Cybersecurity
NIS2 isn't another GDPR. Personal board liability and fines up to PLN 100 million. Find out if your company is covered and how to avoid penalties.
When yet another EU directive lands, many executives roll their eyes and brace for a fresh wave of red tape. Poland's implementation of the NIS2 Directive is a different story. It isn't an incremental update to existing rules. It's a fundamental paradigm shift, driven by hard geopolitical realities. As a frontline state, Poland is adopting rules that go well beyond the EU minimum and treating cybersecurity as part of national security. Ignoring these changes is no longer a viable business option. It poses a direct threat to the company's stability and to the personal careers of its executives. This article cuts through the legal jargon to reveal five of the most striking, and often surprising, truths about the new National Cybersecurity System Act (KSC).
The most revolutionary change NIS2 brings is that it shifts accountability once and for all from technology teams to the board itself. Cybersecurity stops being a technical matter and becomes a core element of corporate governance, one that executives answer for personally. It redefines cybersecurity as a fundamental fiduciary duty of the board, on par with financial oversight, rather than a technical task to be delegated.
Under the new rules, management bodies must approve risk management measures and oversee their implementation. Most importantly, this is a personal, non-transferable responsibility. It cannot be handed off to the Chief Information Security Officer (CISO) or any other employee. It is tied directly to the office held. The consequences of negligence fall squarely on executives: the supervisory authority can fine a board member up to 600% of their compensation and impose a temporary ban on holding management positions.
To make sure this accountability is more than words on paper, the Act sets out a concrete requirement: board members have a statutory obligation to complete regular cybersecurity training. So the law doesn't just create a harsh penalty. It also prescribes the remedy: education. The goal is to give leaders the knowledge they need to make informed decisions about allocating resources and accepting risk.
The new rules fundamentally change how regulated entities are identified, shifting the entire burden and legal risk onto businesses. The old NIS1 model, in which a public authority designated companies as "operators of essential services," is being retired.
Now every company must self-identify. That means proactively assessing its own operations, mainly against the "size-cap rule" (which captures medium and large enterprises at a minimum) and whether it operates in one of the sectors listed in the Act. But relying on headcount alone is a recipe for disaster. The Act includes a list of critical exceptions: entities that are covered regardless of size. These include:
The analysis also has to go much further: you must factor in data from linked and partner enterprises across the entire corporate group. As a result, even a small company can fall under the regulation if it belongs to a larger structure. This requires in-depth legal analysis, and getting it wrong can have serious consequences for operating as an unregistered essential or important entity.
NIS2 opens an entirely new front of corporate accountability: the security of the entire supply chain. Companies can no longer focus solely on their own systems. The new law makes them responsible for the cybersecurity posture of their direct suppliers and service providers.
In practice, this means implementing a comprehensive Third-Party Risk Management process. Entities covered by the Act are required to:
On top of that, the state gains a powerful tool: the "High-Risk Vendor" (HRV) procedure. The Minister of Digital Affairs will be able to designate a hardware or software supplier as high-risk. For companies, this means not only a ban on buying new products from that vendor, but also an obligation to remove and replace infrastructure already in use within 4 to 7 years. Crucially, the Act provides no compensation for the cost of these "rip and replace" operations, which represents a massive, uninsurable financial risk.
Many companies that self-identify and qualify as an "important entity" (rather than an "essential" one) may breathe a sigh of relief, assuming this comes with far lighter requirements. That's a dangerous and, as an analysis of the rules shows, false assumption.
The core obligations to implement technical and organizational measures, set out in Article 8 of the Act, are essentially the same for both categories. Essential and important entities alike must implement a risk-based security management system covering, among other things, incident handling, business continuity, supply chain security, and regular testing.
The real difference lies in the supervisory regime:
The strategic trap is this: an "important" entity has less contact with the regulator before a crisis, but once one hits, it will be judged by the same strict standards. The absence of prior audits can create a false sense of security that will be brutally tested after the first serious incident.
Polish lawmakers didn't simply copy the EU rules. When it comes to financial penalties, they opted for "gold-plating": implementing measures far stricter than the minimum required by Brussels, with the aim of creating a chilling effect.
The NIS2 Directive sets maximum administrative fines of up to EUR 10 million (or 2% of global turnover) for essential entities and EUR 7 million (or 1.4% of turnover) for important entities. The Polish Act, however, adds a separate, much higher ceiling. Where a breach endangers national security or public health, or causes serious property damage, the supervisory authority can impose a fine of up to PLN 100,000,000.
And that's not all. The Act also gives regulators a tool for applying continuous pressure. For failing to comply with an administrative decision on time (for example, an order to remediate a vulnerability), the authority can impose a periodic penalty of up to PLN 100,000 for each day of delay. It's a powerful enforcement mechanism that makes ignoring post-inspection recommendations financially ruinous.
If you're wondering whether your company falls under NIS2, need help with self-identification, or want to implement the required security measures, get in touch with us. We'll help you prepare your organization for full regulatory compliance and avoid steep administrative penalties.
The new National Cybersecurity System Act is much more than a list of boxes to tick. It's a new business reality that demands fundamental change in organizational culture, corporate governance, and partner relationships. Personal board liability, mandatory supplier vetting, and draconian fines add up to a system in which cybersecurity becomes a prerequisite for staying in business. That leaves one key question every executive must ask: will you treat the new rules as an investment in business resilience, or just as a costly bureaucratic burden?
Aleksander
Sources: Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2) National Cybersecurity System - official government information
Your company falls under NIS2 if it operates in one of the 18 essential or important sectors (energy, transport, banking, healthcare, water, ICT, public administration, manufacturing, food, and others) and has at least 50 employees or annual turnover above EUR 10 million. However, there are key exceptions: some entities (telecom network providers, trust service providers, TLD registries) are covered regardless of size. You must self-identify, taking your entire corporate group into account.
The NIS2 Directive entered into force on January 16, 2023, and member states had until October 17, 2024, to transpose it into national law. Poland is implementing NIS2 by amending the National Cybersecurity System Act (KSC). Once the amendment takes effect, covered entities will have a set period to self-identify and implement the required security measures. It's essential to start preparing now, because fully deploying monitoring systems and procedures takes months of work.
The administrative fines are significantly tougher than under GDPR. For essential entities: up to EUR 10 million or 2% of global turnover (whichever is higher). For important entities: up to EUR 7 million or 1.4% of turnover. Poland has also gold-plated the rules: where national security is threatened or serious property damage occurs, the fine can reach PLN 100 million. In addition, failing to comply with an administrative decision can trigger a periodic penalty of up to PLN 100,000 for each day of delay. Board members can face a personal fine of up to 600% of their compensation and a ban on holding management positions.
NIS2 and GDPR (known in Poland as RODO) are separate regulations with different goals. GDPR protects the personal data of EU citizens, requires data breach notification within 72 hours, and carries fines of up to EUR 20 million or 4% of turnover. NIS2 protects critical infrastructure and service continuity, requires an early warning of an incident within 24 hours plus a full notification within 72 hours, and carries fines of up to EUR 10 million or 2% of turnover (or PLN 100 million in Poland). NIS2 imposes personal liability on the board and requires 24/7 monitoring and vetting of the ICT supply chain. Organizations often have to meet both sets of requirements at once.
Self-identification is every company's obligation to determine on its own whether it falls under NIS2. The process involves: (1) Checking whether you operate in one of the sectors listed in the Act (18 categories), (2) Verifying company size under the "size-cap rule" (at least 50 employees or EUR 10 million in turnover), (3) Checking the exceptions, since some entities are covered regardless of size (telecom, DNS, trust services), (4) Accounting for the entire corporate group, since a small company can be covered if it belongs to a larger structure. If you determine you're covered, you must register with the appropriate supervisory authority (NASK, CSIRT GOV, or CSIRT MON). A self-identification error can result in penalties for operating as an unregistered entity.
Essential entities include these sectors: energy, transport, banking, healthcare, drinking water, and digital infrastructure. Important entities include manufacturing, food, chemicals, postal services, waste management, and others. The core obligations regarding technical measures (Article 8 of the Act) are the same for both categories: risk management, incident handling, business continuity, and supply chain security. The difference lies in the supervisory regime: essential entities are subject to ex-ante supervision (inspections at any time), while important entities are subject to ex-post supervision (inspections after incidents). Fines: up to EUR 10 million/2% of turnover for essential entities, up to EUR 7 million/1.4% of turnover for important entities.
Reporting is a three-stage process: (1) Early Warning - a report to the competent CSIRT (NASK/GOV/MON) within 24 hours of detecting the incident, with basic information (what happened, initial severity assessment), (2) Incident Notification - an update within 72 hours with a severity assessment, indicators of compromise (IoCs), and information on any cross-border impact, (3) Final Report - within one month after the incident is contained, with a detailed analysis of root causes, consequences, and remediation measures taken. The 24/72-hour requirement effectively makes 24/7 monitoring mandatory: without a round-the-clock SOC, you can't meet the deadline if an incident happens over the weekend.
NIS2 doesn't explicitly require a SOC, but it effectively forces you to have one. The Act requires: (1) Continuous monitoring of infrastructure to detect incidents, (2) Reporting significant incidents within 24 hours (early warning) and 72 hours (full notification), (3) Rapid response and containment of attacks. In practice, to meet the 24-hour reporting requirement when an incident occurs on a Friday night, over a weekend, or on a public holiday, you need 24/7/365 monitoring. That can be an in-house SOC, an outsourced SOC (Managed SOC/SOCaaS), or a hybrid model. Without analysts on duty around the clock, an organization has no chance of being compliant.
NIS2 introduces accountability for the security of ICT suppliers. Organizations must: (1) Inventory all providers of IT systems, software, and cloud services, (2) Categorize suppliers by the level of risk they pose to business continuity, (3) Audit suppliers' security controls and processes, (4) Add security clauses to contracts and SLAs (technical requirements, incident reporting, audits), (5) Implement policies for onboarding new suppliers. In addition, the Minister of Digital Affairs can designate a supplier as a "High-Risk Vendor" (HRV), which means a ban on purchasing new products and an obligation to replace existing infrastructure within 4-7 years with no compensation (a "rip and replace" operation).
NIS2 introduces personal, non-transferable board liability. The supervisory authority can impose the following on a board member: (1) A fine of up to 600% of their compensation for serious negligence, (2) Temporary suspension from management duties, (3) A ban on holding management positions in NIS2-regulated entities. This liability covers: approving and overseeing risk management measures, ensuring the board receives cybersecurity training, and proper incident reporting. It cannot be delegated to the CISO or any other employee. It's a fundamental shift: cybersecurity becomes a fiduciary duty of the board, on par with financial oversight.
Generally no, as long as the company stays below the threshold of 50 employees and EUR 10 million in turnover. However, there are critical exceptions: small businesses are covered by NIS2 regardless of size if they are: (1) Providers of public electronic communications networks/services (telecommunications), (2) Trust service providers (e-signatures, certificates), (3) TLD registries and DNS providers, (4) Part of a corporate group, since a small company can be covered if it belongs to a larger structure that exceeds the thresholds. In addition, if a small business is a key ICT supplier to a NIS2-regulated entity, it may be vetted as part of that entity's supply chain management. Self-identification is mandatory for everyone.
Article 8 of the KSC Act requires risk-based measures in the following areas: (1) Risk management - continuous assessment and updating of risks, (2) System security - vulnerability management, patching, secure configuration, (3) Access control - multi-factor authentication (MFA), privilege management, (4) Cryptography - encryption of data at rest and in transit, key management, (5) Business continuity - Disaster Recovery plans, offline backups, restore testing, (6) Supply chain security - vetting ICT suppliers, (7) Incident handling - detection, response, and reporting procedures, (8) Monitoring - log collection, anomaly analysis, threat detection, (9) Training - regular awareness training for employees and the board. All implemented measures must be documented.
Poland has three supervisory bodies, depending on the sector: (1) CSIRT NASK (NASK - the Research and Academic Computer Network) - the main body for most civilian entities, including energy, transport, healthcare, water, ICT, and manufacturing, (2) CSIRT GOV - for public administration and government entities, (3) CSIRT MON (Ministry of National Defence) - for defense-related entities. These bodies conduct compliance inspections (ex-ante for essential entities, ex-post for important ones), review incident reports, impose administrative fines, and certify ICT products. Entities must register with the competent CSIRT after completing self-identification.
Recommended implementation plan: PHASE 1 - Assessment (2-4 weeks): Complete self-identification, identify the competent supervisory authority (NASK/GOV/MON), run a gap analysis comparing your current state with the requirements of Article 8 of the Act, and conduct a risk analysis using an established methodology (e.g., ISO 27005). PHASE 2 - Planning (1-2 months): Develop a plan for implementing security measures, define budget and resources, select technology vendors (SIEM/XDR/SOC) or an MSSP, and design incident response and reporting procedures. PHASE 3 - Implementation (3-6 months): Deploy 24/7 monitoring (an in-house SOC or outsourcing), roll out MFA, encryption, and vulnerability management, develop and test response procedures (tabletop exercises), audit ICT suppliers, and implement supply chain management. PHASE 4 - Continuous compliance: Run regular board training, keep documentation up to date, test procedures, and monitor regulatory changes.
"Gold-plating" means implementing EU regulations in a way that is stricter than the minimum required by the directive. As a frontline state that treats cybersecurity as part of national security, Poland has introduced much tougher rules: (1) Fines of up to PLN 100 million (approx. EUR 23 million) for incidents that threaten national security, whereas the EU requires a maximum of EUR 10 million, (2) Periodic penalties of PLN 100,000 for each day of delay in complying with an administrative decision, a chilling effect that forces immediate action, (3) A stricter interpretation of supply chain requirements and the High-Risk Vendor procedure. This reflects Poland's geopolitical situation and its view of cybersecurity as a matter of national security, not just consumer protection.
Read more
IAM misconfiguration is the leading cause of cloud incidents. Compare AWS, Azure and GCP: shared responsibility, Zero Trust, CMK, CSPM and NIS2.
⚠️ The NIS2 deadline passed on October 18, 2024. Non-compliant firms face fines up to EUR 10M. Learn your obligations, deadlines and implementation steps.
Poland's cyber defense has two faces: the new cyber.gov.pl portal with free tools for citizens, and openly acknowledged offensive cyberweapons.
A free consultation with one of our experts — no obligation, in full confidence.
Let's talkWe'd like to use Google Analytics cookies to see how many people visit the site and which content is useful. We'll only set them if you agree. You can change your decision at any time via the “Cookie settings” link in the footer. Cookies Policy
