This KRI audit checklist sets out what an auditor will ask for in each area of § 19(2) and § 20 of the Polish KRI 2024 regulation, which evidence they expect and where gaps usually appear. It ends with the structure of a KRI audit report, which is what most requests for a “template” are really about.
The checklist is meant for people who carry out, support or prepare for an internal information security audit in a Polish public body: municipal offices, schools, social welfare centres and the IT suppliers that serve them. KRI (Krajowe Ramy Interoperacyjności, the National Interoperability Framework) is the Council of Ministers regulation of 21 May 2024 (Journal of Laws 2024, item 773); the legal position described is as of November 2026. For the basics, start with KRI audit: what it is and who must comply. If you would rather outsource the work, our KRI audit page describes the service. This article is for information only and is not legal advice.
How to use this KRI audit checklist
Section 19(2) lists 14 activities that the entity’s management must ensure as part of its SZBI (system zarządzania bezpieczeństwem informacji, information security management system, ISMS). Below we group them by topic and paraphrase them. The grouping into tables is ours; check the exact wording in the regulation on isap.sejm.gov.pl. The one point we quote is point 14, the basis of the audit itself, which requires the entity to ensure a periodic internal information security audit “not less than once a year”.
Two working rules:
- Evidence, not statements. “Yes, we do backups” is not a finding. The report from the last restore test, or its absence, is.
- Standards as the benchmark. Under § 19(3), requirements are deemed met if the ISMS is based on PN-ISO/IEC 27001, safeguards on PN-ISO/IEC 27002 and risk management on PN-ISO/IEC 27005. Auditors can therefore use the controls in those standards to judge whether a measure is adequate.
Checklist: documentation, inventory and risk
| Area | What the auditor asks for (evidence) | Typical gaps |
|---|---|---|
| Keeping internal rules up to date | information security policy and procedures with approval date and change history; the head of the entity’s order adopting them; evidence of review after legal or organisational changes | documents cite the 2012 regulation; no review for years; procedures describe systems that no longer exist |
| Hardware and software inventory | current list of hardware and software with type and configuration; list of cloud services; how the list is maintained | fixed-asset register used instead of an IT inventory; cloud and SaaS services missing; no software versions |
| Periodic risk analysis | methodology, latest analysis, risk treatment plan, management’s acceptance of residual risk | analysis done once when the ISMS was introduced; generic risks not linked to actual systems; no actions resulting from the analysis |
Checklist: people, access rights and suppliers
| Area | What the auditor asks for (evidence) | Typical gaps |
|---|---|---|
| Access rights management | procedure for granting and revoking access; access register; sample of requests; system account lists compared with the staff list | active accounts of leavers; shared accounts; everyday use of admin rights; access not changed promptly when roles change |
| Training | training plan and content; attendance lists or platform reports; onboarding training; participation of management | one session at roll-out; no records; generic content that ignores threats typical for the unit, such as phishing |
| Contracts with third parties | IT service and maintenance contracts; security clauses; data processing agreements; agreements with the municipality or shared services centre | no security or incident clauses; uncontrolled remote access by the service provider; nobody knows who holds admin passwords |
Checklist: protecting information and systems
| Area | What the auditor asks for (evidence) | Typical gaps |
|---|---|---|
| Protection against theft, unauthorised access and damage | physical access control for the server room and archive; password and authentication rules; firewall and network segmentation; access monitoring | server in a publicly accessible room; no multi-factor authentication for e-mail and remote access; guest network connected to the office network |
| Mobile and remote work | remote work rules; laptop disk encryption; how users connect to systems (VPN); policy on private devices | unencrypted laptops; access from private computers without rules; remote desktop exposed to the internet |
| Handling information and media | rules for storing and transferring information; procedure for decommissioning, wiping or destroying media and equipment; destruction records | equipment handed over or sold without secure data erasure; no records; uncontrolled USB media |
| System security: patching and vulnerabilities | patching process for systems and applications; vulnerability scan report; response to published vulnerabilities; list of systems out of vendor support | unsupported systems; no scanning; updates “when someone has time”; outdated website and BIP (public information bulletin) CMS |
| System security: failures, backups, cryptography, compliance | backup policy; restore test records; cryptographic mechanisms in use; checks of configuration against policy and standards | backups on a disk permanently attached to the server; no separated copy; no restore tests; no compliance reviews |
Some technical evidence is easiest to collect with tools. Vulnerability scanning gives an objective picture of patch levels, and backups separated from the production network and restore-tested regularly close one of the most common gaps.
Incidents and § 20: system logs
| Area | What the auditor asks for (evidence) | Typical gaps |
|---|---|---|
| Incident reporting | procedure for reporting incidents in a predefined way; incident register; examples of handled events and corrective actions; reporting contacts | procedure exists but staff do not know it; empty register despite known events; no link to the personal data breach procedure |
| Accountability in system logs (§ 20) | which events are logged (logins, permission changes, data operations); retention period; protection of logs against modification; who reviews them and how | logs kept only locally and overwritten after a few days; no logs from cloud services; nobody reviews them; no time synchronisation |
| Internal audit (§ 19(2) point 14) | audit reports from recent years; audit plan; status of recommendations | gap longer than a year; auditor not independent; recommendations without owner or deadline |
What a KRI audit report should look like
Searches for a “KRI audit template” are usually about the report. We do not publish a downloadable template, because the report must describe a specific entity, but its structure should be consistent. The table shows the elements that let the head of the entity make decisions and let an inspector judge whether the audit was sound.
| Report section | Content |
|---|---|
| Scope | entity, locations, systems, period covered, exclusions with reasons |
| Criteria | § 19 and § 20 of KRI 2024, internal documents, PN-ISO/IEC 27001, 27002, 27005 |
| Methods | document review, interviews (roles of interviewees), technical tests, sampling |
| Findings by severity | for each: actual state, requirement, evidence, severity (e.g. critical, high, medium, low), impact on confidentiality, integrity or availability |
| Status of previous recommendations | implemented, partly implemented, not implemented, with comments |
| Recommendations | specific actions linked to findings, proposed owner |
| Deadlines | due date for each recommendation, depending on severity |
| Signatures and approval | auditor’s signature, statement of independence, acceptance by the head of the entity and decision on the action plan |
A good report ends with a one-page management summary: overall assessment of the ISMS, the three to five most important risks and what to do first. If nobody in the organisation will track recommendations between audits, a vCISO can take that role. For an example of applying the checklist in education, see KRI audits for schools and kindergartens.
From 2027: the checklist moves towards KSC
The current KRI regulation applies until 22 February 2027. According to its justification, the draft new regulation of 29 July 2026 no longer contains ISMS requirements, because the amended Polish act on the national cybersecurity system (KSC, which transposes NIS2; Journal of Laws 2026, item 252) now regulates them. The draft may still change. For public bodies classified as important entities, the reference point becomes annex 4 to the KSC act: ICT inventory, access control and least privilege, secure remote work, separated backups with restore testing, incident procedures, cyber-hygiene training (including for the head of the entity) and patching, with an ISMS review at least once a year. Most items on this checklist will carry over into the new structure. Details are in new KRI from 2027 and KSC.
FAQ: frequently asked questions
Is there an official KRI audit checklist template?
No. The regulation contains no template for a checklist or report. The checklist should follow § 19(2), § 20 and the entity’s internal documents, with PN-ISO/IEC 27001 and 27002 as a benchmark.
What is an internal information security audit under KRI?
A periodic, independent assessment of whether the entity’s ISMS works in line with the requirements and its own documentation. Section 19(2) point 14 of KRI 2024 requires one at least once a year. It can be done by an employee or an external auditor.
How many points does § 19(2) of the KRI regulation have?
Fourteen. They cover, among others, updating internal rules, inventory, risk analysis, access rights, training, protection of information, mobile work, supplier contracts, system security, incidents and the annual audit.
Is a vulnerability scan a mandatory part of a KRI audit?
The regulation does not prescribe a specific tool, but its system security requirements include handling technical vulnerabilities. A vulnerability scan is the simplest way to produce evidence for that.
Who approves the KRI audit report?
The auditor signs it and the head of the entity accepts it, decides on the action plan and is responsible for implementing the recommendations.
Want an independent auditor to work through this checklist with you, or a document check before an inspection? See our KRI audit service and contact us. We prepare a custom quote.