02 · Audit
KRI audit — information security audits for Polish public entities
We carry out the annual internal information security audit required by § 19 of Poland's 2024 KRI regulation (National Interoperability Framework) — for public offices, local government units, schools and other public bodies. You get a report for the head of the entity, a remediation plan and a roadmap for 2027, when ISMS requirements move to the Polish Cybersecurity Act (KSC).
Service details
What is KRI and a KRI audit?
KRI (Krajowe Ramy Interoperacyjności — the National Interoperability Framework) is a Polish Council of Ministers regulation that sets minimum requirements for IT systems, public registers and electronic information exchange in the public sector. The current version is the regulation of 21 May 2024 (Journal of Laws 2024, item 773), which replaced the 2012 regulation.
Paragraph 19 of KRI requires every entity performing public tasks to run an information security management system (SZBI, i.e. an ISMS), and requires management, among other things, to ensure a periodic internal information security audit at least once a year. A KRI audit checks whether the ISMS works in practice — from the security policy and risk analysis, through access rights, training and backups, to logs and incident reporting.
- Audit against § 19 and § 20 KRI
- Report for the head of the entity and remediation plan
- 2027 roadmap: KRI → KSC
Our services
How we help you meet KRI requirements
Annual KRI audit
Documentation review, staff interviews and technical checks. A report with findings by severity and recommendations that the head of the entity can present during an inspection.
Risk analysis
Assessment of risks to the confidentiality, availability and integrity of information in line with PN-ISO/IEC 27005, with a risk treatment plan.
ISMS documentation
Information security policy, procedures, registers and statements tailored to how your entity actually works — not copied from another office.
Technical testing
Vulnerability scanning, configuration, access-rights and patch review, backup restore testing — and penetration testing on request.
Training
Information security and cyber-hygiene training for staff, plus a short briefing for management on obligations under KRI and the KSC act.
Preparing for KSC and the new KRI
We check whether the entity is an essential or important entity under the KSC act and map the current ISMS to the requirements of annex 4 to the act.
Who it applies to
KRI applies to entities performing public tasks
Local government
Municipalities (gminy), districts (powiaty) and regions (województwa), their offices and organisational units — social welfare centres, shared services centres, budgetary establishments.
Schools and kindergartens
Public schools and education units are budgetary units. The head teacher is responsible for the ISMS and the annual audit — including systems run by a shared services centre (CUW).
Government administration and other public bodies
Government offices, state organisational units, public funds, research institutes and other entities listed in art. 2 of the Computerisation Act.
Entities performing public tasks
Also non-public organisations that perform public tasks under the law or on behalf of a public entity — to the extent set out in art. 2(1a) of the act.
Obligations
What management must ensure (§ 19(2) KRI)
- Up-to-date internal regulations and an inventory of hardware and software
- Periodic risk analysis
- Access-rights management and staff training
- Protection of information against theft, unauthorised access and disruption
- Secure mobile and remote work
- Security clauses in contracts with third parties
- Secure disposal of media and vulnerability handling
- Event logging (§ 20) and compliance checks of IT systems
- Prompt incident reporting in a predefined way
- An internal information security audit at least once a year
Changes from 2027
KRI, KSC and GDPR — what applies and when
| Period | Legal basis | What it means for the entity |
|---|---|---|
| Until 22 February 2027 | KRI 2024 (Journal of Laws 2024, item 773), § 19 and § 20 | An ISMS compliant with KRI and an internal information security audit at least once a year. |
| Since 3 April 2026 | Amended KSC act (Journal of Laws 2026, item 252) | Public entities may be essential entities (ISMS under art. 8, audit at least every 3 years) or important entities (ISMS under annex 4, review at least once a year). |
| From 23 February 2027 (draft) | New KRI regulation — draft of 29 July 2026 | According to the draft's justification, ISMS requirements are removed from KRI because the KSC act now regulates them. The draft may still change. |
| Always | GDPR, art. 32 | Appropriate technical and organisational measures for the personal data of residents, pupils and staff. |
Legal status as of November 2026. Whether a specific entity is an essential or important entity under the KSC act needs to be verified individually — we do this as part of the audit.
How we work
A KRI audit in four steps
Questions and answers
KRI audit — FAQ
Is a KRI audit mandatory?
Yes. § 19(2)(14) of the 2024 KRI regulation requires a periodic internal information security audit at least once a year. The obligation applies to entities performing public tasks, including public offices, local government units and schools.
Who can carry out a KRI audit?
The regulation speaks of an internal audit, but it does not require the entity's own staff to perform it. Many entities commission an external auditor, which also helps independence. Competence matters — in practice often evidenced by ISO/IEC 27001 auditor qualifications.
Does the KRI audit apply to schools and kindergartens?
Yes. Public schools and kindergartens are budgetary units and therefore public entities under the Computerisation Act. The head teacher is responsible for the ISMS and the annual audit. More in KRI audit for schools and kindergartens.
How much does a KRI audit cost?
It depends on the number of sites, users and systems, the state of the documentation, and whether technical tests and help with implementing recommendations are included. We prepare a custom quote. See KRI audit cost and how to write a request for proposal.
Who checks compliance with KRI?
Under art. 25 of the Computerisation Act, IT systems in local government units and their organisational units are inspected by the voivode (the government's regional representative), and entities supervised by government administration by their supervising authority. The audit report is one of the first documents an inspection asks for.
What changes in 2027?
The amendment to the Computerisation Act (Journal of Laws 2025, item 1158) provides the basis for a new KRI regulation from 23 February 2027. According to the draft of 29 July 2026, ISMS requirements will be removed from KRI because the KSC act regulates them. For many entities the annual KRI audit will turn into an annual ISMS review under the KSC act. Details in The new KRI from 2027 and the KSC act.
Do we need ISO 27001 certification?
No. KRI does not require certification, but it deems the requirements met if the ISMS is based on PN-ISO/IEC 27001 and safeguards and risk management follow PN-ISO/IEC 27002 and 27005. We use these standards as the reference point in the audit.
How does a KRI audit relate to KSC and NIS2?
The amended KSC act (implementing NIS2) also covers public entities. If an entity is an essential or important entity, it must meet KSC requirements regardless of KRI. In a KRI audit we flag gaps against KSC straight away; the full scope is covered by our NIS2 / KSC 2.0 audit.
Can you help after the audit?
Yes. We update documentation, run training, implement backups with restore testing, vulnerability scanning and monitoring, and as a vCISO we run the ISMS on an ongoing basis.
Related services
Often combined with this service
First step
Let's talk about your KRI audit.
30 minutes, no slide decks. We'll tell you straight what audit scope makes sense for your entity, what it means for 2027 and what it costs.
A proposal with scope and pricing within 48 hours of our call.
Go to contact