering services that are critical to their customers.
Examples of indirect NIS2 impact include:
If the company serves regulated entities, it is worth preparing cybersecurity evidence regardless of formal classification.
NIS2 and KSC focus not only on industry, but also on the importance of the service. If disruption of the company’s services could affect health, public safety, operational continuity of many customers, digital infrastructure or an important sector of the economy, the risk of being covered by regulation or customer requirements increases.
The board should answer the following questions:
If several answers are “yes”, the company should treat NIS2 as a board-level topic, even if the formal classification still needs confirmation.
This result is likely if the company operates in a regulated sector, is medium-sized or large, or belongs to a category covered regardless of size.
What to do:
This result applies to companies that operate close to regulated sectors, provide significant services, support many customers or act as important suppliers, but are unsure about their classification.
What to do:
This result is common among SMEs, software houses, IT companies, marketing service providers, consulting firms and technology providers. Formally, the company may not be an essential or important entity, but regulated customers may require security procedures, evidence of training, incident reporting and access controls.
What to do:
If the company does not operate in a regulated sector, is micro or small, does not belong to a special category and does not serve regulated entities, the probability of direct NIS2 coverage is lower.
This does not mean that cybersecurity can be ignored. Ransomware, phishing, data leaks and system outages also affect companies that are not regulated.
The amended Polish KSC Act introduces the distinction between essential entities and important entities. This distinction matters because it affects supervision, obligations and the potential consequences of non-compliance.
An essential entity is typically an organization of higher importance for the functioning of the state, economy, society or critical services. In practice, this may include large entities from high-criticality sectors, selected digital service providers, public administration and entities identified by law or a competent authority.
An important entity is an organization within the scope of the regulation that does not qualify as an essential entity. The obligations remain significant, but the supervision model may differ from that applied to essential entities.
The board should know the organization’s status because it affects registration duties, information security management obligations, audits, supervision and accountability.
Before speaking with a lawyer, auditor or security advisor, it is useful to prepare basic information. This makes the assessment faster, cheaper and more specific.
Business classification codes can help, but they are not enough. What matters is the actual type of services, their importance and the company’s role in the supply chain.
A small company may assume that NIS2 does not apply to it, while providing a service that falls under a special category or is particularly important for customers.
Customers covered by NIS2 may require suppliers to implement controls, procedures, training evidence and incident reporting, even if the supplier is not formally an essential or important entity.
Even if the company concludes that it is not covered by NIS2, it is worth documenting the reasoning. This helps in discussions with customers, auditors and insurers.
If the company is covered by KSC, it will need time for registration, implementation of obligations, training, documentation and compliance evidence.
The company manufactures electronic components and has 180 employees. It operates in the manufacturing of computer, electronic or optical products, or supplies parts to larger industrial organizations. This company should conduct a formal NIS2 and KSC self-assessment.
The company has 25 employees and develops software for healthcare providers. It may not be directly covered by NIS2 because of its size, but healthcare customers may require security procedures, fast incident reporting, access control and evidence of testing.
The company administers customer systems, maintains infrastructure and has privileged access to many environments. Even at a smaller scale, it should carefully check its regulatory status and prepare cybersecurity evidence.
A small online store that does not operate in a regulated sector, does not serve regulated entities and does not belong to a special category will probably not be directly covered. It should still implement basic cyber hygiene, backup, MFA and protection of customer data.
ccyber.io helps companies quickly determine whether they may fall under NIS2 and the amended Polish KSC Act, and which actions have the highest business priority.
We can support your organization with:
The best first step is a short organizational status assessment. It helps the board understand whether immediate action is required or whether monitoring and basic evidence preparation are sufficient.
No. NIS2 and KSC apply to specific sectors, entity types and criteria. However, many companies may be indirectly affected through customer requirements or the supply chain.
Yes, in specific cases. Some entities may be covered by NIS2 regardless of size, including selected digital services, DNS, trust services or entities of specific importance.
No. A business classification code may be useful, but the key factors are actual activity, services provided, sector, company size and the importance of services to customers or the state.
Yes. IT, cloud, managed service, cybersecurity and digital infrastructure providers should carefully check their status because they may be affected directly or indirectly through customer requirements.
Yes. Essential and important entities must manage supplier risk. In practice, this means they may require suppliers to provide documents, procedures, security controls and evidence of training.
The best step is to perform a short formal status assessment, document the assumptions and prepare a board-level decision. It is also worth reviewing contracts, customer requirements and the importance of the services provided.
Not directly. ISO/IEC 27001 can help structure the information security management system, documentation, risks, controls and compliance evidence.
The board should start with three actions: check the sector and company size, assess special exceptions and determine whether the company is a supplier to regulated entities. The next step is a gap analysis and an action roadmap.
The question “does my company fall under NIS2?” should not be delegated only to IT. It is a board-level decision because it affects legal obligations, operational risk, customer relationships, budget and management accountability.
The best approach is simple: check the sector, size, exceptions, supply chain role and service criticality. Then document the result and decide whether the company needs a full compliance assessment.
Even if the organization is not directly covered by NIS2, it may gain a business advantage by preparing basic cybersecurity evidence. For many regulated customers, a supplier that can quickly prove cybersecurity maturity is less risky and easier to approve.
NIS2 in Poland 2026: What Companies Must Do After the KSC Amendment
The amendment to the Polish National Cybersecurity System Act implementing NIS2 significantly expands cybersecurity obligations for companies and public organizations. Learn who is affected, what actions are required and how to prepare for compliance, audits and regulatory reviews.
Author: CCyber Editorial Team
If your organization operates in a sector covered by NIS2 or provides services to essential or important entities, it should prepare for new obligations under the amended Polish National Cybersecurity System Act. In practice, this means cybersecurity risk management, incident handling procedures, training, supplier oversight, documentation and the ability to prove compliance during audits or regulatory reviews.
June 2026
NIS2 is the EU cybersecurity directive designed to raise the level of protection of network and information systems across the European Union.
NIS2 replaces the previous NIS Directive and applies to a broader range of sectors and entities. It also introduces more specific requirements for risk management, incident reporting, supplier oversight and management accountability.
In practice, NIS2 means that cybersecurity is no longer only a technical issue. It becomes part of business management, operational risk, business continuity and board accountability.
Poland implements NIS2 requirements through the amended Act on the National Cybersecurity System, commonly referred to as the KSC Act. The purpose of the amendment is to align Polish law with European cybersecurity standards and strengthen the resilience of organizations that are important for the economy, public services and national security.
The amended KSC Act introduces the distinction between essential entities and important entities. This is one of the key changes because an organization’s status affects its obligations, supervision level and potential consequences of non-compliance.
The scope of regulation is broader than before. It covers not only traditional critical infrastructure, but also additional sectors and organizations that are important for the continuity of services, supply chains, production, communications and digital security.
The leadership of an essential or important entity is responsible for cybersecurity duties. This means that the board should not only ask whether “IT has implemented something”. It should understand cyber risks, approve actions, require reporting and ensure proper training.
Compliance with NIS2 and KSC is not only about buying security tools. Companies must implement proportionate technical, operational and organizational measures. This means combining technology, procedures, responsibilities, documentation and regular reviews.
One of the biggest mistakes is assuming that it is enough to “be secure”. In practice, an organization must be able to demonstrate that it manages cyber risk, handles incidents, trains people, controls suppliers and maintains documentation.
The amended KSC Act entered into force on 3 April 2026. Essential and important entities that met the criteria on that date should pay particular attention to deadlines related to registration, implementation of information security management obligations and audits.
Essential and important entities, after conducting a self-assessment, should submit an application for entry into the official register of essential and important entities.
Entities that met the criteria of an essential or important entity on 3 April 2026 have 12 months to implement obligations related to the information security management system.
An essential entity will be required to carry out its first audit within 24 months from meeting the criteria for being recognized as such an entity. Subsequent audits should be performed at least once every three years.
In practice, companies should not wait until the last moment. Preparing documentation, procedures, supplier reviews, training and evidence can take several months.
NIS2 and the amended Polish KSC Act may apply to organizations operating in essential and important sectors. The scope depends on the type of activity, company size, services provided and the organization’s role in the supply chain.
Even if a company is not formally classified as an essential or important entity, it may still be indirectly affected. This often happens when the company provides services, technology or processes to an organization covered by NIS2 or KSC.
The first step is to check whether the company may qualify as an essential or important entity.
In practice, the company should answer the following questions:
A gap analysis shows the difference between the organization’s current security posture and the requirements of NIS2, KSC, ISO/IEC 27001 or other relevant frameworks.
The assessment should cover:
The roadmap should be practical, not theoretical. It is best to divide actions into urgent, important and long-term tasks.
A good roadmap includes:
NIS2 and KSC require a process-based approach. Buying a tool is not enough.
Companies usually need to implement or improve:
In cybersecurity, compliance without evidence is weak. A company should document not only what it plans to do, but also what it actually does.
Evidence is needed during audits, regulatory reviews, customer discussions, post-incident investigations and cybersecurity maturity assessments.
Cybersecurity is technically connected to IT, but business accountability belongs to management. If the project is limited only to IT, the company may overlook supplier risk, business continuity, reporting and leadership responsibility.
Tools help, but they do not replace governance. A company may have firewalls, backups and MFA, but still lack an incident procedure, risk register and training evidence.
Many companies perform some security activities but do not document them. During an audit or regulatory review, the problem may not be the lack of actions, but the inability to prove them.
NIS2 increases the importance of supply chain security. A company should know which suppliers are critical, what access they have, what services they provide and how they affect the organization’s risk.
Preparing for NIS2 and KSC takes time. This is especially true when the company needs to prepare documentation, implement processes, train people, clean up access rights and collect evidence at the same time.
A manufacturing company has 300 employees and supplies components to a large critical infrastructure operator. It has basic technical security measures: a firewall, backups, antivirus and Microsoft 365.
During an initial assessment, the company discovers that it does not have a formal risk assessment, incident response procedure, supplier policy, training evidence or regular access reviews.
Technically, the company is partially secured. Formally, it is not ready to prove compliance. This is a common situation in organizations that developed security through isolated actions but never built a security management system.
ccyber.io helps companies move from uncertainty to a concrete action plan. Our approach focuses on practical implementation, compliance evidence and actions that reduce real cyber risk.
We can support your organization with:
Not sure where to start? The best first step is a short status assessment and identification of the most important gaps.
No. NIS2 and KSC apply to specific sectors and organizations that meet certain criteria. However, many companies may be indirectly affected as suppliers to essential or important entities.
Not directly. ISO/IEC 27001 is not automatically mandatory for every company covered by NIS2, but it can significantly help structure the information security management system and compliance evidence.
In specific cases, yes. Company size alone does not always determine obligations. The sector, type of services, role in the supply chain and special rules also matter.
Yes. The amended Polish KSC Act refers to cybersecurity training obligations for entity leadership. In practice, the board should understand cyber risk, obligations, consequences and how to oversee security actions.
No. Tools are only one part of compliance. Processes, responsibilities, documentation, training, monitoring, risk management and evidence are also required.
Many IT suppliers may be affected directly or indirectly. Even if a supplier is not formally covered by KSC, its customers may require security evidence.
The best starting point is an organizational status assessment, a gap analysis and a short action roadmap. This helps the company understand what to do first, what evidence to prepare and what budget to plan.
NIS2 and the amended Polish KSC Act are not only legal formalities. They change how organizations manage cybersecurity.
Companies should treat the new requirements not only as a regulatory obligation, but also as an opportunity to organize cyber risk, suppliers, documentation, training and incident readiness.
The best first step is a practical gap analysis. It helps determine whether the organization is affected, what is already in place, what is missing and which actions should have the highest priority.
We write about regulations such as NIS2, DORA, CRA and ISO 27001, cybersecurity for SMEs and critical infrastructure, as well as cyber hygiene, emerging threats and building security awareness within organisations.
Every article delivers practical knowledge - no jargon, just concrete steps you can act on to effectively protect your data, people and business continuity.