Our blog features practical articles on cybersecurity and regulations, written in plain language that business owners and managers can understand. We cover specific topics such as NIS2, DORA and CRA requirements, ISO 27001 implementations, incident analysis, phishing, ransomware and best practices for SMEs.
Instead of technical jargon we offer actionable guidance that can be applied to your business straight away. We focus on content you can implement immediately: checklists, threat analyses, SME guides and regular updates on new regulations.
Cybersecure Water Utilities: How to Deliver the Grant Project and Secure IT/OT?
Cybersecure Water Utilities is not only a grant programme for buying IT equipment or services. It is an opportunity to significantly improve the resilience of the water and wastewater sector, which provides one of the most important services to residents: access to water and wastewater management. A good project should connect four areas: organizational, competency, technical IT and technical OT. The greatest value appears when the grant leads to an ISMS, risk management, secure remote access, IT/OT segmentation, backup, monitoring, training, incident procedures and recovery testing. The biggest mistake is treating the grant as a one-time purchase without a process, owner, tests and post-project maintenance.
Prepared by: CCyber Editorial Team
Cybersecure Water Utilities is a programme designed to strengthen the digital resilience of entities responsible for water and wastewater services. Funding should be used not only to buy tools, but to build an operating IT and OT security system. The best project covers four layers: organization, skills, technical IT safeguards and technical OT safeguards. In practice, this means an ISMS, risk register, asset register, secure remote access, MFA, IT/OT segmentation, backup, recovery tests, monitoring, incident procedures, training, supplier assessment and delivery evidence. Water utilities should not ask only what can be bought with the grant. They should ask what must continue to operate so residents have continuity of water supply and safe wastewater services despite a cyberattack.
July 2026
Cybersecure Water Utilities is financed from Poland’s National Recovery and Resilience Plan under investment C3.1.1. The programme is implemented by the Centre for Digital Poland Projects in cooperation with NASK National Research Institute.
The purpose is to increase digital resilience of national cybersecurity system entities responsible for water and wastewater services and units performing public utility tasks. In practice, this means protecting IT systems, OT systems, data, technological processes, remote access, suppliers and employee skills.
The ranking list shows the scale of needs in the water and wastewater sector. Hundreds of applications were assessed, and projects received funding worth hundreds of millions of PLN. Such high interest means the sector understands the importance of cybersecurity, but it also shows the investment gap in IT, OT, procedures, training and security management.
This is not only statistical information. For water utility boards and local governments, it means that cybersecurity in the water and wastewater sector is becoming a management standard, not an exception.
Access to water and wastewater services are basic services for residents, public health, businesses, schools, hospitals and administration. Disruption of water utilities or wastewater treatment is not an ordinary IT outage. It can lead to water supply interruption, service quality deterioration, sanitary issues, communication chaos and loss of trust in local government.
Water utility cybersecurity must cover all three areas. Securing email alone is not enough. Securing SCADA alone is also not enough if a supplier has uncontrolled remote access or backup has not been tested.
One of the most serious risks is direct or weakly secured remote access to control systems, operator panels, visualization systems, industrial routers, GSM modems, VNC, RDP or technical support tools.
Industrial devices exposed to the internet can be targeted by activists, cybercriminals or random scanners. Even if the system does not seem financially attractive, it may be attacked for publicity or service disruption.
Ransomware may start from a workstation, email or file server and then affect billing, documentation, customer service, operational data and technical coordination.
If the office network is connected to OT without proper segmentation and control, an IT incident may move into the technological environment.
Integrators, automation service providers, domain system providers and external IT companies often have access to the environment. Lack of MFA, named accounts, logging and just-in-time access procedures increases risk.
Backup without restore testing does not prove that the water utility can recover after ransomware, configuration error or hardware failure.
During an incident, there is no time to decide who makes decisions, who reports to CSIRT, who contacts the supplier, who informs the municipality and who communicates with residents.
A good grant project does not end with signing the agreement and buying solutions. It should change how the organization operates. Every cost should lead to a specific effect: lower exposure, shorter detection time, better backup, stronger access control, ready procedure or higher employee competence.
The organizational area is often underestimated because it does not look as attractive as a new tool. In practice, this area decides whether the project will work after funding ends. Without policies, roles, risks, procedures and reporting, tools quickly become unused or misconfigured.
Water utility cybersecurity depends not only on IT staff. Automation engineers, dispatchers, field technicians, customer service employees, accounting, shift managers, board members and suppliers all matter.
The IT environment is often the attacker’s entry point. The project should cover email, identity, workstations, servers, backup, finance systems, billing, customer systems, documentation and remote access.
OT requires a different approach than classic IT. Technological systems must operate reliably, often for many years, and misconfiguration may have physical consequences. OT safeguards must therefore be designed carefully, with automation and operations teams involved.
Remote access is needed because automation providers, service teams and technical duty staff must respond quickly. But uncontrolled remote access is one of the most serious risks. The grant should help move from informal access to a controlled model.
Backup in water utilities is not only a copy of office files. The organization must know which data and configurations are needed to restore operations.
The most important evidence is not that backup exists. The most important evidence is a critical system restore test and a protocol showing what was restored, how long it took, who participated and what problems were found.
Monitoring makes sense when it is clear what will be monitored, who responds to the alert, how escalation works and what happens after hours. Many water and wastewater entities do not have their own SOC, so SOC as a Service, MDR or shared monitoring for several units may be a good model.
Positive assessment and funding award are only the beginning. The greatest risk appears during delivery: procurement, acceptance, integrations, tests, evidence, deadlines, suppliers and outcome maintenance.
The grant should leave behind measurable improvement in cyber resilience. That is why KPIs should be defined at the beginning, understandable for the board, municipality, auditor and technical team.
The organization buys many solutions but does not know how they will connect with existing IT, OT, monitoring, backup and procedures.
The project strengthens only office computers, while control systems, remote access and field devices remain uncontrolled.
OT cybersecurity should not be designed without people responsible for the technological process.
Tools are implemented, but nobody tests restore, alert escalation, remote access or incident procedure.
The project is technically completed, but there are no reports, protocols, attendance lists, baseline configurations or acceptance confirmations.
After the grant ends, there is no money for licences, monitoring, service, training and regular tests.
Automation and IT suppliers still use broad remote access, shared accounts or unlogged connections.
The board does not see risks, delays, scope changes and project outcomes. Without reporting, accountability and continuity after the project are hard to maintain.
Water and wastewater entities in the national cybersecurity system should treat the grant as part of preparation for wider obligations. The project should support not only technology, but also formal organizational readiness.
A medium-sized water and wastewater company has SCADA, several pumping stations, a wastewater treatment plant, telemetry network, billing system, Microsoft 365, file server and external automation and IT suppliers. An audit shows that some remote access uses old VPN, service accounts are shared, backup has not been tested and OT devices are not fully inventoried.
The grant project is divided into four packages. In the organizational area, an ISMS, risk register and incident procedure are created. In the competency area, training is delivered for the board, IT, automation staff and dispatchers. In the IT area, MFA, EDR, backup and restore testing are implemented. In the OT area, inventory, segmentation, remote access control and anomaly monitoring are implemented.
After the project, the organization has not only new safeguards, but also evidence: audit report, asset register, MFA report, restore test report, segmentation protocol, incident procedure, tabletop results and board report. This is real cyber resilience, not only a settled purchase.
This topic can be connected with further reading and CCyber services to move from ranking list and grant agreement to safe project delivery.
ccyber.io helps water and wastewater companies, local governments and municipal companies turn the Cybersecure Water Utilities grant into real IT and OT security improvement. We combine financing, cybersecurity, OT, national cybersecurity rules, NIS2, IT projects, suppliers and delivery evidence.
We can support your organization with:
The best first step is a Cybersecure Water Utilities Delivery Workshop. In a short workshop, the organization can review project scope, IT/OT risks, required evidence, timeline, suppliers, outcome maintenance and alignment with national cybersecurity rules and NIS2.
No. The programme covers four areas: organizational, competency, technical IT and technical OT. Tool purchases make sense only when they support a process, procedure, risk and measurable outcome.
Not every cost must relate to OT, but OT is a key risk area in the water and wastewater sector. Control systems, telemetry, SCADA, PLCs and supplier remote access should be analyzed.
The most important actions are appointing the project owner, confirming scope, preparing timeline, securing evidence, defining acceptance criteria and connecting purchases with real security outcomes.
Backup is very important, but not enough. It must be tested, backup accounts must be protected, RTO and RPO must be defined and backup must be connected with a ransomware recovery procedure.
Not always in the same scope. Every entity should have detection and escalation capability. This may be an internal process, MSSP service, SOC as a Service or shared model.
It should be inventoried, limited, secured with VPN and MFA, moved to named accounts, logged and preferably implemented as just-in-time access where possible.
MFA report, backup and restore test report, risk register, IT/OT asset register, incident procedure, training report, OT audit report, supplier access review and board report.
Start with critical services, risks, owners, remote access, backup, MFA, OT and evidence timeline. Only then finalize purchases and deployments.
Cybersecure Water Utilities is one of the most important programmes strengthening the cyber resilience of the water and wastewater sector. Its importance goes beyond buying equipment and services. It protects a public service directly connected with health, safety and everyday life of residents.
The best projects will connect organization, skills, IT and OT. They will include ISMS, risks, remote access, segmentation, MFA, backup, monitoring, training, suppliers, incident procedures and tests. This turns the grant into an investment in resilience, not only a settled expense.
The best rule is: do not first ask what to buy. Ask which technological process and which resident service must operate after a cyberattack, then plan safeguards, people, procedures and evidence around that answer.
FBiO Funding for Local Government Cybersecurity: What Can Be Funded and How to Prepare the Project?
The Security and Defence Fund can be an important financing source for local governments to strengthen digital resilience, cybersecurity, critical infrastructure protection and continuity of public services. However, it is not a standard grant for any IT purchase. In practice, it is preferential financing for investments that strengthen the security and resilience of the state and local services. A local government should prepare the project around real risks: water supply, wastewater, transport, crisis communication, e-services, backup, monitoring, MFA, SOC, digital hygiene, data protection, incident procedures and compliance with national cybersecurity rules and NIS2. The biggest mistake is treating FBiO as fast money for equipment. The best projects connect cybersecurity with civil protection, business continuity and measurable resilience improvement.
Prepared by: CCyber Editorial Team
The Security and Defence Fund can help local governments finance cybersecurity projects, but the best projects should not start with a shopping list. They should start with the question: which public services must continue to operate during a crisis, failure, cyberattack or sabotage? FBiO can support investments that strengthen security and resilience, including cybersecurity, threat detection and warning systems, critical infrastructure, ICT services, continuity of operations and dual-use solutions. For local government units and municipal companies, this is an opportunity to finance projects that were previously postponed: backup, recovery, MFA, monitoring, SOC, EDR, crisis communication systems, OT protection, cybersecurity of water, wastewater, transport and e-services. However, this is an investment project with conditions, documentation, eligible costs, deadlines and the need to sustain outcomes.
July 2026
The Security and Defence Fund is financed from Poland’s National Recovery and Resilience Plan. Its purpose is to support investments strengthening state security and resilience, civil protection, dual-use infrastructure, cybersecurity, continuity of critical services and the potential of enterprises, including the defence sector.
In practice, FBiO has two main pillars: a loan part operated by BGK and an equity part implemented by Chrobry S.A. The loan part is especially important for local governments, municipal companies, the rail sector and enterprises planning investments in security and resilience.
In discussions about FBiO, terms such as “money”, “support” or “financing” often appear. For local governments, however, it is important to understand the mechanism precisely. In the loan part, this is a preferential loan, not a classic non-refundable grant for any purchase.
This still requires careful financial planning. Even with zero interest and possible cancellation, a local government must understand the project’s impact on the budget, repayment capacity, investment maintenance and operating costs after completion.
In the municipal loan part, financing may cover several investment categories. Cybersecurity is one of them, but it can also connect with other categories, such as detection and warning systems, civil protection infrastructure, crisis communication and critical service resilience.
A local government should not treat cyber as a separate add-on to infrastructure. In practice, cybersecurity can strengthen almost every resilience project: shelters need communication, water utilities need control systems, transport needs ICT systems, a crisis management centre needs secure communication, and the office needs backup, MFA and response procedures.
Exact eligibility depends on the call rules and BGK documentation, so every idea must be formally checked. The list below shows which types of projects may fit the FBiO logic if they are connected with security, resilience and continuity of services.
The best FBiO-funded project should support obligations under national cybersecurity rules and NIS2. This helps a local government avoid a situation where infrastructure is financed, but there is still no compliance evidence, procedures, risk owners or incident readiness.
Every FBiO project with a cyber component should be mapped to a risk, critical service and organizational obligation. If the project buys a tool, it must show which process the tool supports, who owns it, which evidence will be produced and how resilience improvement will be measured.
Do not start with hardware. Start with the list of services that must operate during crisis: water, wastewater, heating, transport, resident communication, crisis management, e-services, document workflow, finance system and resident data.
The project should come from risk. Example: ransomware may stop the office and municipal utility, missing backup prevents recovery, supplier account takeover gives attackers access to systems, and missing monitoring delays incident detection.
The outcome should be measurable. Not “security improvement”, but for example: 100% of administrator accounts with MFA, 95% of endpoints with EDR, restore test for a critical system every six months, incident escalation under 30 minutes or 24/7 monitoring for five critical systems.
A cyber project should show how the solution will operate: which systems are covered, which data is processed, which integrations are needed, who will administer it, what supplier access looks like and how logs will be secured.
A loan can finance investment, but the local government must maintain the outcomes. Licences, monitoring, MSSP services, updates, tests, training and maintenance need a funding source after project completion.
Costs must comply with the call and eligibility rules. The list below is a practical starting point for budgeting a cyber project, but every item must be verified against BGK documentation.
A server, storage, firewall or licence will not increase resilience if there is no owner, procedure, configuration, testing and maintenance.
SIEM, EDR or backup generate value only when someone analyzes alerts, performs tests, updates rules and responds to incidents.
A security system must be connected to real data sources: email, identity, endpoints, servers, cloud, firewalls, domain systems and OT.
If there is no budget for licences, service, monitoring and training after project completion, the outcome will quickly disappear.
The application should be complete, signed with a qualified electronic signature and compliant with the call requirements. It is important to prepare attachments, cost descriptions, formal documents and investment justification in advance.
A good project shows how the investment will reduce the risk of service interruption for residents, businesses or dependent units.
The outcome should be countable: systems covered by monitoring, accounts with MFA, recovery time, trained people, tests performed, vulnerabilities closed.
If the project supports incident response, business continuity, supplier assessment, asset management, backup, training or risk management, its strategic character is easier to justify.
The local government should know how much the solution will cost after the first year, who will operate it and whether an external service will be needed.
A project without an owner on the office or municipal company side quickly becomes a procurement issue instead of a resilience investment.
FBiO is not only for local governments. Enterprises can use the loan part and equity instruments if the project strengthens state security and resilience. In the loan part for enterprises, financing may cover cybersecurity projects, continuity of energy and fuel supply, physical security of critical infrastructure, ICT services, transport and dual-use production.
A local government may use different programmes at the same time, but it must avoid double financing of the same costs. FBiO cannot finance expenses already settled or submitted for settlement under the National Recovery Plan or other EU programmes, nor costs covered by other national support.
One project may be part of a broader resilience strategy, but each cost must have one funding source, clear justification and documentation. It is useful to prepare a financing map showing which actions are funded by FBiO, which by own budget, which by Digital Europe and which by other sources.
First describe the critical service, risk and expected outcome. Only then choose technology and suppliers.
An external contractor can implement the solution, but the office or municipal company must own decisions, acceptance and maintenance.
The project is financed, but there is no budget for licences, monitoring, service, training and testing in the following years.
The local government buys tools, but procedures, registers, evidence, reports and incident reporting mechanisms are not created.
The office strengthens its systems, but water utilities, municipal services or education units remain outside the project.
Backup, SOC, incident procedure and emergency communication must be tested. Without tests, the project is incomplete.
The project includes costs that are not well linked to the financing objective, are not described or may be excluded.
Evidence is hardest to recreate at the end of the project. Documentation should be created during delivery, at each milestone and acceptance.
A medium-sized municipality has an office, water utility, tax system, document workflow, public information bulletin, email, e-delivery and an external IT provider. After risk analysis, the biggest threat is ransomware and the inability to quickly recover office and water utility systems. In addition, some administrator accounts do not have MFA, and the IT provider uses remote access without full action logging.
The municipality prepares an FBiO project not as an “IT equipment purchase”, but as a digital resilience programme for critical services. The scope includes ransomware-resistant backup, MFA, EDR, segmentation, log monitoring, incident procedure, restore test, tabletop and supplier assessment. The project covers the office and water utility because the utility provides a critical service to residents.
After implementation, the municipality has not only new tools, but also evidence: MFA report, restore test report, risk register, supplier register, incident reporting procedure, business continuity plan and leadership report. This connects financing with national cybersecurity rules, NIS2 and real resilience for residents.
This topic can be connected with further reading and CCyber services to move from an FBiO idea to a well-prepared project, application and implementation.
ccyber.io helps local governments, municipal companies and suppliers prepare cybersecurity projects for FBiO and other national and EU financing programmes. We connect financing, cybersecurity, national cybersecurity rules, NIS2, IT projects, suppliers and delivery evidence.
We can support your organization with:
The best first step is an FBiO Cyber Project Workshop for local governments. In a short workshop, the organization can decide whether the idea fits the financing, which critical services it covers, which costs should be planned, which evidence will be produced and how to connect the project with national cybersecurity rules and NIS2.
Not in the classic sense. For the municipal sector, it is primarily a preferential loan that may have interest from 0%, a long repayment period and possible partial cancellation for eligible local government units.
Yes, cybersecurity projects are indicated as one of the categories eligible for financing. However, the project must show a link with security, resilience and eligible costs.
This may be justified if the project is linked to resilience of critical services, incident detection, national cybersecurity rules, NIS2 and business continuity. Eligibility of a specific cost model must be checked in the call rules.
A backup and recovery project can fit well into cyber resilience, especially if it concerns critical systems, ransomware protection and restore tests. However, the outcome and post-project maintenance must be described.
Yes, the BGK product for the municipal sector indicates local government units and municipal companies as recipients. Project structure, roles, ownership, costs and impact on public services must be described.
A broader financing strategy can be planned, but the same costs cannot be financed twice. A clear cost and funding source map should be maintained.
The key is connecting the project with a critical service, risk, measurable outcome, budget, cost eligibility and outcome maintenance plan.
Start with critical services, system register, backup, MFA, suppliers, risks and incident procedure. Only then build the financing project and select technology.
FBiO can become one of the most important instruments for financing local government resilience in the coming years. For local government units and municipal companies, it creates an opportunity for projects that connect civil protection, service continuity, cybersecurity, warning systems, critical infrastructure and digital resilience.
The key is the right approach. The project should not be a shopping list or an attempt to spend money on any IT. It should come from risk, concern services important to residents, have measurable outcomes, a maintenance plan, owners and delivery evidence.
The best rule is: do not first ask what can be bought. Ask which public service will stop after a cyberattack, how long recovery will take, who will make the decision and which financing will truly increase resident resilience.
Cybersecurity Grants from the Digital Europe Programme: How to Prepare and Deliver a Successful Project?
A cybersecurity grant is not only a way to buy a tool. It is a project that needs a clear objective, business justification, compliance with the call rules, measurable outcomes, realistic budget, timeline, competent team, delivery evidence and a plan to sustain results after funding ends. The Digital Europe Programme and NCC-PL initiatives show that funding can support SMEs, NIS2 and CRA projects, AI-based cybersecurity solutions, preparedness testing, penetration testing, vulnerability assessment, training, platforms, services and tools that increase cyber resilience. The biggest risk for beneficiaries is not only a weak idea, but poor scope, unrealistic budget, missing owners, weak documentation and failure to deliver outcomes.
Prepared by: CCyber Editorial Team
Cybersecurity funding from the Digital Europe Programme, NCC-PL, ECCC or similar instruments can accelerate the development of products, services, skills and organizational resilience. However, it should not be treated as “free money for cyber”. A grant is a project that must be planned, justified, delivered, documented and reported. The best projects have a clear problem, well-defined beneficiaries, measurable outcomes, realistic budget, strong team, solid timeline, delivery evidence, risk management plan and a sustainability plan after funding ends. The most common mistakes are overly broad scope, missing owner, unrealistic timeline, weak cost justification, poor alignment with the call objective, underestimating reporting work and missing evidence.
July 2026
Cybersecurity is becoming more expensive and more necessary. Companies must invest in MFA, backup, EDR, monitoring, training, supplier assessment, penetration testing, compliance with NIS2, CRA, DORA, AI Act, ISO 27001 and cyber insurance. At the same time, SMEs, startups, healthcare entities, local governments and smaller technology providers often do not have the budget to implement everything quickly and independently.
Grants can reduce the entry barrier. They can help develop Polish cyber products, strengthen SMEs, test organizational resilience, fund training, create compliance tools, develop AI-based solutions, support healthcare, digital infrastructure and supplier resilience.
The Digital Europe Programme supports the development and deployment of advanced digital technologies in the economy and public administration. In cybersecurity, an important role is played by the ECCC, the European Cybersecurity Competence Centre, and the network of National Coordination Centres. In Poland, this role is performed by NCC-PL.
From the perspective of companies and institutions, the key point is that such programmes do not fund “cybersecurity in general”. They fund specific objectives: deployment of innovative solutions, tool development, testing, vulnerability assessment, regulatory readiness, critical sector resilience, skills, AI, cloud, infrastructure and response capabilities.
Digital Europe Programme and related calls show which directions matter for the EU and the Polish cyber ecosystem. Some of the calls mentioned had deadlines in the first half of 2026, so they should be treated as examples and a preparation pattern for future competitions.
Calls focused on uptake of innovative cyber tools for SMEs show that regulations such as NIS2 and CRA create a real need for practical solutions. It is not enough to say that SMEs must be secure. They need tools, platforms, services, training, hotlines and processes that can be implemented in small organizations.
AI-based cyber solutions can support threat detection, alert analysis, incident response, automation and data analysis. Such projects must also address the security of AI itself, data quality, AI Act compliance, GDPR and risk of wrong decisions.
Preparedness tests, exercises, penetration tests and risk assessments matter because they show whether organizations are ready for real incidents. A well-designed testing project does not end with a report. It should lead to remediation and retesting.
Grants for organizations specializing in cybersecurity show that the market needs practical services: penetration testing, vulnerability assessment, technical recommendations and support for entities in scope of NIS2.
Calls related to submarine cables show that cybersecurity is connected with physical infrastructure, international communications and strategic resilience. This is a good example of a project where cyber, infrastructure, AI, data analysis and operational security must work together.
Eligible entities depend on the specific call. In practice, cybersecurity projects include various groups of beneficiaries and partners.
A consortium makes sense when the project requires combining skills: technology, research, deployment, access to end users, regulation, testing, training and commercialization. A consortium should not be created only to look better in the application. Every partner must have a real role, budget, tasks and accountability.
The best chance belongs to projects that fit the call objective and can show why their outcome is needed, feasible and sustainable.
The biggest mistake is starting with “how much can we get?”. The more important question is: which problem does the programme want to solve and does our project really address it?
A project for SMEs affected by CRA and NIS2 will be different from a project for hospitals, CSIRTs, digital infrastructure entities or cyber providers. The more precisely the beneficiary is defined, the easier it is to justify scope.
The outcome should be specific: tool, platform, service, testing methodology, training, module, report, pilot, deployment, recommendations, ready product or tested procedure.
Check whether the organization can apply, whether a consortium is required, whether an EU or EEA establishment is needed, what the funding rate is, what co-financing is required and which costs are eligible.
The budget should follow tasks. Each cost should have a justification, owner and link to the project outcome.
The timeline must include time for procurement, contracts, testing, acceptance, corrections, reporting, partners, risks and delays. A cyber project often needs more time for integration and testing than the first plan assumes.
Already at the application stage, you should know which evidence will prove project delivery: acceptance protocols, test reports, logs, technical documentation, participant lists, training reports, scan results, materials, repositories and financial reports.
Every call has its own rules, but cybersecurity projects may cover many types of activities. The list below helps prepare scope, but it must always be compared with the documentation of the specific competition.
The budget should be understandable for evaluators and defensible during reporting. It should not look like a wish list. It should follow work packages and outcomes.
A grant project must have measurable outcomes. In cybersecurity, it is easy to fall into generic language such as “improving security”. That is not enough. The project must show exactly what will change.
Awarding the grant is not the end. It is the moment when the project moves from promise to execution. This is where the most common problems appear: delays, missing documentation, partner disputes, unclear roles, missing evidence, procurement errors and reporting left until the last moment.
The project should have a sponsor, project manager, work package owners, finance owner, compliance owner, technical owner and evidence owner.
A steady rhythm works best: weekly operational meeting, monthly management review, quarterly risk review and evidence review before every report.
In a publicly funded project, decisions should be recorded. This applies to scope changes, supplier selection, timeline shifts, risks, acceptance and approvals.
A cyber project almost always changes. New vulnerabilities, technology changes, supplier delays, regulatory changes and new user needs appear. What matters is that changes are controlled and documented.
The most expensive mistake is trying to recreate documentation at the end of the project. Evidence should be created when the task is completed.
The project is interesting, but it does not solve the problem described in the competition. Evaluators see weak alignment and scoring drops.
AI, NIS2, CRA, resilience and innovation matter, but slogans are not enough. The application must show what exactly will be done.
The project talks about the market, but does not show who will actually use the solution, how it will be deployed and how it will be maintained.
The budget is too low to perform the tasks or too high without justification. Both situations weaken credibility.
The team declares advanced cyber activities, but does not show experience, roles, certifications, projects or partners.
Evaluators want to know what happens after funding ends. Will the product be maintained? Will the service be available? Will the results be used?
Everyone runs part of the project, so nobody controls timeline, budget, partners, reports and evidence.
Documentation created at the last minute is incomplete, inconsistent and hard to defend.
The team adds features, changes technology or moves tasks without a formal decision and without assessing budget impact.
Partners work separately, do not understand dependencies and do not provide evidence on time.
A cyber project is not only technical work. Reporting, meetings, acceptance, coordination, documentation and settlement require real time.
The beneficiary does not prepare documents for control and later has to search for evidence in emails, chats and folders.
Do not rely only on the competition summary. Eligibility, reporting, changes, subcontracting and evidence rules come from the call documents and agreement.
Every task should have a folder or record: description, owner, outcome, evidence, date, status and link to costs.
If a cost relates to penetration testing, there should be a test report, scope, acceptance protocol and budget link.
In a consortium, every partner must provide evidence of its tasks, while the coordinator should control completeness.
Supplier delay, technical problem, lack of resources or scope change should go into the risk register, not remain an informal conversation.
The best grant project increases the cyber resilience of beneficiaries. This means that after the project ends, the organization should be better prepared for threats, not only richer by one document or one-time report.
A Polish cybersecurity company develops a tool helping SMEs prepare for NIS2 and CRA. The tool supports asset inventory, supplier assessment, risk register, training and compliance evidence. The company sees a Digital Europe call and wants to apply.
The first version of the application is too generic. It describes a “cyber platform for SMEs”, but does not identify a specific beneficiary group, KPIs, pilot, sustainability model and evidence. After a workshop, the scope is narrowed: the project includes a platform, training module, expert hotline, pilot in 50 SMEs and impact report. The budget is assigned to work packages, while a research partner owns the maturity assessment methodology.
After receiving the grant, the company launches an evidence repository, meeting cycle, risk register, progress reporting and acceptance protocols. It does not wait with documentation until the end of the project. After several months, it can show which SMEs used the tool, which gaps were identified, which training was completed and which outcomes were deployed.
This topic can be connected with further reading and CCyber services to move from funding idea to a well-prepared project and secure implementation.
ccyber.io helps organizations prepare cybersecurity project scope, plan budgets, define outcomes, collect evidence, implement solutions and translate funding into a real increase in cyber resilience. We can support both organizations applying for grants and beneficiaries that already received funding and must deliver the project properly.
We can support your organization with:
The best first step is a Cyber Grant Readiness Workshop. In a short workshop, the company can determine whether the idea fits the funding programme, which outcomes should be planned, which costs are logical and which evidence should be collected from the first day of the project.
Sometimes yes, but it depends on the rules of the specific call. The purchase must be part of a project with a clear objective, outcome, beneficiary and justification, not only a shopping list.
In some calls yes. In others, a consortium is recommended or practically useful. The call documentation and eligibility requirements must always be checked.
Not always, but many current cyber calls support solutions helping organizations meet regulatory requirements, including NIS2 and CRA. Alignment with regulations often strengthens project justification.
Both matter. A good idea can fail because of weak scope, budget and missing evidence. A good grant project must be needed, feasible and reportable.
No project manager, weak documentation, unclear partner roles, underestimating reporting, delays, missing evidence and uncontrolled scope changes.
It can improve project attractiveness if AI is justified and securely designed. Simply adding AI to an application without clear function, data, controls and AI Act compliance may weaken the project.
Through measurable outcomes: number of tests, deployments, trained people, closed vulnerabilities, reduced response time, improved maturity, technical reports, acceptance protocols and pilot results.
Start with alignment between the idea and the call objective. Then define beneficiary, outcome, budget, partners, KPIs, risks and evidence that will prove the project was delivered.
Cybersecurity grants from the Digital Europe Programme and NCC-PL initiatives can be an important accelerator for Polish companies, SMEs, cyber providers, the public sector, healthcare and organizations preparing for NIS2, CRA, DORA and AI Act. They can support tools, services, training, tests, platforms and new skills.
However, the grant should not be treated as one-time funding for a purchase. It should be a project with a real outcome, beneficiary, metrics, timeline, evidence and sustainability plan. A well-delivered project does not only end with successful reporting. It leaves behind stronger cyber resilience.
The best rule is: do not write a project for the money. Write it for a problem that truly needs to be solved, and treat funding as a tool to reach the outcome faster and with better documentation.
National Cybersecurity Rules in Local Government: What Are Mayors and Local Leaders Responsible For?
The amended Polish national cybersecurity framework turns local government cybersecurity from a purely technical issue into a leadership accountability issue. A mayor, city president, county leader or head of an entity should no longer ask only whether IT “secured something”. They should know whether the entity is in scope, registered, connected to the S46 system, has an ISMS, risk register, incident procedure, backup, MFA, supplier assessment, training, AI rules and evidence of execution. The biggest risk is not the lack of a document, but the lack of an operating process, owners and management decisions before an incident.
Prepared by: CCyber Editorial Team
The amended Polish national cybersecurity framework means that cybersecurity in local government can no longer be treated as a task for one IT person or IT provider. A mayor, city president, county leader, regional leader or head of an entity must understand whether the entity is in scope, what obligations apply, who owns the risk, how incidents are reported, whether backup works, who has administrative access, which suppliers are critical and whether employees know how to use AI safely. The most important elements are an information security management system, incident procedures, compliance evidence and recurring management reporting. Leadership accountability means decisions, oversight and evidence, not manual technical execution.
July 2026
The amended Polish national cybersecurity framework, implementing NIS2, changes how local government should think about cybersecurity. Cybersecurity is no longer a server room topic. It is part of continuity of public services, protection of resident data, trust in the office, security of e-services and management accountability.
Local government now operates digitally: ePUAP, e-delivery, tax systems, resident registers, financial systems, public information bulletin, email, document workflow, education systems, municipal services, monitoring, healthcare systems and platforms for communication with residents. An attack on these systems is not only an IT issue. It may mean interruption of services, data leakage, communication chaos and leadership accountability.
IT can implement safeguards, administer systems and respond technically. But IT should not independently decide on risk acceptance, budget, public service priorities, resident communication, regulatory notifications, supplier relationships or accountability for data.
This is why national cybersecurity rules move cybersecurity to leadership level. Not so that the mayor configures a firewall, but so that the office has real oversight of risk.
In practice, the analysis should cover not only the municipal, county or city office. Local government is an ecosystem of many units, suppliers and services. Some entities may be registered by the authorities, some may require individual analysis and some may be indirectly affected through contracts or sector rules.
Deadlines matter because they show that preparation cannot be postponed until the end of the year. A local government entity should maintain an obligations calendar and report its status to leadership.
The first task is to assess whether the office or unit is an essential entity, important entity, entity registered by the authorities, entity requiring self-registration or entity indirectly affected through relationships with other units or suppliers.
Registration is the first formal step for many entities. Some entities may be registered by the authorities, but this does not remove the obligation to complete data and implement further duties.
The S46 system is intended, among other things, for incident reporting, receiving warnings and communicating with competent authorities in the national cybersecurity system. A local government should treat S46 as an operational channel, not only a formal platform.
An information security management system should be a working system, not a folder of documents. It should include risks, policies, procedures, roles, evidence, reviews and remediation actions.
Local government leadership should see risks in the language of impact on public services, residents and business continuity, not only in technical language.
The incident procedure should answer: who detects, who classifies, who escalates, who reports, who communicates and who makes business decisions. Under national cybersecurity rules, incident reporting to CSIRTs and use of proper channels, including S46, is important.
Local governments often use many domain systems and documents whose loss may paralyze work. Backup without restore testing is not sufficient resilience evidence.
Compromise of email, administrator or IT provider account is one of the easiest ways into an organization. MFA should be treated as a baseline requirement, especially for email, administrators, VPN, finance systems, backup and remote access.
Many local governments use external providers for tax systems, finance, document workflow, public information bulletin, email, backup, hosting, e-services, IT support and cybersecurity. Their risk is the entity’s risk.
Shadow AI in local government means employees using AI tools without organizational knowledge and rules. The most risky scenario is entering resident data, administrative decision data, medical information, children’s data, social assistance records or internal documents into public chatbots.
The head of an entity does not need to know system administration commands, but must ask the right questions. This is the simplest way to translate accountability into oversight.
Shadow AI is especially dangerous in administration because public offices process resident data and handle matters that may involve taxes, social assistance, education, healthcare, real estate, complaints, permits and administrative proceedings. Using a private chatbot to draft a letter may seem harmless, but it can cause confidentiality breach, incorrect content, unauthorized data processing or lack of control over where information goes.
The document workflow system, network share and some computers are encrypted. Email is unstable. Residents cannot handle some matters. The office must decide whether to activate emergency work, report the incident, inform leadership and recover data.
An attacker gains access to email and tries to change a bank account number in correspondence with a contractor. Fast account blocking, email analysis, payment verification and finance communication are needed.
A file containing resident personal data was sent to the wrong recipient or entered into an external AI tool. The office must assess GDPR, national cybersecurity rules, duties toward people, evidence and remediation actions.
A tax or e-service system provider has an incident and the system is unavailable. The office must know whether it has a workaround, emergency contact, SLA, data backup and resident communication plan.
IT is important, but national cybersecurity rules concern leadership accountability, data, public services, suppliers, incidents, audits and communication.
The entity assumes it is not in scope or waits for an official notification. Meanwhile, the obligation to assess and act may sit with the entity.
A security policy without restore testing, access review, training, risk register and remediation actions does not create real resilience.
One person has access to the system, procedures and contacts. When they are on leave, the office cannot report an incident.
Backup exists, but nobody knows whether the finance system, document workflow or domain system data can be restored.
The IT provider has remote access, but nobody knows whether it has MFA, whether actions are logged and how it reports incidents.
Employees use private chatbots to draft letters and summarize documents, while the office has no rules, training or risk assessment.
Leadership does not receive information about risks, gaps and actions. Without reporting, it is difficult to demonstrate oversight and due diligence.
A medium-sized city office uses a document workflow system, tax system, finance and accounting system, e-delivery, public information bulletin, email, education systems and several external providers. Leadership knows that the amended law applies, but assumes the topic is under control because the office has IT staff and an external IT provider.
The first review shows that there is no current risk register, backup has not been tested for a year, some administrator accounts do not have MFA, the IT provider uses a shared account and employees use public AI tools to draft letters. There is also no incident notification template and no deputy for the main IT person.
The office implements a 90-day plan: applicability assessment, critical service register, MFA, restore test, incident procedure, AI policy, supplier assessment, training and tabletop. After three months, leadership receives a report with risks, remediation actions and evidence. This does not finish the work, but it turns cybersecurity from informal trust in IT into a managed oversight system.
This topic can be connected with further reading and CCyber services to move from awareness of accountability to concrete action in local government.
ccyber.io helps local governments and public entities translate national cybersecurity rules into a practical programme of actions, evidence and oversight. We combine legal, technical, organizational and management perspectives so leadership knows what has been implemented, what requires a decision and what risk remains.
We can support your organization with:
The best first step is a KSC Readiness Workshop for local government. In a short workshop, the entity can define its status, key obligations, security gaps, shadow AI risks, required evidence and action priorities before the next statutory deadlines.
No. They must ensure oversight, owners, budget, decisions, reporting and evidence. Leadership accountability means risk management, not technical system configuration.
No. IT staff or a provider can perform technical tasks, but the office still needs an ISMS, procedures, risk register, leadership oversight, supplier control, training and evidence.
Not always. Some entities are registered by the authorities, while others may require self-registration. Every entity should assess its status and not assume automatically that the obligation does not apply.
Status assessment, registration, contact persons, S46, ISMS, critical system register, MFA, backup, restore testing, incident procedure, supplier assessment and employee training.
S46 Cyber Hub is a platform used, among other things, for incident reporting, receiving warnings and exchanging cyber threat information with competent authorities in the national cybersecurity system.
Employees may enter resident data, sensitive data or official documents into public AI tools without control. This may violate information security, GDPR, national cybersecurity rules and responsible AI use principles.
MFA report, backup and restore test report, risk register, critical system register, supplier register, incident procedure, training report, access review and remediation action status.
Start with a simple review: status under national cybersecurity rules, critical systems, resident data, IT suppliers, administrator accounts, MFA, backup, incident procedure and employee training. Then build an ISMS and action roadmap.
National cybersecurity rules in local government change the level of accountability. Cybersecurity is no longer only a technical issue. It is part of public service management, resident data protection, business continuity and leadership accountability.
A mayor, city president, county leader or head of an entity does not need to do an administrator’s job, but must know whether the entity has a functioning information security management system, incident procedures, backup, MFA, assessed suppliers, AI rules, training and evidence. Without this, demonstrating due diligence will be difficult.
The best rule is: do not ask only whether the office has IT staff. Ask whether the office has a system that can detect an incident, report it on time, recover services, protect resident data and show leadership a real picture of risk.
What Must a Company Do Under NIS2? 10 Obligations, Evidence and Priorities Based on ENISA NIS360
NIS2 is not about one document or a one-time audit. A company in scope must build an operating cyber risk management system: risk register, security policies, incident procedure, business continuity, backup, supplier assessment, vulnerability management, training, cryptography, access control, asset management, MFA and board reporting. ENISA NIS360 shows that cybersecurity maturity in EU critical sectors is improving, but unevenly. The key is a proportionate approach: start with critical services, risks, evidence and actions that truly reduce incident impact.
Prepared by: CCyber Editorial Team
A company in scope of NIS2 must do more than prepare a security policy. It must implement and maintain proportionate technical, operational and organizational measures to manage cyber risk and reduce incident impact on customers, users, other services and the supply chain. In practice, this means 10 areas: risk analysis and information security policies, incident handling, business continuity, supplier security, acquisition and maintenance security, effectiveness assessment, cyber hygiene and training, cryptography, HR security, access control and asset management, plus MFA and secure communications. In addition, board oversight, significant incident reporting, compliance evidence and regular reviews are required. The key is not having documents, but being able to show that the process works.
July 2026
Before building a NIS2 programme, the company must check whether it is directly, indirectly or contractually affected. This matters because an essential or important entity has different duties from a smaller supplier receiving requirements from a NIS2 customer.
Even if a company is not directly in scope of NIS2, it may receive requirements from a customer. This especially concerns IT providers, software houses, SaaS, cloud, hosting, maintenance, backup, SOC, MDR, OT integrators, logistics companies, laboratories, healthcare subcontractors and providers serving public administration.
ENISA NIS360 is not a checklist for an individual company. It is a sectoral report that helps understand where high criticality sectors stand in terms of cybersecurity maturity and criticality for society and the economy.
The report shows that cybersecurity maturity in critical sectors is improving, but unevenly. ENISA identifies a risk zone, meaning sectors where criticality exceeds maturity. These include health, railway, maritime, ICT service management, space, public administrations, and drinking water and wastewater.
For a company, the conclusion is simple: if you operate in a high criticality sector or provide services to such entities, you must organize governance, risk, incidents, suppliers and business continuity faster.
Boards often ask: where should we start if NIS2 is so broad? ENISA NIS360 suggests a way of thinking. Do not start with documents. Start with how critical your service is, how mature your current cybersecurity model is and how large the gap is between service importance and organizational readiness.
Article 21 is the operational core of NIS2. Below is a practical translation of the 10 areas into actions and evidence a company should prepare.
The company must know which cyber risks matter most, how they affect services and which mitigation actions are planned. The risk register cannot be a file created once before an audit. It must be updated after changes, incidents, audits and new requirements.
NIS2 requires preparation for detecting, analyzing, containing, reporting, handling and recovering from incidents. The incident procedure should operate before an attack, not be written during ransomware.
Backup without restore testing is only a declaration. NIS2 requires operational resilience, meaning the ability to maintain or recover services after an incident.
An IT, cloud, SaaS, backup, SOC, finance system or OT integrator can be either the source of an incident or a condition for recovery. NIS2 requires security aspects of relationships with direct suppliers and service providers to be considered.
Security must be considered when buying, implementing, developing and maintaining systems. This applies both to internally developed applications and purchased SaaS or systems delivered by external providers.
NIS2 cannot be satisfied on paper. The company must have policies and procedures to assess whether safeguards work. This means measuring, testing and improving.
Cyber hygiene is not an add-on. It is an obligation. Employees must recognize phishing, know how to report incidents, use MFA, protect data and understand basic rules of working with technology.
The company should know where encryption is used, how it protects data at rest and in transit, who manages keys and which data requires special protection.
The company must know who has access, to what, why and when access was reviewed. It must also know which assets it has: systems, applications, devices, data, accounts, suppliers and public-facing assets.
MFA is one of the key safeguards against account takeover. NIS2 refers to MFA or continuous authentication, secure voice, video and text communications, and secure emergency communication systems where appropriate.
NIS2 brings cybersecurity into the boardroom. Management cannot treat cyber as a technical IT problem. It must approve risk management measures, oversee their implementation and understand the consequences of non-compliance.
A presentation alone is not good evidence. Good evidence is minutes, a decision, risk approval, allocated budget, action owner and deadline.
NIS2 requires reporting significant incidents according to a defined cycle. The company should have the procedure ready beforehand, because during ransomware or account takeover there is no time to search for the reporting channel.
In Poland, NIS2 obligations must be read through national cybersecurity legislation. Entities covered by the amended law should analyze their activities according to sectors, enterprise size criteria and statutory provisions. In practice, this means preparing not only for “NIS2 compliance”, but for concrete national obligations, deadlines, registration, reporting channels and audits.
The health sector remains in the risk zone. For hospitals, clinics, laboratories and medical suppliers, this means priority for backup, business continuity, patient data protection, legacy system protection, monitoring and ransomware procedures.
Public administration is highly targeted and often has uneven maturity. Local governments and smaller units should start with basics: MFA, backup, incident procedure, system register, supplier assessment and training.
MSPs and MSSPs are critical for other sectors. Their weaknesses can transfer risk to customers. Managed service providers should therefore focus especially on patch management, segmentation, data security, operational preparedness and their own supplier security.
Transport operates in complex environments with many stakeholders, OT, IT and supplier dependencies. Priorities should include segmentation, remote access, continuity plans, OT security and supplier incident scenarios.
Service availability is directly connected with public safety. OT protection, remote access, configuration backup, emergency plans and exercises involving management and technical suppliers are important.
Finance is one of the most mature sectors, but this does not mean risk is low. DORA, NIS2, fraud, deepfakes, mobile malware, business continuity, ICT suppliers and operational resilience require continuous improvement and testing.
An auditor, customer, authority or board will not only want to hear that “NIS2 is implemented”. They will want evidence. The best compliance programme generates evidence during normal work.
NIS2 covers many areas. A company, especially an SME, should not try to do everything at once without priority. First, it should protect what has the highest impact on critical services and reporting duties.
Documents are necessary, but NIS2 requires operation. A policy without execution evidence will not defend the organization in an audit or after an incident.
The company assumes it is not in scope because it is too small or not a critical infrastructure operator. This may be wrong, especially for ICT providers, digital services and customer requirements.
If the board receives only technical IT reports, it does not truly perform oversight. It needs reports on risk, impact, costs, decisions and actions.
A risk without an owner, a system without an owner and a remediation action without an owner mean that the process does not work.
The company says it has backup, but has never restored a critical system. Under NIS2, resilience matters, not declarations.
An IT, cloud, MSSP, SaaS or backup provider may be critical to company operations. Their risk becomes the organization’s risk.
The 24-hour deadline is difficult to meet without a prior classification matrix, template and contact person.
The company implements safeguards, but does not measure whether they work. NIS2 requires assessment of the effectiveness of cyber risk management measures.
A mid-sized logistics company has 180 employees and serves manufacturing and e-commerce customers. It has WMS, ERP, Microsoft 365, VPN, customer integration system, an external IT provider and several SaaS suppliers. The board hears from a large customer that the company must demonstrate NIS2 readiness as a supply chain provider.
The first review shows partial MFA, backup without restore testing, no formal risk register, incomplete supplier list, outdated incident procedure and no board reporting. IT performs many technical actions, but there is no governance evidence.
The company implements a 90-day plan. It creates an applicability assessment, critical service register, risk register, enables MFA for critical accounts, performs a restore test, prepares an incident response plan, assesses key suppliers, trains employees and runs a ransomware tabletop. After three months, the board has a risk report, remediation actions and an evidence pack for the customer. The company is not fully mature yet, but it has moved from declarations to an operating programme.
This topic can be connected with further reading and CCyber services to move from NIS2 analysis to concrete organizational action.
ccyber.io helps companies translate NIS2 into a practical programme of actions, evidence and board oversight. It is not only about documentation. We help build a system that works in audits, customer discussions and real incidents.
We can support your organization with:
The best first step is a NIS2 Readiness Workshop. In a short workshop, the company can determine whether it is in scope of NIS2, what gaps exist, which actions are critical and which evidence should be prepared first.
No. NIS2 requires appropriate and proportionate technical, operational and organizational measures. A tool can help, but it does not replace owners, processes, decisions, evidence and board oversight.
No. Documentation is necessary, but it must be supported by operating evidence: reports, tests, access reviews, backup restore, training, supplier assessments and board decisions.
Start with applicability assessment, critical services, risk register, MFA, backup, incident procedure, suppliers and board reporting.
Yes. The board should approve and oversee cyber risk management measures and receive regular reports. Cybersecurity cannot be only an IT issue.
Risk register, asset register, security policies, incident response plan, BCP, DRP, backup report, restore test, supplier assessment, MFA report, access review, training and board report.
It shows that maturity differs across critical sectors and that some sectors are more critical than they are cyber-ready. Companies should prioritize actions according to impact on services, customers and supply chains.
Yes, if they meet NIS2 criteria or act as a supplier to a regulated entity. Even a smaller company can receive NIS2 requirements in contracts and customer questionnaires.
They can help with monitoring, incidents, technologies and evidence. They cannot take over board accountability, risk acceptance, business decisions or compliance oversight.
NIS2 requires companies to manage cyber risk in practice. The key areas are risk, incidents, business continuity, suppliers, system security, effectiveness of safeguards, training, cryptography, access, asset management, MFA and board reporting.
ENISA NIS360 shows that cybersecurity maturity in EU critical sectors is improving, but remains uneven. Some sectors, such as health, public administration, ICT service management, rail, maritime transport, water and wastewater, require particular focus on operational preparedness, suppliers and business continuity.
The best rule is: do not ask only whether we have a NIS2 document. Ask whether we can prove that we manage risk, detect and report incidents, recover operations, oversee suppliers and show the board a real picture of cyber resilience.
We write about regulations such as NIS2, DORA, CRA and ISO 27001, cybersecurity for SMEs and critical infrastructure, as well as cyber hygiene, emerging threats and building security awareness within organisations.
Every article delivers practical knowledge - no jargon, just concrete steps you can act on to effectively protect your data, people and business continuity.