ISMS implementation under the Polish KSC Act
The Polish National Cybersecurity System Act (KSC) requires essential and important entities to implement an information security management system (ISMS, in Polish: SZBI). Companies covered by the Act since 3 April 2026 have until 3 April 2027 to do so. We implement the ISMS using ready-made, proven documentation templates. Gap assessment from PLN 8,000 net; the implementation is quoted at a fixed price after the gap assessment.
What is an ISMS under the KSC Act?
An information security management system (ISMS) is a structured way for an organisation to assess risk, choose safeguards and check that they work. The amended National Cybersecurity System Act (KSC) has been in force since 3 April 2026. Under its Art. 8(1), an essential or important entity implements an ISMS in the information system used in the processes that affect the provision of its service.
An ISMS is not a single document but a working system: policies and procedures, technical and organisational measures, incident management and regular evaluation of their effectiveness. Decisions on preparing, implementing, applying, reviewing and supervising the ISMS are taken by the head of the entity (Art. 8d).
What the ISMS must ensure
Art. 8(1) of the Act lists five areas the system must ensure. A summary is below.
Risk assessment
Systematic assessment of the risk of an incident and management of that risk (point 1).
Technical and organisational measures
Appropriate and proportionate to the assessed risk, taking into account, among other things, the state of the art, implementation costs, the size of the entity and the likelihood of incidents (point 2).
Threat intelligence
Collecting information on cyber threats and vulnerabilities of the information system used to provide the service (point 3).
Incident management
An incident management process (point 4). Reporting significant incidents to the competent CSIRT is governed separately by Art. 11.
Limiting the impact of incidents
Including protection of the confidentiality, integrity, availability and authenticity of data, regular software updates, protection against unauthorised modification and prompt response to vulnerabilities (point 5).
Measures listed explicitly in the Act (Art. 8(1)(2))
- risk assessment and information system security policies, including topic-specific policies
- security in the acquisition, development, maintenance and operation of the system, including testing
- physical and environmental security, including access control
- human resources security
- security and continuity of the supply chain of ICT products, services and processes
- business continuity, contingency and recovery plans: implemented, documented and tested
- continuous monitoring of the information system
- policies and procedures for assessing the effectiveness of security measures
- cybersecurity education for staff
- basic cyber hygiene practices
- policies and procedures for the use of cryptography, including encryption
- secure electronic communications, with multi-factor authentication where appropriate
- asset management
- access control policies
Who must implement an ISMS, and by when?
The Art. 8 obligation applies to essential and important entities. Entities that met the criteria of the Act on the day it entered into force have 12 months to fulfil the obligations of Chapter 3 of the Act, including implementing the ISMS (Art. 33(1)). A company that started to meet the criteria later, for example after acquiring another company, has 12 months from that day (Art. 16).
The Act is in force
The new obligations apply to essential and important entities.
ISMS deadline
End of the 12 months for Chapter 3 obligations for entities covered by the Act since 3 April 2026 (Art. 33(1)).
First audit and fines
Deadline for the first audit of essential entities (Art. 33(2)). From this date the fines under Art. 73(1)–(4) and Art. 73a may be imposed (Art. 35).
Responsibility of the head of the entity
- Is responsible for the performance of cybersecurity obligations, also when they have been entrusted to another person (Art. 8c).
- Takes decisions on the ISMS, plans the budget for cybersecurity and supervises the tasks (Art. 8d).
- Completes training once per calendar year; participation must be documented (Art. 8e).
- Admits persons to ISMS (Art. 8) and incident handling (Art. 11) tasks after receiving information from the National Criminal Register confirming no convictions for offences against the protection of information (Art. 8f).
Fines
Failure to implement an ISMS, or a system that does not meet the requirements of Art. 8, may result in a fine: for an essential entity up to EUR 10 million or 2% of revenue (whichever is higher), for an important entity up to EUR 7 million or 1.4% of revenue (Art. 73). Separately, the head of the entity may be fined up to 300% of their remuneration (Art. 73a). These fines may be imposed from 3 April 2028 (Art. 35). The deferral does not cover the fine of up to PLN 100 million under Art. 73(5), which applies already: it can be imposed where a breach of the Act causes a direct and serious cyber threat to defence, state security, public order or human life and health, or a threat of serious material damage or serious disruption to services.
Special cases
- Important entities that are public entities (and some entities of the higher education and science system) build their ISMS according to the requirements of Annex 4 to the Act (Art. 8(3)).
- Providers of, among others, DNS services, cloud computing, data centre services, managed services and managed security services apply, within the ISMS, the measures of Commission Implementing Regulation (EU) 2024/2690 (Art. 8b).
- For the banking and financial market infrastructure sectors, the ISMS provisions apply only to a limited extent (Art. 8i). The DORA Regulation plays the main role there.
- The Council of Ministers may set detailed ISMS requirements for specific types of activity by regulation (Art. 8a).
Not sure whether your company is an essential or important entity? Start with a written NIS2/KSC opinion.
NIS2/KSC opinionArticle numbers refer to the National Cybersecurity System Act as amended; Art. 33 and 35 are transitional provisions of the amending act of 23 January 2026 (Journal of Laws 2026, item 252).
How we implement an ISMS
We work in stages. The gap assessment starts from PLN 8,000 net. We quote the implementation at a fixed price after the gap assessment. The first 30-minute consultation is free. We don't write documentation from scratch: we use ready-made, proven templates and tailor them to your organisation.
Gap analysis
We compare your current safeguards, documentation and processes with the requirements of Art. 8. We define the ISMS scope, i.e. the information systems used to provide the service, and the list of gaps to close.
Documentation based on proven templates
We prepare policies, procedures and registers using proven ISMS documentation templates: from risk assessment, through access control and the supply chain, to business continuity.
Implementing measures and processes
We help put into practice what the documentation describes: risk assessment, asset and incident management, supplier cooperation, backups and monitoring. We point out which technical safeguards need to be added.
Management training
We train the head of the entity and the persons entrusted with cybersecurity duties. The Act requires such training once per calendar year (Art. 8e). We also help plan staff education.
Review and audit readiness
We check whether the system works in practice: ISMS review, assessment of the effectiveness of safeguards and a list of corrective actions. This is how we prepare an essential entity for the audit it must carry out at least once every 3 years (Art. 15). The audit cannot be carried out by a person who performs tasks under Art. 8 and Art. 9–13 of the Act for the entity, such as ISMS or incident handling tasks, or did so in the year before the audit started (Art. 15(2a)).
ISMS under the KSC Act vs ISO 27001
The KSC Act does not require ISO/IEC 27001 certification, but the standard is a natural framework for the ISMS. It is risk-based and covers most of the areas listed in Art. 8, such as security policies, access control, asset management, supplier security, business continuity and cryptography. If you plan to get certified, it makes sense to build one system that addresses both sets of requirements from the start.
An ISO 27001 certificate on its own does not automatically mean that the requirements of the Act are met. The scope of a certified system may be narrower than the information system used to provide the service, and some obligations arise only from the Act.
What an ISO 27001-based ISMS usually covers
- risk assessment and risk treatment plan
- security policies, including topic-specific policies
- access control, asset management and cryptography
- supplier security and business continuity
- management reviews, internal audits and corrective actions
What to check or add for the KSC Act
- ISMS scope: the information system used to provide the service (Art. 8(1))
- reporting significant incidents to the competent CSIRT: early warning within 24 hours, notification within 72 hours (Art. 11)
- security documentation of the information system, including infrastructure protection documentation (Art. 10)
- contact persons for the national cybersecurity system (Art. 9)
- annual training of the head of the entity (Art. 8e) and criminal record information for persons performing Art. 8 tasks (Art. 8f)
- security audit of an essential entity at least once every 3 years (Art. 15)
- measures from EU implementing acts, if they apply to your type of activity (Art. 8b)
The Act allows the minister for digital affairs to publish a list of requirements from standardisation documents (standards) whose application fulfils obligations under the Act (Art. 45(3)). Such a list is intended to help determine detailed ISMS requirements in individual sectors. The obligations themselves follow directly from Art. 8 of the Act.
ISO 27001 implementation