A KRI audit for schools is a legal duty of the head teacher as head of the unit: every Polish public school and kindergarten must carry out an internal information security audit at least once a year. This article explains which school systems the audit covers, how it runs step by step and what the audit report should contain.
This guide is written for IT providers, software vendors and education organisations that work with Polish public schools, and for anyone who has been asked to deliver or support a KRI audit in one. KRI (Krajowe Ramy Interoperacyjności, the National Interoperability Framework) is the regulation that sets minimum security requirements for Polish public bodies. Schools rarely have their own IT department, and part of their services often comes from the municipality or a shared services centre, which shapes how the audit is done. The general rules are explained in KRI audit: what it is and who must comply, and our service is described on the KRI audit page. Legal position as of November 2026. This article is for information only and is not legal advice.
Why schools and kindergartens fall under KRI
Public schools and kindergartens run by a gmina (municipality) or powiat (county) are usually budgetary units, i.e. part of the public finance sector. Under Article 2(1) of the Act on the computerisation of entities performing public tasks, they are therefore public entities and must apply the KRI regulation of 21 May 2024 (Journal of Laws 2024, item 773).
Section 19 of that regulation requires an SZBI (system zarządzania bezpieczeństwem informacji, an information security management system or ISMS), and § 19(2) point 14 requires management to ensure a periodic internal information security audit at least once a year. Non-public schools perform public tasks under education law and may be subject to selected provisions of the act (Article 2(1a)); their exact obligations need individual analysis.
Inspections in organisational units of local government are carried out by the voivode (wojewoda, the central government’s regional representative) under Article 25 of the act. KRI sets no fines, but a missing audit becomes an inspection finding and a point against the school after any personal data breach.
The head teacher’s duties: an ISMS in a school
The head teacher (dyrektor) is responsible as head of the unit for an ISMS that exists and works. They do not configure servers themselves, but they must provide the conditions: appoint people, approve documents, commission the audit and accept its results. In practice this means:
- An information security policy approved by the head teacher’s order: objectives, roles (who administers systems, who grants access, who reports incidents), rules for devices, e-mail and cloud services, teachers’ remote work, handling of storage media.
- A risk analysis for school systems, reviewed periodically and after major changes such as a new electronic register or a move to cloud e-mail.
- An inventory of hardware, software and online services used by the school.
- Access management: granting, changing and revoking access when staff change, including substitute teachers and trainees.
- Documented security training for staff.
- An annual audit and follow-up of the previous audit’s recommendations.
A school ISMS is not the same as GDPR documentation, although they overlap. A Polish public school must appoint a data protection officer (Article 37 GDPR), and Article 32 GDPR requires appropriate security measures and regular testing of their effectiveness. It makes sense to keep one consistent set of documents and involve the DPO in the audit rather than maintain two separate sets of procedures.
Which systems a KRI audit for schools covers
| System | What the auditor looks at |
|---|---|
| Electronic class register (dziennik elektroniczny, usually a cloud service) | supplier contract and data processing agreement, accounts and roles, accounts of former pupils and teachers, authentication, data export and availability |
| School office: PCs, pupil records, correspondence, reporting systems (e.g. SIO, the national education information system) | OS updates, antivirus, laptop disk encryption, backups, access to records and shared folders |
| Accounting and HR (often in a CUW) | split of responsibilities in the agreement with the CUW, school staff access to CUW systems, how documents are exchanged |
| School website and BIP (public information bulletin) | CMS and plugin updates, admin accounts, hosting and backups, who publishes content |
| Network and Wi-Fi | separation of the administrative network from pupil and guest Wi-Fi, network passwords, router credentials and firmware |
| Teachers’ laptops and tablets, computer labs | asset register, local accounts, use outside school, USB media, decommissioning and disposal |
| Cloud e-mail and storage for staff and pupils | multi-factor authentication for staff accounts, external file sharing, backups, pupil accounts after leaving |
Schools served by a shared services centre
Many schools receive accounting, HR and sometimes IT support from the municipality’s CUW (centrum usług wspólnych, shared services centre). The head teacher still owns the school’s ISMS, but the audit cannot ignore shared systems. The scope has to be agreed: either the school’s audit covers selected CUW systems under the agreement between the units, or the CUW provides the results of its own audit for the part relevant to the school. The agreement should state clearly who is responsible for backups, access rights and incident reporting.
Common findings in school audits
We do not publish statistics, but the same issues recur in education units often enough to be worth checking before the audit. Many concern documentation copied from a template and never updated, including policies that still cite the 2012 regulation. Another group concerns access: accounts of teachers who have left, shared logins in the school office, a single register administrator who is the only person who knows the passwords.
There is often no inventory of cloud services even though the school uses several. Backups may be written to a disk permanently attached to the same PC, and nobody has tested whether data can actually be restored. Pupil Wi-Fi shares a network with the school office. Training happened once, at roll-out, and left no record. Recommendations from the previous audit remain open because no owner or deadline was assigned.
How the audit runs, step by step
- Commission and scope. The head teacher appoints the auditor (a staff member or an external firm) and sets the scope: buildings, systems, CUW involvement, report deadline.
- Document review. Security policy, procedures, risk analysis, inventory, supplier contracts, training register, previous report.
- Interviews. Head teacher, school office, the person administering IT, the register administrator, the DPO, a few teachers.
- Technical verification. Accounts and permissions, patching, antivirus, backups with a test restore, network and Wi-Fi configuration, e-mail and cloud settings, logs. This may include vulnerability scanning of the website and internet-facing services.
- Findings and assessment. Each finding mapped to a requirement and rated for severity.
- Report and debrief. Report delivered to the head teacher, results discussed, recommendations accepted.
- Action plan and follow-up. Owners and deadlines; the next audit checks progress.
Detailed auditor questions for each area of § 19 and § 20 are in our KRI audit checklist.
The KRI audit report for a school: what it should contain
We do not provide a downloadable template, because the report must reflect the school’s actual situation. The table lists elements whose absence usually indicates a superficial audit.
| Report section | What it should contain |
|---|---|
| General information | name of the school or kindergarten, period covered, dates of fieldwork, auditor and their independence |
| Scope | locations, systems, involvement of the CUW or municipality, what was excluded |
| Criteria | § 19 and § 20 of KRI 2024, the school’s internal documents, optionally PN-ISO/IEC 27001 and 27002 |
| Methods | document review, interviews, technical tests, samples (e.g. which accounts were checked) |
| Findings | actual state, requirement, evidence, severity (e.g. critical, major, minor) |
| Status of previous recommendations | implemented, in progress, not implemented |
| Recommendations | specific actions, owner, deadline |
| Summary and approval | overall assessment of the ISMS, auditor’s signature, head teacher’s acknowledgement |
KSC and the changes from 23 February 2027
The amended Polish act on the national cybersecurity system (KSC, which transposes NIS2; Journal of Laws 2026, item 252) has applied since 3 April 2026 and covers some public bodies as key or important entities. That does not mean every school is in scope: it depends on how the specific unit is classified under the act’s annexes. It is worth checking, because important entities that are public bodies must implement an ISMS meeting annex 4 of the act and review it at least once a year. We help with that assessment as part of our NIS2 audit.
The current KRI regulation applies until 22 February 2027. According to its justification, the draft new regulation of 29 July 2026 no longer contains ISMS requirements, but it is still a draft. The 2026 audit must be carried out under the current rules. What comes next is covered in new KRI from 2027 and KSC.
FAQ: frequently asked questions
Is a KRI audit mandatory for Polish public schools?
Yes. As budgetary units they are public entities and must carry out an internal information security audit at least once a year (§ 19(2) point 14 of KRI 2024).
Is a KRI audit in a kindergarten different from one in a school?
The requirements are the same. The scope is usually smaller: fewer systems and users, often no computer lab. The same areas are checked, including children’s and parents’ data in the register or parent communication app.
Who is responsible for the school’s KRI audit: the head teacher or the municipality?
The head teacher, as head of the unit. The municipality or CUW is responsible for the systems it provides and should cooperate in the audit as set out in the agreement.
Can the school’s IT teacher perform the KRI audit?
Yes, if they have the competence. They should not, however, assess systems they configure and maintain themselves, as the audit would then lack independence.
What should a school’s KRI audit report include?
Scope, criteria, methods, findings rated by severity, status of the previous audit’s recommendations, new recommendations with deadlines, the auditor’s signature and the head teacher’s acknowledgement.
Need a KRI audit for a school or kindergarten before the end of the year, or support for a Polish education client? See our KRI audit service and contact us. We prepare a custom quote based on the number of buildings and systems and the role of the CUW.