Cybersecurity audit — know what to fix and where to start
An IT security audit that ends with a concrete plan. We review your infrastructure, configurations and access, cloud, backups and procedures. You get a risk-rated report and a prioritised remediation plan. From PLN 5,000 net, usually 2–4 weeks. We confirm a fixed price before work starts.
What is a cybersecurity audit?
A cybersecurity audit, also called an IT security audit, is an independent assessment of how your company protects its systems and information. We review technical safeguards: network, servers, configurations, permissions, cloud and backups. We also assess information security from the organisational side: procedures, roles, access management and incident response. The result is a list of gaps with a risk rating and a plan for what to fix first.
We do not stop at a list of issues. We describe findings in language that both your IT team and your management understand, and we shape recommendations so they can actually be implemented. Audits are led by our founder, who has worked in IT security and enterprise infrastructure for more than 16 years.
What we review
We agree the scope before work starts. The audit can cover all of the areas below or only selected ones. Penetration tests can be added as an option, carried out together with a trusted partner.
Infrastructure and network
Network architecture and segmentation, firewalls, servers and workstations, remote access and software updates.
Configurations and access
System and service configurations, privileged accounts, multi-factor authentication (MFA) and the principle of least privilege.
Cloud
Configuration and permissions in AWS, Azure and GCP environments, event logging and monitoring.
Backups and recovery
Backup scope and frequency, protection against ransomware, restore tests and recovery times matched to your business needs.
Procedures and organisation
Security policies, roles and responsibilities, supplier management, incident handling and staff awareness.
NIS2 and ISO 27001 readiness
A comparison of your current state with the requirements of the Polish KSC Act (NIS2) and ISO 27001, with a list of gaps to close.
How the audit works
Free 30-minute call
We learn about your company, your IT environment and the reason for the audit. We reply to your enquiry on the same working day.
Scope and fixed price
We agree which areas and systems the audit covers and give you a fixed price before work starts.
Technical and organisational review
We analyse configurations and documentation and talk to the people responsible for IT and security. Dates and the way we access your systems are agreed with your team.
Report and results meeting
We hand over the report, the remediation plan and the management summary, and walk through the results with you in a meeting.
What you get
Risk-rated report
Every finding with a description, possible impact and a risk rating, so it is clear what is really urgent.
Prioritised remediation plan
Concrete recommendations in order: what to fix right away, what in the coming months and what to plan for later.
Management summary
A short, non-technical overview of your security posture, the main risks and the decisions that need to be made.
Results walkthrough
A meeting with your IT team and management to go through the findings. If you wish, we can also help implement the recommendations.
IT security audit and the statutory KSC audit (Article 15)
The amended Polish Act on the National Cybersecurity System (KSC), which implements NIS2, has been in force since 3 April 2026. Essential and important entities must, among other things, manage risk and implement an information security management system, and essential entities must also carry out a security audit at least once every 3 years (Article 15 of the KSC Act). An essential entity must send a copy of the audit report to the competent cybersecurity authority within 3 working days (Article 15(1a)). The authority may also order an external audit at any time for an essential entity, and for an important entity after a serious incident or another breach of the Act, by a decision that is immediately enforceable (Article 15(1b) and (1c)). So you cannot always schedule the audit on your own terms. An IT security audit shows where your company stands against these obligations today and helps you prepare for the statutory audit.
Not sure whether the Act applies to your company? Start with a written NIS2 opinion. If it does, the audit results will be useful for ISO 27001 implementation.
Who the cybersecurity audit is for
- ✓Companies covered by the KSC Act (essential and important entities) preparing for their new obligations.
- ✓Suppliers to regulated companies who receive security questions and questionnaires from their clients.
- ✓Companies planning an ISO 27001 implementation that want to know where to start.
- ✓Organisations after an incident or a major IT change, such as a cloud migration.
- ✓Management boards that want an independent view of their security posture before budget decisions.