The NIS2 requirements apply to medium and large enterprises operating in certain sectors considered essential or important for the functioning of EU society and the economy. Criteria include, among others, the number of employees (over 50) and annual turnover (above EUR 10 million). Some small enterprises may also fall within the scope if they provide services of significant importance to society or the economy.

The NIS2 requirements expand the range of sectors covered compared with the previously applicable NIS. They include, among others:

• •Energy
• •Transport
• •Banking and financial market infrastructure
• •Healthcare
• •Drinking water supply and wastewater management
• •Digital infrastructure
• •Public administration
• •Manufacture and distribution of chemicals
• •Food production
• •Postal and courier services
• •Waste management
• •Digital service providers

To assess whether your company is subject to the KSC Act, you should:

• •Determine the company’s sector of activity and check whether it is listed in the Directive as essential or important. The decisive factor is the actual carrying out of activities in the sectors listed in the annexes to the Directive.

• •Check whether the company meets the size criteria (number of employees and annual turnover).

• •Consider the importance of the services provided for society and the economy. Online tools, such as questionnaires, are also available to help make a preliminary assessment of whether the company is subject to the Directive.

The NIS2 Directive entered into force on 16 January 2023. Member States of the European Union were required to implement its provisions into their national legal frameworks by 17 October 2024. In Poland, NIS2 was implemented in 2026, through an amendment to the Act of 5 July 2018 on the national cybersecurity system (consolidated text: Journal of Laws of 2026, item 20, as amended).

In the event of a cybersecurity incident, an organisation should activate pre-prepared incident response procedures, which are a key element of an information security management system.

First, the incident should be identified without delay, its scale and potential impact on business continuity, system integrity and data protection should be assessed. This process should include an initial technical analysis and classification of the incident according to the adopted criteria. At the same time, measures should be taken to mitigate the effects of the event – for example, isolating the infected system, restoring basic operational functions or activating contingency plans.

In accordance with the NIS2 Directive, an organisation has the obligation to notify serious security incidents to the appropriate national authority (e.g. CSIRT or another supervisory authority) within specified timeframes – usually an initial notification within 24 hours, supplemented by a report within 72 hours and a final report after the effects have been remedied. Notification of service recipients is also required if the incident may have affected the provision of essential or important services.

After the situation has been contained, the organisation should conduct an in-depth root cause analysis to identify the gaps that allowed the incident to occur. On this basis, appropriate corrective and preventive measures should be implemented, which may include updating security policies, system configurations, access management procedures or additional training for employees.

A key aspect is documenting all stages of incident response and verifying the effectiveness of the measures taken. This not only enables compliance with legal obligations to be demonstrated, but also supports the continuous improvement of the information security management system.

Obliged entities should implement appropriate technical and organisational measures to effectively manage cybersecurity risk. This includes, among other things, carrying out risk assessments, developing and applying security policies, effective incident management, organising training for personnel and securing the supply chain. An important obligation is also the reporting of serious security incidents to the relevant national authorities. Regular risk assessments and security audits should be conducted to ensure the measures in place remain up to date and effective. Cooperation with national authorities and other entities in exchanging information about threats is also of key importance.

The Act on the national cybersecurity system provides for severe penalties for non-compliance with its provisions:

• •For essential entities: up to EUR 10 million or 2% of annual turnover.
• •For important entities: up to EUR 7 million or 1.4% of annual turnover.

Additionally, persons responsible for management may be held liable for breaches of the obligations arising under the Directive.

In principle the NIS2 requirements apply to medium and large enterprises. However, some small and micro-enterprises may be covered if they provide services of significant importance to society or the economy, such as DNS service providers, domain registrars or qualified trust service providers.

The differences between the NIS Directive and the NIS2 Directive are significant and reflect the growing need for a more effective approach to cybersecurity at Union level. The NIS2 Directive introduces a number of important changes compared with its predecessor.

First, the scope of entities has been expanded – the new rules cover many more sectors, including, among others, postal services, waste management, the manufacture of selected products (e.g. pharmaceuticals or electronics), and public administration. More precise criteria for classifying entities as "essential" or "important" have also been introduced, which affects the scope of obligations and supervision.

Second, NIS2 provides for more stringent requirements on risk management and incident reporting. Obligations in this area have been clarified and harmonised across the EU, and entities must implement specific remedial measures and report serious incidents within defined timeframes.

Third, the responsibility of senior management has been increased. Under NIS2, they are not only responsible for the implementation of technical and organisational measures, but must also demonstrate engagement in oversight of cybersecurity, including participation in training.

Moreover, the new rules provide for harsher sanctions for non-compliance, including administrative fines that can be significant – both for organisations and for their management.

A final key change is the strengthening of cooperation and information sharing between Member States, including through the establishment of the European cooperation network (EU-CyCLONe) and improved communication between CSIRTs and the relevant national authorities.

Preparing a company for implementation of the NIS2 requirements requires a comprehensive approach to cybersecurity management. The first step should be a detailed risk assessment that will identify potential threats to operational continuity and the security of information systems. On this basis, appropriate technical and organisational measures should be implemented to enable effective management of the identified risks.

Another important element is the development and implementation of procedures for reporting security incidents in line with the requirements of the KSC Act – including defining how incidents are classified and the deadlines and procedures for reporting them to the competent authorities. Equally important is adequate training of staff, not only technical personnel but also management, to ensure awareness of threats and familiarity with the applicable procedures.

One must also maintain contact with the competent national authorities and participate in the information-sharing system on threats and incidents, which is a key element of the security framework at the European level. Regular updating of activities and documentation based on changing requirements and emerging threats will be necessary to ensure compliance with the KSC Act.