Security audit under the KSC Act
We check whether your procedures, systems and technical and physical safeguards meet the requirements of Poland's National Cybersecurity System Act (KSC) and the KRI regulation. The audit is carried out by a team that meets the requirements of Article 15 of the Act. You receive a report with risks rated by severity and a remediation plan with deadlines.
When you need an audit
Essential entities must carry out their first audit by 3 April 2028 and then repeat it at least every three years. Audits are also required by grant programmes, public tenders and business partners who want confirmation that their supplier takes information security seriously.
01
What the audit covers
02
What you receive
An audit report and technical documentation, signed with the auditors' qualified electronic signatures.
- Overall assessment
- objectives, methodology and a security assessment written in plain language for management
- Risks and non-conformities
- vulnerabilities rated on the CVSS scale, non-conformities with the KSC Act and the KRI regulation, with references to specific provisions
- Remediation plan
- recommendations with deadlines and an assessment of the risk that remains after the changes
- Evidence
- logs, screenshots and scan results from the tests performed
An audit shows what needs fixing and provides a remediation plan, but it does not improve security on its own. We can help you implement the changes, and a retest can confirm their effect.
03
Selected work
- Cybersecurity audits and assessments of public offices and entities under the KSC Act, with the NASK‑PIB maturity questionnaire, recommendations and staff training.
- GDPR compliance audits, risk analysis and security policies, including for a fuel infrastructure operator and a central public institution.
04
Contact
Describe your situation. Within two working days we will tell you where to start, what scope of work we suggest and how long it will take.