{"id":3921,"date":"2026-06-23T09:10:00","date_gmt":"2026-06-23T07:10:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/where-should-the-board-begin-preparing-for-nis2\/"},"modified":"2026-10-03T20:25:43","modified_gmt":"2026-10-03T18:25:43","slug":"where-should-the-board-begin-preparing-for-nis2","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/where-should-the-board-begin-preparing-for-nis2\/","title":{"rendered":"Where should the board begin preparing for NIS2?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for the board and management \u2022 published June 23, 2026 \u2022 updated September 27, 2026 \u2022 8 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

With two decisions that the board itself must make. These are who in the organization is the entity manager within the meaning of the KSC Act, and whether the entity’s qualification has been determined and documented. Only after these does a gap analysis, implementation plan, and budget make sense\u2014without them, the organization finances work whose scope no one can justify. The Act does not allow the entity manager’s responsibility to be transferred to the IT department or to a vendor, so the first decision is a board decision, not a task to be delegated. <\/p>\n<\/div>\n\n\n\n

Why this question arises at all<\/h2>\n\n\n\n

Preparation for NIS2 is sometimes initiated from the middle. The board learns that the organization is subject to new regulations, assigns the matter to the IT or compliance department, and after a few weeks receives a list of missing procedures and a quote for tools. The question of sequence returns only when an expenditure must be approved that no one can link to a specific obligation. <\/p>\n\n\n\n

The source of this confusion is the structure of the regulations. Directive (EU) 2022\/2555 itself binds the Member State, not the business\u2014an organization’s obligations arise from the Act on the National Cybersecurity System (KSC) as amended by the amendment of January 23, 2026, which entered into force on April 3, 2026. The Act changes something that was not so clear in the previous legal state. It places responsibility for performing cybersecurity obligations on the entity manager (Article 8c), imposes on them an obligation to undergo documented training once per calendar year (Article 8e), and provides for a separate financial penalty for that person\u2014up to 300% of the remuneration they receive (calculated under the rules for determining cash in lieu of annual leave) and as a rule up to 100% in a public entity (Article 73a(4) and (5))\u2014independent of the penalty imposed on the entity.<\/p>\n\n\n\n

Cybersecurity therefore ceases to be a matter that the board can simply acknowledge. It becomes an area in which the board makes decisions and must be able to show the basis on which it made them. <\/p>\n\n\n\n

The second reason is the calendar. Entry in the KSC Register for entities registering on application falls within the period until October 3, 2026, the adaptation period ends on April 3, 2027, and the twenty-four-month deadline for the first audit of essential entities expires on April 3, 2028. After that date financial penalties may also be imposed for the first time (Article 35 of the amending act). The only penalty outside this deferral is the penalty of up to PLN 100 million under Article 73(5). The registration schedule itself does not follow from the Act but from the communication of the Minister of Digitization of April 8, 2026. The minister may amend it only where technical or organisational reasons make it impossible to make entries and start using the S46 system within the scheduled timeframe (Article 34(5) of the amending act). The date of October 3, 2026 applies to entities that met the criteria on April 3, 2026. An organization that meets them later has six months from that moment to submit the application\u2014for entry ex officio, the deadline runs from service of the summons. These dates are not an argument for haste. However, they determine which work must be completed this year and which has until April 3, 2027.<\/p>\n\n\n\n

\n

What should the board know?<\/h2>\n\n\n\n

Responsibility for performing obligations under the KSC Act rests with the entity manager and cannot be transferred by contract or resolution\u2014tasks can be delegated, not responsibility. The entity manager has an obligation to undergo documented cybersecurity training, and the Act provides for a separate financial penalty for them, in addition to the penalty for the entity. <\/p>\n\n\n\n

Entity qualification is, as a rule, based on self-assessment. The authority writes to an entity entered ex officio (a notice) or designated by decision. The legal basis is Articles 7a(2) and 7b(1), 7j, 7l and 7m of the Act and Article 34(2) of the amending act. The result of the assessment\u2014including a negative one\u2014should be documented. The scope of implementation depends on the entity’s category and what the organization already has, so a budget set before a gap analysis is a guessed budget. Deadlines divide the work into two stages. The first is registration in 2026, the second is implementation and connection to the S46 system by April 3, 2027. <\/p>\n<\/div>\n\n\n\n

What must be determined before the decision<\/h2>\n\n\n\n

Who is the entity manager and what the Act requires of them<\/h3>\n\n\n\n

This question sounds formal but determines everything else. In organizations with a multi-member board, responsibility applies to the body, but practice requires identifying a person who leads the matter, reports it to the board, and is responsible for the completeness of decision-making materials. In capital groups, qualification and status are determined separately for each entity, so there are as many entity managers as there are companies covered by the Act\u2014a common group project does not replace this. <\/p>\n\n\n\n

From this determination, three things follow that the board should ask at the first meeting devoted to this matter. These are who is responsible by name, what training they have completed or will complete, and by what procedure they receive information about incidents. The third question is most often omitted, yet it determines the ability to report a serious incident within the required timeframe\u2014early warning within 24 hours of detecting a serious incident and notification within 72 hours, also counted from detection and not from the early warning. <\/p>\n\n\n\n

Whether qualification is determined and documented<\/h3>\n\n\n\n
\n\n

Remember<\/p>\n\n\n\n

Qualification is not a formality opening the project, but its foundation.<\/p>\n\n<\/div>\n\n\n\n

It determines whether the organization is an essential or important entity, and from that\u2014whether it must plan an audit cycle and under what supervisory regime it will operate. The criteria and method of self-assessment are set out in Does every organization fall under NIS2?<\/a>. What the board should receive from that assessment is a concrete result. <\/p>\n\n\n\n

A useful qualification result is not the sentence “we are subject.” It is a brief document. It records which lines of business were assigned to sectors from the annexes of the Act, how the entity’s size was calculated taking into account related and partner enterprises, what category was adopted, and who approved this conclusion. Without this record, the board has no way to demonstrate that the decision was informed\u2014and with a negative qualification result, this document is the only trace that it was conducted at all. <\/p>\n\n\n\n

What the organization already has<\/h3>\n\n\n\n

Preparation for NIS2 rarely starts from scratch. Organizations with a certified information security management system, with implemented GDPR, with a functioning incident response procedure, or with obligations arising from the DORA regulation already have some of the required elements\u2014usually in a different arrangement and under a different name. <\/p>\n\n\n\n

Establishing the starting point is the step that most strongly affects cost. A board that orders “NIS2 implementation” without this inventory usually pays for duplication of already existing procedures and for documentation describing processes that the organization does not conduct. Documentation should show how the organization actually operates; if it describes an invented state, during an audit it works against it. <\/p>\n\n\n\n

The practical scope of this review is finite. It covers risk analysis and its currency, access and authorization management, backups with recovery testing, event logging, incident reporting and response procedure, business continuity plan, requirements for suppliers in existing contracts, and verification of the criminal record of persons performing tasks related to the information security management system and to incident handling\u2014information from the National Criminal Register on the absence of convictions for offences against the protection of information, whereby a valid security clearance at the “confidential” level or higher replaces this requirement.<\/p>\n\n\n\n

Who is responsible for what on the operational side<\/h3>\n\n\n\n

The entity manager’s responsibility does not eliminate the need to assign tasks. The Act requires, among other things, the designation of at least two persons responsible for contacts with entities of the national cybersecurity system; one person is sufficient only for a micro or small enterprise and for an important entity that is a public entity. In practice, process owners and risk owners are also needed\u2014that is, people who can say what will happen to a specific service when a specific system is unavailable. <\/p>\n\n\n\n

A common organizational arrangement looks like this. Security formally belongs to IT, but decisions about priorities are made in business lines, and no one has a mandate to resolve disputes between them. In such an arrangement, implementation stops at the risk analysis stage, because assessing the consequences of process interruption requires input from the business, and the business does not feel it owns the matter. Resolving this issue is a management decision, not a technical one. <\/p>\n\n\n\n

What board decisions determine the pace<\/h3>\n\n\n\n

Three decisions actually condition the progress of work, and none of them can be made at a lower level. The first is the level of risk that the organization accepts\u2014without it, risk analysis ends with a list of threats without a conclusion. The second is the financial and human resources assigned to tasks, along with a determination of what the organization does independently and what it entrusts to a security service provider. The third concerns suppliers. Supply chain oversight requires changes in contracts and in the procurement process, and these go beyond the competence of the IT department. <\/p>\n\n\n\n

\n

A separate element not worth closing at this stage is long-term hardware commitments related to provisions on high-risk suppliers. The President signed the amendment and referred to the Constitutional Tribunal a motion concerning the provisions on designating a supplier as a high-risk supplier, the effects of such a decision and its review by the administrative court (case K 19\/26). The motion did not suspend the Act’s validity, but this fragment of regulation may change. As of September 27, 2026, no hearing had been held and no ruling issued in the case. <\/p>\n<\/div>\n\n\n\n

Checklist of initial decisions<\/h2>\n\n\n\n

Things to check off before the first budget decision.<\/p>\n\n\n\n

\n