NIS2 / KSC / CYBERSECURITY

NIS2 and local law KSC: preparation and effective implementation for organizations

I help define the scope of obligations, assess readiness, and translate requirements into responsibilities, priorities, and actions that can be maintained and demonstrated during an audit.

Schedule a diagnostic conversation

A single process connecting management decisions with the actions of legal, compliance, IT, and cybersecurity teams.

One coherent process

Scope and decisions

Organization qualification, obligations and priorities.

Plan and responsibility

Roles, sequence of actions and agreed-upon schedule.

Implementation

Changes in processes, safeguards and collaboration methods.

Maintenance and audit

Evidence, progress control, tests and updates.

When is support needed?

The starting point may vary. The working method remains structured and adapted to the actual need.

Uncertain status

It is unclear whether the organization is subject to KSC and what obligations apply.

No plan

Priorities, roles, and a realistic implementation sequence are needed.

Implementation in progress

Actions are ongoing, but there is a lack of consistency, pace, or evidence of completion.

Audit preparation

Verification of readiness, documentation, and process operations is needed.

LEGAL STATUS: AUGUST 2026

Key polish KSC dates

Dates help plan activities but do not replace the qualification of a specific organization.

April 3, 2026

KSC amendment in force

The act implementing the NIS2 directive has entered into force.

October 3, 2026

Deadline for entry into the KSC Register

For entities meeting the criteria on April 3, 2026, that have not been entered ex officio.

April 3, 2027

End of adaptation period

Deadline for starting to use S46 and implementing obligations arising from the act.

For entities that start meeting the criteria later, deadlines are generally counted from the moment the criteria are met. The scope and schedule are confirmed individually. This information is general in nature and does not constitute individual legal advice.

Sources: Ministry of Digital Affairs — key dates and Journal of Laws 2026 item 252.

Implementation covers three interconnected areas

Documentation is proof of system operation, not an end in itself.

Management and responsibility

Roles of management and process owners
Scope of decisions and oversight
Risk associated with services and assets

Operational resilience

Incidents and communication
Business continuity and testing
Suppliers and supply chain

Evidence and audit readiness

Plan, actions, and responsibilities
Documentation consistent with the actual state
Measurable progress and complete evidence

How does the project proceed?

Each stage concludes with a specific result and a decision on the next step.

Scope identification

Scope and obligations

Gap and risk analysis

Priorities and decisions

Implementation plan

Roles and milestones

Implementation support

Changes and team preparation

Maintenance and audit

Control and updates

How to tell if the implementation is working?

The organization can make decisions, carry out actions, and provide evidence of them.

Evidence of operation

✓ Management responsibility is clear and documented.

✓ Process and risk owners are appointed and active.

✓ Risks are linked to services and assets.

✓ The organization responds to and communicates incidents.

✓ Suppliers are supervised, and requirements are enforced.

✓ Evidence of completed actions and decisions is available.

Organizational capabilities

Clear decisions

Management receives the information needed to act.

Implementation control

Progress, responsibilities, and delays are visible.

Lasting readiness

The system is maintained, tested, and updated.

Collaboration and tools

Support does not replace existing teams. It organizes responsibilities, connects perspectives, and helps translate requirements into actions for process owners, IT, compliance, and suppliers.

LabLogic’s role

Qualification, analysis, priorities, coordination, recommendations, and control of the agreed scope’s implementation.

Organization’s role

Management decisions, access to information, designation of action owners, and implementation of changes in processes and safeguards.

Role of IT and suppliers

Technical information, security implementation, testing, and evidence of completion.

In projects combining cybersecurity and data protection, the scope can be coordinated with external DPO / IOD support.

Application for KSC compliance – Red Into Green

Depending on the scope, the Red Into Green application can support the recording of risks, actions, responsibilities, incidents, and evidence. The tool organizes work but does not replace expert assessment or organizational decisions.

Support requiring the combination of several perspectives

Effective KSC implementation combines law, security, technology, processes, and management responsibility. I work at the intersection of these areas, supporting organizations from diagnosis to maintaining readiness.

Over 20 years of experience

Knowledge of systems, services, suppliers, and the realities of the organization’s operations.

Law, IT, and cybersecurity in one process

I translate requirements into risks, decisions, and concrete actions.

Working with complex organizations

Communication tailored to management and cooperation with legal, compliance, and IT departments.

Related services

Incidents and Breaches

When an incident occurs, the organization may need a separate assessment, coordination of decisions, communication, and corrective actions.

See incident support

NIS2 training for boards and management

Implementation requires a shared understanding of responsibilities, risks, and decision-making.

See GDPR and NIS2 training

Frequently Asked Questions

How to determine if an organization is subject to KSC?

We start with the type of services provided, sector, scale of operations, and the organization’s role. Then we organize the criteria and confirm the scope of obligations, considering the current legal status.

Do I support the organization in full implementation?

Yes. I support the organization in planning and conducting the implementation — from qualification and gap analysis, through action plans, documentation, and team preparation, to readiness verification. Responsibility for decisions and actions remains with the organization.

How does cooperation with the current IT or compliance department look?

We build a single, common plan and a clear division of responsibilities. We utilize existing safeguards and processes, and fill in missing elements without creating unnecessary bureaucracy.

What is the Red Into Green application used for?

The Red Into Green application helps organize risks, actions, responsibilities, incidents, and evidence. It is professional support for project implementation but does not replace joint analysis or organizational decisions.

How long does the project take?

The time depends on the scope of obligations, the organization’s maturity, and the number of required changes. After a diagnostic conversation, I propose stages, priorities, and a realistic schedule instead of a single rigid declaration.

What information is needed at the beginning?

A brief description of the organization, main services, current security management approach, and stage of preparation is sufficient. Confidential documents and incident details are shared only after agreeing on a secure channel.

DIAGNOSTIC CONVERSATION

Let’s determine the right first step for your organization

Initially, a brief description of the situation is enough. After our conversation, I will propose an adequate scope: qualification, gap analysis, an implementation plan, or full implementation support.

Write directly

Briefly describe your situation

The administrator of the data provided in the form is Michał Rutkowski, operating LabLogic Consulting. I use the data to handle inquiries and prepare a response or offer. Details can be found in the Privacy Policy. Do not send passwords, special categories of data, or full incident documentation.