PLEN
Book a consultation

Does NIS2, KSC or DORA really apply to your company?

NIS2 and the Polish KSC Act, DORA, MiCA, CRA, KRI and ISMS, plus TISAX and PCI DSS. You answer questions about your sector, organisation and security. At the end you get an assessment, obligations with deadlines and a list of risks. We will put the action plan together with you during a free call.

How it works

How the Regulatory Compass survey works

1. SectorChoose one or more of 109 sectors and organisation types, from a bank or hospital to a municipal office or food producer.
2. OrganisationEnter headcount, turnover, balance sheet total and countries of operation. Size decides whether the Act covers your company.
3. SecurityRate 24 short statements on procedures, backups, restore tests, monitoring and access control.
4. ResultYou see straight away which rules apply to you, what your obligations and deadlines are, and where the biggest risks lie.

Who is in scope

Who NIS2, the Polish KSC Act, DORA, MiCA and CRA apply to

NIS2 and the KSC Act

In Poland, NIS2 is implemented by the amended National Cybersecurity System Act (Journal of Laws 2026, item 252), in force since 3 April 2026. It covers essential and important entities in the sectors listed in the annexes to the Act, as a rule medium-sized and large organisations. See: NIS2 / KSC 2.0 audit.

DORA

Regulation (EU) 2022/2554 has applied since 17 January 2025. It covers financial entities such as banks, payment institutions, insurers and investment firms, and indirectly their ICT service providers. See: DORA audit.

MiCA

Regulation (EU) 2023/1114 covers issuers of crypto-assets and crypto-asset service providers. It has applied in full since 30 December 2024. See: MiCA audit.

CRA

The Cyber Resilience Act, Regulation (EU) 2024/2847, covers manufacturers, importers and distributors of products with digital elements. Reporting obligations apply from 11 September 2026 and the whole regulation from 11 December 2027.

KRI

The National Interoperability Framework (KRI) applies to entities performing public tasks in Poland. Among other things, it requires an annual internal information security audit. See: KRI audit.

Outside regulation

If no regulation covers you, the survey shows business, organisational, staffing, financial and technology risks, and what your customers may require. vCISO and SIEM are among the ways to address them.

Key facts

The KSC Act in numbers

3 April 2027deadline to implement the obligations for entities covered when the Act entered into force
24 h / 72 hearly warning and notification of a significant incident
€10mor 2% of revenue, maximum fine for an essential entity
€7mor 1.4% of revenue, maximum fine for an important entity

Questions and answers

NIS2, KSC and DORA scope assessment: common questions

How do I check whether NIS2 applies to my company in Poland?

In Poland, the scope of NIS2 is set by the National Cybersecurity System Act (KSC Act). Two things count: a sector listed in Annex 1 or 2 to the Act, and the size of the organisation, as a rule at least a medium-sized enterprise. Some entities, such as DNS service providers, qualified trust service providers and part of the public sector, are covered regardless of size. The survey asks these questions one by one and gives a classification with reasons.

What is the difference between an essential and an important entity?

An essential entity is, as a rule, an organisation from Annex 1 to the Act that exceeds the thresholds for a medium-sized enterprise. An important entity is a medium-sized enterprise from Annex 1, or at least a medium-sized one from Annex 2. An essential entity must have a security audit at least once every 3 years and faces higher fines: up to €10 million or 2% of revenue. For an important entity the limit is €7 million or 1.4% of revenue.

What is the deadline for implementing the KSC Act obligations?

Entities that met the criteria on the day the Act entered into force, 3 April 2026, have 12 months to implement the obligations, until 3 April 2027. Essential entities have 24 months for their first audit, until 3 April 2028.

Is the survey free?

Yes. You see the result on screen straight away, with no sign-up and no e-mail address required. You only give contact details if you want to book a free call.

How long does the survey take?

Usually a few minutes. All questions are closed, and “don't know” is a valid answer too.

What happens to my answers?

Your answers are stored only in your browser, so that you can come back to the result. We receive them, together with a summary of the result, only if you send the contact form and leave the option to attach your answers ticked.

Is the result legal advice?

No. It is a preliminary assessment based on your answers and on the legal texts as of November 2026. We confirm the final classification during a free call.

No regulation applies to my company. Is the survey still useful?

Yes. The survey rates security maturity in six areas and shows business, organisational, staffing, financial and technology risks. Requirements often come from customers before they come from the legislator. vCISO and SIEM are among the ways to address them.

Without the survey

Prefer to talk straight away?

30 minutes, no slides. We will tell you plainly which rules apply to you and where to start.

Book a consultation

Free and without obligation.

Go to contact