NIS2 for mid-sized companies: where to start

Poland’s amended Act on the National Cybersecurity System has applied since 3 April 2026. A practical plan for mid-sized companies: how to check whether you are covered and what to do in the first 90 days.

Where we are on the calendar

In Poland, the NIS2 Directive has been transposed through an amendment to the Act on the National Cybersecurity System (KSC), which has applied since 3 April 2026. For a mid-sized company, four dates matter most:

If your company is covered by the Act and did not apply by 3 October 2026 — do it now. The registration duty has not been suspended. The authority can add a company to the register on its own initiative and start an inspection, and the moratorium only covers some of the penalties.

Step 1. Check whether — and how — you are covered

Essential or important entity status arises directly from the Act. The authority does not send notices — each company must assess for itself whether it meets the criteria.

Check three things:

• Sector. The Act covers 18 sectors listed in Annexes 1 and 2 — from energy, health, transport and water, through ICT, to manufacturing, food, chemicals, waste management and postal services.
• Size. As a rule, the threshold is medium-sized enterprise status under EU criteria, including linked and partner enterprises. A small company within a larger group can therefore be covered.
• What you actually do, not just your activity code. Assess your real business activity; the registered activity code can be misleading either way.

Even if your company is not covered but supplies essential or important entities, expect security questions in contracts and supplier questionnaires. NIS2 requires them to manage supply-chain risk.

Step 2. Registration and contact persons

Applications are submitted at wykaz-ksc.gov.pl (part of the S46 system). Registration gives access to the S46 Cyber Hub, through which a company meets its statutory obligations — including incident reporting.

Appoint at least two contact persons for KSC matters and make sure they have system access. It sounds minor, but during your first incident it decides whether you report on time.

Step 3. Management takes responsibility — literally

This is the biggest shift in mindset that NIS2 brings. Cybersecurity is the responsibility of the head of the entity, not the IT department:

• outsourcing or appointing an internal specialist does not transfer responsibility,
• if the board does not appoint a person responsible for cybersecurity, all board members are liable,
• management must complete documented cybersecurity training every year,
• once the moratorium ends, the rules provide for penalties on individual managers (up to 300% of their pay), and D&O policies usually do not cover administrative fines.

In practice it means one thing: NIS2 is not an IT project. It is a management project in which IT is the delivery team.

Step 4. Inventory and risk assessment

You cannot protect what you do not know. Before buying any tool, prepare:

1. A list of business-critical services — what must keep running for the company to earn money.
2. A map of the systems and data those services depend on: ERP, email, production, cloud, network.
3. A list of suppliers with access to your systems or data.
4. A risk assessment: what can go wrong, how much it would hurt, and what already limits it today.

This is the foundation of the whole ISMS. A good risk assessment tells you what to spend the budget on first — and lets you defend that decision to the board and the auditor.

Step 5. Incident reporting procedure — right away

Incident obligations apply once you are in the register, so do not leave them until 2027. Reports are submitted through the S46 system to the competent CSIRT:

• early warning — within 24 hours of detecting a significant incident at the latest,
• incident notification — no later than 72 hours after detection,
• final report — within one month of the notification at the latest.

Write a simple one-page procedure: who detects, who decides whether an incident is significant, who reports, and who keeps the board informed. Run one tabletop exercise — 24 hours pass faster than you think.

Step 6. ISMS implementation plan by 3 April 2027

A few months remain to implement the requirements. Do not build the system from scratch — ISO/IEC 27001 is a good framework, and NIS2 requirements overlap with it to a large extent.

Start with the measures that give the most protection at a reasonable cost:

• multi-factor authentication (MFA) for email, VPN and administrative access,
• ransomware-resilient backups with regularly tested restores,
• patching and vulnerability management,
• least-privilege access and account reviews,
• log collection and review,
• a business continuity plan for critical services.

Most common mistakes

• Treating NIS2 as a job for the IT department. Without board decisions and budget, the project stalls.
• Buying a tool before the risk assessment. A tool does not replace knowing what you protect and why.
• Policies copied from the internet. Documents nobody follows will not pass an audit or help during an incident.
• Ignoring suppliers. Many incidents start on their side.

The first 90 days — checklist

• [ ] Assess whether the company is covered (sector, size including the group)
• [ ] Apply for registration (if not done yet)
• [ ] Board resolution: responsible person, budget, timeline
• [ ] Board training
• [ ] Inventory of services, systems and suppliers
• [ ] Risk assessment and list of priorities
• [ ] Incident reporting procedure and two S46 contact persons
• [ ] ISMS implementation plan by 3 April 2027

Sources

• Amendment to the KSC Act — self-registration in the register of essential and important entities (gov.pl, in Polish)
• The amended KSC Act takes effect — NIS2 implementation timeline (ITwiz, in Polish)
• Registration in the KSC register by 3 October (Infor.pl, in Polish)
• Handling and reporting incidents under NIS2 (Lege Artis, in Polish)

This article is for information only and is not legal advice. Before making decisions, check the current text of the KSC Act and announcements in the S46 system.