GRC · Specialist service
Poland’s National Cybersecurity System / NIS2: readiness and implementation
Cybersecurity obligations span governance, people, processes and technology. We help translate the requirements applicable to your organisation into a concrete implementation plan and evidence of operation.
Service scope
KSC/NIS2 readiness
We begin with the organisation’s activities, status and applicable National Cybersecurity System requirements, then assess organisational and technical gaps. We connect risk, incidents, resilience, suppliers and management preparation. The plan includes owners, dependencies, applicable deadlines and documentation. Legal status and entity scope are confirmed as of the assessment date; we do not apply one set of obligations to every organisation.
Classification and requirements mapping
We analyse activities and information needed to establish obligations. Interpretative questions are referred for agreement with the customer’s legal advisers.
Readiness assessment
We review risk management, incident handling, continuity and supplier security, alongside management roles and the awareness programme.
Planning and implementation
We turn gaps into organisational and technical tasks, supporting documentation, ownership and integration with SOC and S&VM work.
Evidence and reviews
We define records demonstrating fulfilment, agree registers and progress reviews, and update the programme after changes.
Project deliverables
What will your team receive?
- A requirements map and assumptions supporting entity classification.
- A gap report and prioritised alignment plan.
- Agreed documentation and a responsibility matrix.
- An evidence-collection and progress-monitoring plan.
Delivery conditions
What do we agree before starting?
- Information about organisational activities, size and structure.
- Access to documentation, responsible people and control evidence.
- A programme owner and cooperation with legal advisers on classification.
How we work
From understanding the need to verifying the result.
We establish obligations
We confirm classification assumptions and current requirements, then agree the assessment scope and responsibilities.
We assess and plan
We collect evidence, identify gaps and prioritise actions, creating a plan that accounts for dependencies between teams.
We support implementation
We help implement agreed processes and document progress, reviewing evidence completeness and open risks.
Clear responsibilities
What is already included, and what do we extend?
SOC/NOC and Enterprise support monitoring, response and action documentation. Comprehensive assessment and implementation of National Cybersecurity System/NIS2 requirements form a separate GRC programme. Purchasing a plan alone does not confirm organisational compliance.
Reference points: The NIS2 Directive · Poland’s National Cybersecurity System. Requirements and their applicability are established for the individual organisation.
Before making a decision
Questions about National Cybersecurity System/NIS2 readiness
Does the same National Cybersecurity System scope apply to every company?
No. Obligations depend on entity classification and applicable legislation. We therefore start by analysing activities and confirming assumptions.
Does implementing SOC fulfil NIS2?
No. SOC supports some operational obligations, but requirements also cover risk management, continuity, suppliers, training and other appropriate measures.
Will we receive a guarantee of compliance or freedom from sanctions?
No. You receive assessment and implementation support within a defined scope. Fulfilling obligations also requires management decisions and maintaining processes after the project.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.