National Cybersecurity System After Amendment – What the Implementation of the NIS2 Directive Means for Companies

Poland is entering a new stage of building the digital resilience of the state and the economy. Karol Nawrocki has signed the amendment to the National Cybersecurity System Act, which implements the EU NIS2 Directive. The new regulations will come into effect as early as April and will significantly expand the scope of cybersecurity obligations.

This is one of the biggest changes in digital security in Poland in recent years. For many organizations, it means the need to review current systems, procedures, and collaboration with technology providers.

NIS2 – the Beginning of Dynamic Changes

The amendment to the KSC Act implements European cybersecurity standards arising from the NIS2 Directive. Its goal is to increase organizations’ resilience to cyberattacks and improve their ability to respond to security incidents.

In practice, this means several key changes.

More Sectors Covered by the Regulation

The new regulations significantly expand the list of industries required to comply with cybersecurity requirements. In addition to sectors already covered, the obligations will also include, among others:

• Postal and courier services
• Water and wastewater management
• Food production
• Chemical industry
• Selected digital and technology services

This means that many companies will, for the first time, fall under formal cybersecurity management requirements.

New Obligations for Critical and Important Entities

Organizations subject to the regulations will be classified as either critical entities or important entities. Regardless of the category, they will need to implement a range of measures to increase security levels.

The main obligations include:

• Regular cybersecurity risk analysis
• Implementation of adequate technical and organizational measures
• Threat monitoring and incident response
• Mandatory incident reporting to relevant authorities
• Security control of supply chains and IT services

In practice, this requires organizing and standardizing security processes across the entire organization.

Greater Responsibility for Management Boards

One of the most important changes introduced by NIS2 is the shift of responsibility to the management level.

Cybersecurity is no longer solely the domain of IT departments. Management and executives will:

• Be responsible for overseeing the security management system
• Be obliged to make decisions regarding risk management
• Potentially bear consequences for failing to implement proper safeguards

This makes cybersecurity an element of organizational management strategy, not just a technical matter.

Expanded State Competences

The amendment also strengthens the competences of state authorities responsible for digital security.

The new regulations will enable:

• More effective supervision of organizations covered by the regulation
• Faster exchange of threat information
• More efficient response to serious cybersecurity incidents

This aims to make the system more coherent and effective across the entire economy.

What Does This Mean for Organizations?

For many companies, the coming months will be a period of intensive preparation. Implementing NIS2 requirements in practice means the need to review:

• IT and OT system architecture
• Security policies
• Incident response procedures
• Relationships with technology providers
• Employee awareness levels

Today, cybersecurity becomes an element of risk management for the entire organization, not just a technical aspect of IT infrastructure.

NIS2 Means More Obligations Than NIS1

The new directive significantly expands the tasks and responsibilities of organizations compared to the previous NIS1 directive. This applies both to the number of sectors covered and the level of detail of security requirements.

Companies that start preparations early will not only meet regulatory requirements but also genuinely increase the resilience of their infrastructure to cyber threats.

National Cybersecurity System. Where to Start Preparing?

The first and most important step is a thorough assessment of the current security level. Without it, it is difficult to determine what actions are needed to comply with the new regulations.

In practice, this means conducting a professional cybersecurity audit to:

• Identify security gaps
• Assess compliance with NIS2 requirements
• Prepare a plan for implementing necessary changes

If your organization may be subject to the new regulations, it is worth starting preparations now.

Direct IT Helps Companies Navigate This Process Safely and Effectively

From cybersecurity audits to risk analysis and the implementation of required safeguards, Direct IT supports companies throughout the entire process.

Trust the IT Experts

We have extensive experience in delivering comprehensive solutions for data protection and preventing information leaks for companies of all sizes. Our solutions are tailored to the individual needs of our clients, so you can focus on the core aspects of running your business.

Want to learn more?

Contact us, and we will prepare a detailed offer customized specifically for your company: CONTACT

Also, visit us on: Facebook