Implementation of the NIS2 Directive

The NIS2 Directive (Directive of the European Parliament and of the Council of 14 December 2022 concerning measures for a high common level of cybersecurity) is a new version of the NIS Directive. Its aim is to increase the level of cybersecurity in the European Union. NIS2 introduces new responsibilities for Member States and expands the scope of entities covered by obligations.

The introduced requirements demonstrate synergies with the global standards ISO/IEC 27001 and ISO/IEC 27002, which define the framework for Information Security Management Systems.

The National Cybersecurity System (Krajowy System Cyberbezpieczeństwa, KSC) is an organized system designed to ensure cybersecurity at the national level through coordination and information exchange between enterprises, institutions, and public authorities. Its primary goal is to protect critical infrastructure and ensure the continuity of services in key industries.

The legal basis is the National Cybersecurity System Act, in effect since August 28, 2018, which implements the NIS Directive into Polish law. Work is currently underway to amend the Act to align it with the expanded NIS2 requirements.

By implementing the requirements described in the aforementioned standards and obtaining certification from an accredited entity, a company can demonstrate compliance with the obligations imposed by the Act. Effective implementation of the standard also facilitates demonstrating compliance with the General Data Protection Regulation (GDPR). Regulated entities that fail to meet the Act’s requirements are subject to significant financial penalties imposed by the relevant cybersecurity authorities.

The regulations apply to two groups of companies – those in important and key sectors – which have been imposed obligations related to cybersecurity management. Higher requirements apply to sectors such as energy, transportation, drinking water suppliers, and digital service providers. To a somewhat lesser extent, the new obligations must be met by companies in important sectors, such as postal services, waste management, food producers and distributors, and selected subsectors of industrial production (e.g., automotive).

In practice, this means that thousands of private and public entities will be required to meet a range of new cybersecurity requirements, including system auditing, penetration testing, and incident response.