On 3 April 2026 Poland's amended National Cybersecurity System Act (KSC), which transposes the EU NIS2 Directive, came into force. It covers around 38,000 organisations, including thousands of medium-sized companies that until now thought of cybersecurity as antivirus software and a Wi-Fi password.
Over the past few months my clients have been asking me two kinds of question. The first: "Does this even apply to us?" The second, usually after a customer has sent over a 40-question security questionnaire: "What on earth do we tell them?" This article answers both, without legal jargon, from the point of view of someone who actually puts these safeguards in place.
Disclaimer: this is written by an IT practitioner, not a lawyer. If you sit close to the thresholds or operate in a regulated sector, have your classification checked by legal counsel.
Who Does NIS2 Apply To in 2026?
The biggest change compared with the old law: whether you are covered depends mainly on what you do and how big you are, not on a decision by a regulator. Companies have to assess themselves.
Criterion 1: sector
NIS2 covers 18 sectors split into two groups:
- Essential sectors — including energy, transport, banking, healthcare, water, digital infrastructure, ICT service management (e.g. managed IT service providers) and public administration.
- Important sectors — including postal and courier services, waste management, manufacture and distribution of chemicals, food production and distribution, manufacturing (medical devices, electronics, machinery, vehicles) and digital providers (online marketplaces, search engines, social networks).
Criterion 2: size
As a rule the law applies to medium and large enterprises in those sectors:
| Company category | Employees | Annual turnover or balance sheet |
|---|---|---|
| Micro | under 10 | up to €2m |
| Small | 10–49 | up to €10m |
| Medium | 50–249 | up to €50m turnover / €43m balance sheet |
| Large | 250+ | above the medium thresholds |
Micro and small firms are generally exempt, with exceptions. Regardless of size, the rules cover trust service providers, domain name registries, DNS providers and organisations the state designates as critical.
Criterion 3 (unofficial): the supply chain
This is the point small businesses most often miss. Even if your 15-person company is outside NIS2, your customer may well be inside it, and the law requires them to manage supply-chain risk.
In practice that means:
- the hospital you work with will send you a security questionnaire,
- the manufacturer you provide IT support for will add incident-reporting and MFA clauses to your contract,
- the logistics firm you supply software to will ask about backups and password policy.
Having no credible answers will not get you fined by the state. It will do something more painful: lose you the contract to a competitor who does have the answers.
Deadlines — What and When
The timetable under the new Polish law looks like this:
| Deadline | Obligation |
|---|---|
| 3 April 2026 | amended KSC Act comes into force |
| around October 2026 (6 months) | self-identification and entry on the register of essential and important entities |
| around April 2027 (12 months) | information security management system in place |
| around April 2028 (24 months) | first audit (essential entities) |
If your company may be covered and you have not done the self-assessment yet, this is quite literally the last moment. Registration is a simple formal step, but without it every subsequent obligation starts from a position of arrears.
Penalties — What It Really Costs
NIS2 sanctions are high and meant to hurt:
- essential entities — up to €10m or 2% of global turnover, whichever is higher,
- important entities — up to €7m or 1.4% of turnover,
- personal liability for management — the board is responsible for overseeing cybersecurity and can be penalised individually.
I do not expect the first mid-sized manufacturer in Wielkopolska to receive a multi-million-euro fine. But a ransomware incident that reveals the company had no offline backups and no MFA on email is a very realistic trigger for proceedings, to say nothing of the cost of downtime.
What Exactly Has to Be Implemented?
The law talks about "appropriate and proportionate technical and organisational measures". Below I translate that into the concrete steps I implement for clients.
1. Asset inventory and risk analysis
You cannot protect what you do not know exists. Step one is a list of:
- every device (laptops, servers, printers, cameras, routers),
- cloud services (Microsoft 365, Google Workspace, CRM, online accounting),
- accounts with administrator privileges,
- data whose loss would bring the business to a halt.
In a 30-person company this typically takes 2–3 working days. There are almost always surprises: a former employee's account with access to the managing director's mailbox, a 2016 NAS that has never been updated, or a router still on its default password.
2. Multi-factor authentication (MFA)
The best return on investment in the whole project. Turning on MFA for email and remote access eliminates a huge share of attacks based on stolen passwords. In Microsoft 365 and Google Workspace it is included in the licence — you only pay for the implementation time.
3. Backups following the 3-2-1 rule
Three copies of your data, on two different types of media, one off-site, and at least one immutable or offline. Ransomware in 2026 deliberately hunts for and encrypts network-attached backups. Regular restore tests matter just as much: a backup nobody has ever tried to restore is merely a hope.
4. Patching and vulnerability management
Automatic updates for operating systems and applications, plus a monthly review of network devices. Microsoft Intune or a similar MDM tool helps here: one dashboard shows you which laptop has not received a patch in three months.
5. Incident response procedure
NIS2 requires fast reporting of significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Without a written procedure nobody in the company will know who calls whom at 2 a.m. on a Saturday.
A 2–3 page document is enough: who decides, who gets notified, where the CSIRT contact details are, and how to isolate an infected computer from the network.
6. Staff training
Phishing is still the front door for most attacks. A one-hour session every quarter plus a simulated phishing campaign produces measurable results: by the third round the click rate usually drops several-fold.
7. Supplier security
If your customers are asking you, you need to ask your own suppliers too. Keep a list of IT suppliers with a risk rating and basic contractual requirements (confidentiality, incident reporting, data location).
How Much Does NIS2 Compliance Cost for a Medium-Sized Company?
Indicative ranges for a 50–100 person company starting from an average baseline (antivirus and some sort of backup, no documentation):
| Item | One-off cost | Monthly cost |
|---|---|---|
| Audit and risk analysis | £1,300 – £3,300 | — |
| MFA, policies, Intune rollout | £1,100 – £2,600 | M365 Business Premium licences approx. £22/user |
| 3-2-1 backup with an immutable copy | £650 – £2,200 | £65 – £330 |
| Documentation (policies, incident procedure) | £1,100 – £3,300 | — |
| Training and phishing simulations | £450 – £1,100 | £45 – £175 |
| Monitoring and IT support | — | £330 – £1,100 |
In total: roughly £4,500–£13,000 one-off plus several hundred to around a thousand pounds a month. For comparison, the average downtime after a ransomware attack runs from several days to several weeks, and rebuilding an environment without backups can cost several times the entire table above.
For a small company outside NIS2 that simply wants to answer a customer's questionnaire properly, the scope is narrower: MFA, backups, patching, a short security policy and an incident procedure. That is usually £1,100–£3,300 one-off.
The Most Common Mistakes I See
- "We'll buy an expensive firewall and be done with it" — hardware without configuration, monitoring and procedures is just expensive decoration.
- Documentation written for the auditor, not for reality — a template policy nobody in the company has read will not help during an incident.
- Administrator = owner — the managing director holding global admin rights in M365 and using them for everyday work.
- Never testing a backup restore — the copy exists, but nobody knows how long restoring a server takes or whether it works at all.
- Putting it off until the audit — with current demand for security specialists, waiting until 2027 means higher rates and longer queues.
A 30-Day Plan
If you are reading this and do not know where to start:
- Week 1 — self-assessment: sector, size, and a list of key customers covered by NIS2.
- Week 2 — inventory of devices, accounts and cloud services.
- Week 3 — MFA on every account and a check of backups (including a restore test).
- Week 4 — incident response procedure and a costed plan for the next steps.
These four steps will not make you fully NIS2-compliant, but they remove around 80% of the real risk and give you concrete answers for customer questionnaires.
Summary
NIS2 is not another GDPR that can be "ticked off" with a single document. It requires genuine IT security management, with board-level accountability and deadlines that are already running. The good news: most of the requirements are sensible practices that protect the business from ransomware, data leaks and downtime anyway.
I help companies in Poznań and across Poland work through this process in practice — from inventory and Microsoft 365 or Google Workspace configuration, through backups and MFA, to procedures your staff actually understand. Book a free 30-minute consultation and we will work out whether NIS2 applies to you and which three actions will make the biggest difference in your first month.