NIS2 / KSC 2.0 audit and compliance

It applies mainly to medium and large organizations (50 or more employees, or annual turnover and balance sheet above EUR 10 million) operating in one of the 18 sectors listed in the directive — for example energy, transport, banking, healthcare, digital infrastructure, ICT service management, manufacturing or food. Some entities, such as DNS and trust service providers, are covered regardless of size. We start every engagement by checking your classification.

Both must meet the same risk management and reporting obligations. The difference is in supervision and penalties: essential entities are supervised proactively and face fines of up to EUR 10 million or 2% of global turnover, while important entities are supervised after the fact, with fines of up to EUR 7 million or 1.4% of turnover.

For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification with an initial assessment within 72 hours, and a final report within one month. Meeting these deadlines requires monitoring and a rehearsed procedure — which is why many clients combine NIS2 with our 24/7 SOC.

Yes. Under NIS2, management bodies approve the cybersecurity risk management measures, oversee their implementation and can be held liable for failures. Board members are also required to take part in cybersecurity training.

KSC 2.0 is the amendment to the Polish National Cybersecurity System Act that transposes NIS2 into Polish law. It defines which entities are covered, their registration, obligations and the penalties enforced by Polish authorities.

Not as such. In the digital area NIS2 covers online marketplaces, search engines and social networking platforms, as well as cloud, data center and managed IT service providers. A regular online shop is usually covered only if it falls into another sector, such as food distribution or manufacturing, and meets the size threshold.

A classification of your organization, a maturity assessment against the 10 measures of Art. 21, a gap report with priorities and an implementation plan — typically for the next 90 days — plus, if you continue with us, the documentation and evidence for the supervisory authority.

Financial entities covered by DORA follow DORA as the more specific law for ICT risk. ISO 27001 is not required by NIS2, but an existing ISMS covers a large part of its measures and makes compliance much easier — we take it into account in the gap analysis.

Yes. We implement the missing measures, run penetration tests and vulnerability scanning, provide a vCISO to lead security on an ongoing basis and repeat audits periodically.