DualStack — Offense + Defense

The NIS2 directive has been transposed into Polish law as the Act on the National Cybersecurity System (KSC). If your organization operates in a critical or important sector, you are now legally required to implement specific cybersecurity measures.

This guide covers everything you need to know.

Who is affected?

NIS2 significantly expands the scope compared to the original NIS directive. The following sectors are now covered:

Essential entities

Energy (electricity, oil, gas, heating)
Transport (air, rail, water, road)
Banking and financial market infrastructure
Healthcare
Drinking water and wastewater
Digital infrastructure (DNS, TLD, cloud, data centers)
Public administration

Important entities

Postal and courier services
Waste management
Chemical manufacturing
Food production and distribution
Manufacturing (medical devices, electronics, machinery)
Digital providers (online marketplaces, search engines, social networks)

Key change: NIS2 applies to all medium and large enterprises in these sectors — not just those designated by member states. If you have 50+ employees or €10M+ annual turnover, you're likely in scope.

What are the obligations?

Organizations must implement measures in four key areas:

Risk management — Conduct regular risk assessments and implement appropriate technical and organizational measures
Incident reporting — Report significant incidents to CSIRT within 24 hours (early warning) and 72 hours (full notification)
Supply chain security — Assess and manage cybersecurity risks in your supply chain
Business continuity — Maintain backup management, disaster recovery, and crisis management plans

Technical measures required

The law specifies minimum technical requirements:

Network and information system security policies
Incident handling procedures
Business continuity and backup management
Supply chain security assessment
Security in network and information system acquisition
Multi-factor authentication (MFA) for all privileged access
Encryption of data at rest and in transit
Employee cybersecurity training

# Minimum MFA requirements
mfa_policy:
  required:
    - admin_root_access: true
    - vpn_connections: true
    - cloud_management_consoles: true
    - email_sensitive_data: true
  recommended:
    - standard_user_login: false  # not required but recommended

Example Terraform snippet for enforcing MFA on AWS:

resource "aws_iam_account_password_policy" "strict" {
  minimum_password_length        = 14
  require_lowercase_characters   = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_symbols                = true
  allow_users_to_change_password = true
  max_password_age               = 90
}

resource "aws_iam_policy" "enforce_mfa" {
  name   = "enforce-mfa"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyAllExceptMFA"
        Effect    = "Deny"
        NotAction = ["iam:CreateVirtualMFADevice", "iam:EnableMFADevice"]
        Resource  = "*"
        Condition = {
          BoolIfExists = { "aws:MultiFactorAuthPresent" = "false" }
        }
      }
    ]
  })
}

Timeline and deadlines

Milestone	Date	Status
NIS2 directive published	Dec 2022	✅ Done
Polish KSC act adopted	Jan 2026	✅ Done
Registration of entities	Jun 2026	⏳ Upcoming
Full compliance required	Oct 2026	⏳ Upcoming
First audits expected	Q1 2027	📋 Planned

Penalties

Non-compliance carries significant fines:

Essential entities: up to €10M or 2% of global annual turnover
Important entities: up to €7M or 1.4% of global annual turnover
Personal liability: Management bodies can be held personally liable for failures to implement adequate measures

Practical steps to achieve compliance

Here's a prioritized roadmap:

Phase 1: Assessment (weeks 1–4)

Determine if your organization falls under NIS2 scope
Conduct a gap analysis against KSC requirements
Inventory all network and information systems
Map your supply chain dependencies

Phase 2: Implementation (weeks 4–12)

Draft and adopt cybersecurity policies (ISMS)
Implement incident detection and response procedures
Deploy MFA on all privileged access
Establish backup and disaster recovery processes
Conduct employee awareness training

Phase 3: Validation (weeks 12–16)

Perform penetration testing on critical systems
Run a tabletop incident response exercise
Review and test backup restoration procedures
Document everything for audit readiness

How DualStack can help

We offer a complete NIS2/KSC compliance package:

Gap analysis — We assess where you stand and build a roadmap
ISMS documentation — Policies, procedures, and incident response plans
Penetration testing — Validate your security posture with real-world testing
Employee training — Phishing simulations and security awareness workshops
Ongoing monitoring — Continuous security assessment through our subscription model

Two engineers, zero middlemen. We find the gaps, write the fixes, and ship them. Not a 200-page PDF that sits in a drawer — actual, implemented security.

Get in touch →

NIS2 in Poland — What Your Company Must Do in 2026