Cybersecurity and compliance
We establish the real state of your security and your compliance with the KSC Act and ISO/IEC 27001. We show what to fix first and support you in implementing an information security management system, business continuity plans and procedures. Finally, a retest checks that the safeguards work.
Who the KSC Act applies to
Since 3 April 2026, an amended version of Poland's National Cybersecurity System Act (KSC), which implements the NIS2 directive, has been in force. It covers more organisations, including in public administration, healthcare, water and wastewater, energy and manufacturing. Organisations covered from the day the amendment took effect have until 3 April 2027 to meet their obligations, including implementing an ISMS. Essential entities must carry out their first audit by 3 April 2028. Audits are also often required in public tenders and by business partners.
01
Scope of services
02
Measurable result
We measure the effect by the number and severity of vulnerabilities, the retest result and compliance with the KSC Act. For business continuity, we measure exercise results and actual recovery time against the target (RTO). We agree specific measures before we start.
An audit shows what needs fixing and provides a remediation plan, but it does not improve security on its own. If you want to check the effect of the fixes, the contract can include a retest.
03
Selected work
- 30 organisations where we have implemented, audited or overseen cybersecurity and data protection, including a fuel infrastructure operator, a central public institution, a transport operator and local authorities.
- Cybersecurity audits and assessments of public offices and entities under the KSC Act, with the NASK‑PIB maturity questionnaire, recommendations and staff training.
- ISMS documentation, implementation, internal audits and maintenance in line with ISO/IEC 27001 in district heating, public administration, transport and services, including transition to the 2023 edition of the standard.
- Business continuity management systems, tested by shutting down the IT environment.
04
Contact
Describe your situation. Within two working days we will tell you where to start, what scope of work we suggest and how long it will take.