NIS2 implementation

In short: NIS2 is an obligation to take cybersecurity management seriously, with clearly assigned board-level responsibility, regular risk assessments, and tangible evidence that the organisation can detect an incident, respond to it, and maintain business continuity.

For management: formal risk oversight (approved policy, objectives, and budget), defined roles and metrics (e.g. recovery time, patching timeliness, training completion rates), regular status reviews, and readiness to meet statutory incident reporting obligations (including early notifications and final reports).

For business and operations: consistent processes (access, updates, backups and recovery tests), security requirements embedded in supplier contracts, regular staff training, vulnerability scanning and patching, event monitoring, and complete documentation and registers; so that in the event of an audit, you can demonstrate not just that procedures exist, but that they are actually followed.

Size threshold (general rule): if you operate in sectors covered by NIS2 and are at least a medium-sized company (≥50 employees and ≥€10M in turnover or balance sheet total), you fall within the scope of the directive.

Automatic exceptions (regardless of size): certain types of entities are always in scope, including providers of cloud services and data centres, managed IT services (MSP/MSSP), public networks and electronic communications, DNS/TLD services, trust services, and certain digital platforms and services.

Small companies in a critical role: even below the threshold, you may be brought into scope if you play a key role in service continuity, such as the sole significant supplier in a region or supply chain, or due to a high risk profile.

Financial (administrative) penalties:

• Essential entities: up to €10M or 2% of global annual turnover, whichever is higher.
• Important entities: up to €7M or 1.4% of global annual turnover, whichever is higher.

Additional sanctions and supervisory measures:

• binding orders to remediate violations with set deadlines,
• audit/inspection and obligation to provide evidence of compliance,
• public disclosure of the violation (including the entity’s name),
• possible temporary removal of management personnel from security-related responsibilities.

Step by step:

1. Scoping and qualification (1–2 weeks): confirmation of whether you are subject to NIS2, under which category (essential/important), and which systems/processes/suppliers are in scope.
2. Audit and gap mapping (2–4 weeks): assessment of the current state against NIS2 requirements; prioritised gap list with assigned responsibilities and risks.
3. Roadmap and quick wins (2–4 weeks): action plan, implementation of quick wins (access controls, backups, core procedures), beginning of documentation process.
4. Implementation and audit readiness (4–12+ weeks): processes (risk, incidents, continuity), technical measures, training; evidence pack prepared and incident reporting drill completed.

How long does it take?
For a typical medium-sized organisation, core implementation usually takes 8–16 weeks; full process maturity and cyclical review takes 3–6 months. The duration depends primarily on the complexity of the environment, number of suppliers, availability of data and evidence, and the organisation’s readiness for change.

In short: No. Being ISO 27001, PCI DSS or GDPR compliant is very helpful, but does not guarantee compliance with NIS2. A gap analysis is needed, along with addressing requirements specific to NIS2.

Why is it not enough?

• Scope:
  • ISO 27001: information security management system (ISMS), but without some of the NIS2 supervisory obligations.
  • PCI DSS: narrow scope (card data).
  • GDPR: personal data protection, not comprehensive service resilience.
• Specific to NIS2: management responsibility, categories of entities (key/important), supply chain requirements, incident reporting deadlines (initial notification within 24h, update within 72h, final report), possible supervisory measures and penalties.

What usually needs to be added despite ISO/PCI/GDPR?

• formal NIS2 qualification and registration under national law,
• incident reporting policies and procedures, including dry run,
• security requirements for suppliers and evidence of verification,
• metrics and reporting to management confirming oversight,
• a coherent set of compliance evidence aligned with NIS2 implementation in Poland.

Conclusion: existing certifications shorten the path, but a gap map against NIS2 and closing the missing elements is necessary.

Competent authorities and CSIRTs in Poland:

• Supervision is sector-based. Competent authorities are typically the relevant ministries (e.g., Digital Affairs for digital infrastructure, respective ministries for infrastructure/energy/health etc.). The contact list is published by, among others, the EC.
• Three national-level CSIRTs: CSIRT NASK (CERT Polska), CSIRT GOV (ABW) and CSIRT MON(MON) cooperating and coordinating incident handling within the KSC framework.

Current status: the EU deadline for transposing NIS2 into national law passed on 17 October 2024. For countries that missed the deadline (including Poland), the European Commission initiated infringement procedures and issued reasoned opinions in May 2025.

What happens next in Poland: On 22 October 2025, the Council of Ministers adopted a draft amendmentto the KSC Act implementing NIS2 (currently going through the legislative process). The proposal sets out avacatio legis period: 1 month, followed by 6 months for adjustment for essential and important entities. The final deadlines and procedures will be confirmed once the law is formally adopted.

Practical takeaway: if you potentially fall within the NIS2 scope, preparations (qualification, gap map, action plan) are worth starting before the final legislation is enacted, as the real window for full adoption will be short.