There is no standard KRI audit cost: the price depends mainly on the number of locations, users and systems, on the state of the existing documentation and on how much technical testing is in scope. Instead of a price list, this article explains what really drives a quote, how to spot an offer that is too cheap to be a real audit, and how to write a request for proposal that produces comparable bids.
KRI (Krajowe Ramy Interoperacyjności — the National Interoperability Framework) is a Polish regulation for public bodies. The current version of 21 May 2024 (Dz.U. 2024 item 773) requires management, in § 19(2)(14), to ensure a periodic internal information security audit at least once a year. Municipal offices, public schools, kindergartens and social-welfare centres often commission this audit from an external auditor, which raises the questions of cost and procurement route. This guide is for Polish public bodies and for the foreign IT providers and international organisations that work with them. If you first need to establish whether the obligation applies, start with KRI audit: what it is and who must comply. The legal position is described as of November 2026; this article is for information only and is not legal advice.
KRI audit cost: what actually drives the price
We do not publish a price list for our KRI audit service, because two bodies with the same label, say “primary school”, can need very different amounts of work. Auditor time grows with the number of sites to visit, people to interview and systems to review. The same logic applies to any information security audit: the price follows the scope of work, not the name of the service.
| Cost driver | Why it affects the price | What to state in your request |
|---|---|---|
| Number of locations | Each building has its own server room or network cabinet, different physical security and often travel time. | Number and addresses of sites; whether an on-site visit is required at each. |
| Users and workstations | Determines the size of the review of accounts, permissions, endpoints and mobile devices. | Staff with system access, desktops, laptops, mailboxes. |
| Number and type of systems | Each system (EZD document management, domain-specific registers, finance and accounting, electronic school register, e-mail, cloud services) has its own permissions, backups and logs. | A system list showing who operates each one (the body, a vendor, a cloud provider). |
| IT operating model | An in-house IT person, a CUW (centrum usług wspólnych — a municipal shared services centre that handles administration, accounting and sometimes IT for schools) or an outsourced provider: this changes the number of interviews and evidence sources. | Who is responsible for IT; whether one CUW serves several units. |
| State of documentation | An up-to-date information security policy, risk analysis and asset inventory shorten the audit. Missing documents mean more work, or a separate drafting service. | Document list with last revision dates; the previous audit report. |
| Scope of technical checks | Reviewing configuration, patching, backups with a restore test and logs is hands-on work on systems. A vulnerability scan or penetration test is a further level. | Which checks are mandatory and which optional; whether remote work by the auditor is acceptable. |
| Additional deliverables | Remediation plan, documentation updates, staff training, a follow-up audit after recommendations are implemented. | A clear split between the base scope and options. |
| Deadline | A short report deadline requires a larger team. | Dates for the visit, the draft report and the final report. |
Schools usually have fewer workstations and systems than a municipal office, so the scope is smaller, but the structure of the audit is the same. Where a municipality or CUW runs many schools on shared procedures and the same systems, one combined procurement for several units can be simpler than separate requests from each head teacher. The report still has to address each unit separately. School-specific issues are covered in KRI audit in schools and kindergartens.
What a reasonable KRI audit scope includes
Whatever the size of the body, an information security audit under § 19 of KRI 2024 should combine three sources of evidence: documents, people and systems. A reasonable scope covers:
- Document review: information security policy and procedures, risk analysis, hardware and software inventory, register of authorisations, training records, and IT supplier contracts checked for security clauses.
- Interviews: with the head of the body, the person responsible for IT (or the provider), the data protection officer and selected staff. Conversations quickly show whether procedures work in practice.
- Technical checks: accounts and permissions (including dormant ones), patch levels, endpoint and network configuration, backups with a test restore, accountability in system logs (§ 20 of KRI 2024) and, where justified, vulnerability scanning.
- Report: findings backed by evidence, a risk rating for each non-conformity, prioritised recommendations and a summary for the head of the body, who is responsible for implementing them.
A detailed list of areas to check and what the report must contain is in our KRI audit checklist. KRI does not require penetration testing, but for bodies with internet-facing services it is worth listing penetration testing as an option in the request.
Red flags in cheap offers
A low price is not a problem in itself: a small body with orderly documentation simply needs less work. The problem is an offer from which key audit elements have quietly disappeared. Be careful when:
- There are no technical checks. A questionnaire filled in by the body plus a document review is a paper exercise, not an audit. Nobody verifies that backups can be restored or that leavers’ accounts are disabled.
- There are no interviews. Without talking to people, the auditor cannot judge whether procedures are known and followed.
- The report looks copy-pasted. Generic statements that fit any organisation, no evidence or dates, sometimes another institution’s name left in the text. Ask for an anonymised extract of a sample report.
- The offer cites only the 2012 regulation. KRI 2024 has applied since 23 May 2024. An outdated legal basis suggests an outdated method.
- The auditor checks what it operates. If the company that administers your systems also audits them, ask how roles and teams are separated. The internal audit can be outsourced, but independence and competence matter.
- A “document pack” comes bundled with the audit. Template policies that are not adapted to the body describe an organisation that does not exist and will not survive an inspection.
- Confidentiality is not addressed. The auditor sees configurations, permissions and sometimes personal data. No confidentiality undertaking, or no data processing agreement where one is needed, is a warning sign.
How to write a KRI audit request for proposal
In Polish practice the request is usually called a zapytanie ofertowe (request for quotation). A well-written one is the easiest way to receive comparable offers: if you describe the body and the expected deliverables, bidders price the same work rather than their own assumptions. The checklist below works for offices and schools alike.
| Element | What to include |
|---|---|
| Subject and legal basis | Internal information security audit under § 19(2)(14) of KRI 2024, the period covered, optionally a reference to PN-ISO/IEC 27001 (§ 19(3)). |
| Entity profile | Number of users and workstations, number of locations, on-premises servers or cloud, list of systems, who runs IT (in-house, CUW, outsourced provider). |
| Existing documentation | List of SZBI (information security management system, ISMS) documents with revision dates; information on the previous audit and the status of its recommendations. |
| Scope of work | Document review, interviews, technical checks (named individually), vulnerability scan yes or no, penetration test as an option. |
| Deliverables | Report with findings and recommendations, management summary, action plan, presentation of results, optional follow-up audit. |
| Deadline | Dates for the visit, draft report and final report; time allowed for the client’s comments. |
| Auditor qualifications | For example ISO/IEC 27001 Lead Auditor, experience auditing public-sector bodies, how this is evidenced (certificate, list of services), a declaration of no conflict of interest. |
| Confidentiality and access | Confidentiality undertaking, a data processing agreement if the auditor will access personal data, rules for system access and deletion of materials after the audit. |
| Acceptance | Draft report, comment period, final report, signed acceptance protocol as a condition of payment. |
| Selection criteria | Price plus, for example, experience or depth of technical checks; the required price breakdown (base scope and options priced separately). |
Requests for quotation and the Public Procurement Law
Contracts below the threshold of the Polish Public Procurement Law (PZP) are commonly awarded through a request for quotation under the body’s internal procurement rules. Above the threshold, PZP procedures apply. For a multi-year contract the estimated value of the whole contract is what counts, which may change the procurement route, so check with the person responsible for procurement in the body.
Multi-year contracts: the 2026 audit and the move to KSC requirements
The KRI audit is an annual obligation, so some bodies sign contracts covering several years. For 2026–2027 the change in the law has to be built in. KRI 2024 remains in force until 22 February 2027. The draft new KRI regulation of 29 July 2026, planned for 23 February 2027, removes the SZBI requirements because they are now regulated by the amended Act on the National Cybersecurity System (KSC, Poland’s NIS2 implementation). Public bodies classified as important entities under the KSC must review an SZBI meeting annex 4 at least once a year, while key entities must undergo a security audit at least every three years.
In practice a multi-year contract can be structured like this:
- 2026: KRI audit under § 19 of KRI 2024, including a gap analysis against the KSC requirements that match the body’s status.
- From 2027: an annual SZBI review under KSC annex 4 (important entity) or preparation for the audit under art. 15 of the KSC (key entity).
- A scope-change mechanism: the draft regulation may still change and each body’s KSC status has to be determined individually, so the contract should allow the scope to be adjusted.
The details of the transition are covered in the new KRI regulation 2027 and the KSC. If the body needs ongoing support between audits, a vCISO arrangement works well.
How to prepare so the audit takes less time
Part of the cost is time the auditor spends looking for information. You can reduce it by preparing, before work starts:
- a current list of systems, servers and workstations showing who maintains each,
- the full set of SZBI documents and the previous audit report with the status of recommendations,
- contact details for the IT person or provider and their agreement to take part in interviews,
- a schedule of availability for the head of the body and staff,
- a secure way to give the auditor read access to configurations and logs.
FAQ: frequently asked questions
How much does a KRI audit cost for a school?
It depends on the number of workstations, systems and sites, the state of documentation and the depth of technical checks. A school usually needs a smaller scope than a municipal office. Describing the school’s profile in the request gets you the most accurate quote.
Can a KRI audit be outsourced to an external company?
Yes. KRI requires an internal audit, but it can be carried out by an employee or by an external auditor engaged by the body. What matters is competence and independence from the areas being audited.
Does a KRI audit require a public tender?
That depends on the estimated contract value. Below the PZP threshold, bodies usually use a request for quotation under internal rules. For multi-year contracts the value of the whole contract counts.
What should a KRI audit RFP include?
Subject and legal basis, entity profile, existing documentation, scope including technical checks, deliverables, deadlines, auditor qualifications, confidentiality rules and acceptance terms.
Is a KRI audit still required in 2027?
KRI 2024, with its annual audit obligation, applies until 22 February 2027. Under the draft new KRI, SZBI requirements move to the KSC, where obligations depend on the body’s status. The draft may still change.
Need a quote for an office, a school or several units served by one CUW? See our KRI audit service and send us your entity profile or request for quotation. We will prepare a quote that separates the base scope from optional work.