Does NIS2 affect only large organizations?

No. Qualification depends not only on size, but also on sector, role, service criticality and ICT supply chain exposure.

Can POLEGIS help assign executive accountability?

Yes. We translate NIS2 requirements into decision roles, oversight mechanisms, risk acceptance and reporting paths.

Does the outcome include supplier requirements?

Yes. The service includes supplier assessment criteria, contract expectations and evidence of oversight over external dependencies.

NIS2 KSC DORA RODO ISO NIST

NIS2

NIS2: from directive requirements to real accountability

NIS2 has applied at EU level since 18 October 2024 and in Poland is implemented through the amended KSC framework. It is no longer only an IT topic: boards, process owners and ICT supplier relationships are directly in scope.

Discuss NIS2 See the KSC page

NIS2 moves cyber to the executive layer How the POLEGIS delivery model works What the organization receives Frequently asked questions

NIS2 moves cyber to the executive layer

NIS2 requires cybersecurity to be governed as part of the enterprise operating model. That means executive accountability for decisions, risk acceptance, incident oversight and the ability to demonstrate action.

Board and process-owner accountability model.
Risk management, continuity and service resilience.
Incident reporting and ICT supplier control.

How the POLEGIS delivery model works

Identify scope, services, processes and external dependencies.
Map NIS2 requirements into procedures, roles, metrics and evidence.
Build an implementation plan for governance, risk, incidents, continuity and supplier clauses.
Support operational rollout and control readiness.

What the organization receives

A decision on what is already covered and what remains a regulatory gap.
A single work model for board, compliance, IT and security.
Evidence of action: registers, reports, decisions and test confirmations.
A coherent bridge from NIS2 into KSC and ongoing governance maintenance.

Frequently asked questions

Can NIS2 be handled with a policy document alone?
No. Documentation without assigned roles, metrics, tests and evidence does not create real readiness.

Does the service also cover OT and continuity?
Yes. We assess both IT and operational services together with dependencies affecting resilience.

Should NIS2 and KSC be implemented separately?
No. In Poland these requirements should be designed together to avoid duplication and inconsistency.

Contact

Send us a message

Use the form below to contact POLEGIS. You can provide e-mail, phone, or both.

Scope: KSC, NIS2, DORA, GDPR, digital resilience

Mode: consultation, implementation, audit readiness

Support: SME, public sector, critical and essential entities

Nombre y apellidos *

Empresa

E-mail

Teléfono

Mensaje *

Este formulario se utiliza para gestionar consultas comerciales sobre servicios POLEGIS. Describa el caso y proporcione al menos un canal de contacto.

Si proporciona una dirección de e-mail o número de teléfono, active el consentimiento para el canal de comunicación correspondiente.

Confirmo que el formulario se refiere a una consulta comercial y que los datos de contacto enviados son correctos. Confirmo que he leído el aviso de tratamiento de datos personales relacionado con la gestión de esta consulta. Acepto ser contactado electrónicamente en la dirección de e-mail proporcionada. Acepto ser contactado por teléfono en el número proporcionado.

Aviso de tratamiento de datos

El responsable del tratamiento es POLEGIS Sp. z o.o., Milenijna 43 / 2, 03-130 Warszawa, Polska. Contacto sobre este formulario: biuro@polegis.pl.

Tratamos los datos para responder a la consulta, mantener correspondencia y preparar una oferta o conversación de trabajo.
La base legal son las medidas solicitadas por la persona que contacta y el interés legítimo del responsable en gestionar relaciones comerciales.
Conservamos los datos durante el caso y después durante el período necesario para asegurar posibles reclamaciones y demostrar el curso del contacto.
Tiene derecho de acceso, rectificación, supresión, limitación del tratamiento, oposición y reclamación ante la autoridad supervisora competente.