{"id":3834,"date":"2026-08-07T19:37:12","date_gmt":"2026-08-07T17:37:12","guid":{"rendered":"https:\/\/www.lablogic.pl\/nis2-and-ksc-preparation-and-implementation-support-for-organizations\/"},"modified":"2026-10-04T02:12:53","modified_gmt":"2026-10-04T00:12:53","slug":"nis2-ksc","status":"publish","type":"page","link":"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/","title":{"rendered":"NIS2 and local law KSC \u2014 preparation and implementation support for organizations"},"content":{"rendered":"\n
\n
\n
\n
\n
\n

NIS2 \/ KSC \/ CYBERSECURITY<\/p>\n\n

NIS2 and local law KSC: preparation and effective implementation for organizations<\/h1>\n\n

I help define the scope of obligations, assess readiness, and translate requirements into responsibilities, priorities, and actions that can be maintained and demonstrated during an audit. A single process connecting management decisions with the actions of legal, compliance, IT, and cybersecurity teams.<\/p>\n\n

\n
Schedule a diagnostic conversation<\/a><\/div>\n\n
Does every organization fall under NIS2?<\/a><\/div>\n<\/div>\n\n
\n

<\/p>\n\n

Nearest deadline: 3 October 2026<\/strong> \u2014 entry in the KSC Register.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n

KEY KSC DEADLINES<\/p>\n\n

\n
\n

April 3, 2026<\/p>\n\n

KSC amendment in force<\/h4>\n\n

The act implementing the NIS2 directive has entered into force.<\/p>\n<\/div>\n\n

\n

NEAREST DEADLINE<\/p>\n\n

October 3, 2026<\/p>\n\n

Deadline for entry into the KSC Register<\/h4>\n\n

For entities meeting the criteria on April 3, 2026, that have not been entered ex officio.<\/p>\n<\/div>\n\n

\n

April 3, 2027<\/p>\n\n

End of adaptation period<\/h4>\n\n

Deadline for starting to use S46 and implementing obligations arising from the act.<\/p>\n<\/div>\n\n

\n

April 3, 2028<\/p>\n\n

First security audit<\/h4>\n\n

Deadline for the first audit of essential entities; further audits at least every three years.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n

The 3 October 2026 deadline comes from a ministerial announcement<\/a> rather than directly from the act<\/a>, so it may change. For entities that start meeting the criteria later, deadlines are generally counted from the moment the criteria are met. The scope and schedule are confirmed individually. This information is general in nature and does not constitute individual legal advice.<\/p>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Does this apply to your organisation?<\/h2>\n\n
\n
\n
\n

PRIMARY PATH<\/p>\n\n

\n

1<\/p>\n\n

\n

Type of activity<\/h4>\n\n

Qualification follows actual activity, not the registered scope of business.<\/p>\n<\/div>\n<\/div>\n\n

\n

2<\/p>\n\n

\n

Size of the organisation<\/h4>\n\n

Thresholds are assessed together with linked and partner enterprises.<\/p>\n<\/div>\n<\/div>\n\n

Both conditions must be met together.<\/p>\n<\/div>\n\n

\n

or<\/p>\n<\/div>\n\n

\n

SPECIAL PATH<\/p>\n\n

\n

3<\/p>\n\n

\n

Special criteria<\/h4>\n\n

Some entities are covered regardless of their size.<\/p>\n<\/div>\n<\/div>\n\n

Size of the organisation is then not assessed.<\/p>\n<\/div>\n<\/div>\n\n

<\/p>\n\n

\n

The organisation is covered by the KSC Act<\/h4>\n\n

From that moment, not from an administrative decision.<\/p>\n<\/div>\n\n

<\/p>\n\n

\n

<\/p>\n\n

\n

Entry in the KSC Register<\/h4>\n\n

It follows from qualification rather than creating it \u2014 the duty arises earlier.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n

<\/p>\n\n

The assessment should be documented even when it ends with \u201ewe are not covered\u201d.<\/p>\n\n

Documentation is proof of system operation<\/strong>, not an end in itself. The recorded qualification assessment is the first such piece of evidence.<\/p>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

When is support needed?<\/h2>\n\n

The starting point may vary. The working method remains structured and adapted to the actual need.<\/p>\n\n

\n
\n
\n

Uncertain status<\/h3>\n\n

It is unclear whether the organization is subject to KSC and what obligations apply.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

No plan<\/h3>\n\n

Priorities, roles, and a realistic implementation sequence are needed.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

Implementation in progress<\/h3>\n\n

Actions are ongoing, but there is a lack of consistency, pace, or evidence of completion.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

Audit preparation<\/h3>\n\n

Verification of readiness, documentation, and process operations is needed.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Implementation covers three interconnected areas<\/h2>\n\n
\n
\n
\n

<\/p>\n\n

Management and responsibility<\/h3>\n\n