NIS2: who it covers, the penalties, and where to start

Context

Cybersecurity stops being an IT project

The 2016 NIS Directive set a minimum and left implementation to member states. NIS2 tightens the requirements, harmonizes them, and covers far more organizations. The rules now apply not only to IT specialists: senior managers, information security officers, and operations and finance departments are jointly responsible for cybersecurity.

More sectors, split into essential and important entities
Higher penalties and a bigger role for regulatory oversight
Management accountability for compliance
More reporting obligations toward national authorities
Mandatory security measures, implemented and documented on an ongoing basis

NIS 2016 vs. NIS2

Since 2023

Scope of entities

NIS: selected critical-infrastructure sectors

18 sectors

Penalties

NIS: set nationally, fragmented

up to €10M

Accountability

NIS: in practice, the IT department

board personally

Incident reporting

NIS: deadlines varied by country

24 h / 72 h / 1 month

Supervision

NIS: mostly after the fact

reactive and proactive

Center of gravity risk management

Sectors covered by NIS2

18 sectors

Essential entities

EnergyTransportBankingFinancial market infrastructureHealthcareDrinking waterWastewaterDigital infrastructureICT service managementSpace Selected public entities

Important entities

Postal and courier servicesWaste managementChemicalsFoodManufacturingDigital service providersScientific researchNuclear energy investmentsRegional public entities

18 sectors — 11 essential and 7 important, per the split in the NIS2 Directive. Poland's Annexes 1 and 2 to the KSC Act split things somewhat differently — the annex text governs, not the count. For financial entities the DORA Regulation applies as the more specific regime and displaces a large part of the KSC obligations.

Scope

Sector and size decide, but not only them

Classification as an essential or important entity depends on the sector of activity and the size of the company. PKD and NACE codes are only auxiliary — what governs is the actual scope of activity and services provided, as well as any licenses, permits, and entries in regulated-activity registers.

Essential entity — a large company under Annex 1: at least 250 employees, or annual turnover above €50M together with a balance sheet total above €43M
Important entity — a medium-sized company under Annex 1 (50–249 employees), plus medium- and large-sized companies under Annex 2. A large company in an important sector is an important entity, not an essential one
Regardless of size — essential entities also include DNS providers, TLD registries, domain name registration service providers, qualified trust service providers, critical entities, public entities under Annex 1, nuclear facility operators, and entities designated as such by the authority
By type of activity — a managed security service provider (MSSP) is an essential entity already from the size of a small or medium-sized enterprise; an electronic communications undertaking is essential from the size of a medium-sized enterprise, and is an important entity as a micro or small enterprise; a non-qualified trust service provider is an important entity as a micro, small, or medium-sized enterprise
The single-enterprise rule — under EU Regulation 651/2014, the size threshold aggregates the headcount and financial figures of linked and partner enterprises (ownership above 25%)

Size criteria

SME classification

Medium-sized enterprise

up to 250 FTEs

€50M turnover · €43M balance sheet

Small enterprise

up to 50 FTEs

€10M turnover · €10M balance sheet

Micro-enterprise

up to 10 FTEs

€2M turnover · €2M balance sheet

A company falls into a given class when it meets the headcount criterion plus one of the two financial indicators. Growing past the threshold can mean becoming subject to NIS2.

Supply chain

Often overlooked

Why it also affects suppliers

NIS2 covers the security of covered entities' supply chains Companies whose customers include essential or important entities must meet those customers' security requirements Requirements also cover the secure procurement, maintenance, and operation of IT systems Every organization's leadership should carry out an impact analysis of the directive on the business

It's estimated the new rules will affect over 100,000 additional companies in Europe, largely through requirements imposed on suppliers.

Mandatory actions

Two reporting obligations you can't put off

The first is entry in the list of essential and important entities, maintained by the competent cybersecurity authorities in the S46 system. The second is reporting security incidents to the relevant sector CSIRT, within strictly defined deadlines.

List of entities

6 months

Authority in Poland: competent authorities (S46 system)
Registration deadline: 6 months from meeting the criteria
Data changes: 14 days
Missing or late entry: possible entry ex officio

The list is maintained by the competent cybersecurity authorities in the S46 system — for a given sector, e.g. the minister responsible for energy for the energy sector. The Minister of Digital Affairs is responsible for the system and makes some entries ex officio. Companies that met the criteria on 3 April 2026 have until 3 October 2026 to register.

Information to be reported

Company name, legal form, and company register (KRS) number Address and contact details, including email and phone Company IP address ranges Relevant sector or subsector of activity List of EU member states where the company operates

Incident reporting

Deadlines in Poland

24 hoursEarly warning

A report to the relevant sector CSIRT indicating whether the incident may have resulted from intentional action, such as a cyberattack, and whether it affects other EU member states.

72 hoursIncident report

A report to the sector CSIRT: description of the impact on service provision, causes, course of events, likely effects, and preventive action taken.

On requestInterim report

An update on remediation status, at the request of the relevant sector CSIRT.

1 monthFinal report

A final report within one month of the report. If handling the incident is still ongoing, an interim progress report is due within this period, and the final report — within one month of the handling being completed.

CustomersDuty to inform

Reporting to the CSIRT does not exhaust the obligation. You must also inform the recipients of your services if the incident may affect the services they use, and, in the case of a serious cyber threat, tell them about the protective measures they can take.

Exception: trust service providers must report an incident within 24 hours of detection, without the early-warning/report split.

Risk management

Areas you need to implement and document

Below are the risk-management measures from Article 21 of the NIS2 Directive. Under Polish law they correspond to the information security management system areas set out in Article 8 of the KSC Act — what's assessed during a control is compliance with the Act. Essential and important entities must implement an ISMS and connect to the S46 system within 12 months, i.e. by 3 April 2027. Essential entities also undergo a first security audit by 3 April 2028 (24 months), with the audit report sent to the authority within 3 working days of receiving it.

Policies

Guidelines on risk management and information security, adopted and maintained across the organization.

Incident management

The ability to prevent, detect, and resolve incidents, with clearly assigned roles.

Business continuity

Backups, disaster recovery, and crisis management, tested in practice.

Supply chain

Measures securing procurement processes as well as the maintenance and operation of IT and network systems.

Effectiveness assessment

Specifications for assessing cyber risk and checking that implemented measures actually work.

Training

Regular cybersecurity training for management and staff, not just the IT department.

Cryptography

Concepts and procedures for using cryptography and encryption across all key areas.

Personnel and access

Protection of employees' personal data, access-control concepts, and monitoring of network activity.

Asset management

Alignment of policies, procedures, methods, and tools with an information security management system (ISO 27001).

Authentication

Multi-factor authentication (MFA) and single sign-on (SSO) for system access.

Communication

Security measures for voice, video, and text communication.

Crisis response

Secure emergency communication systems, ready for use during a serious incident.

KTBnet support

A large part of the requirements can be automated

There's no single tool that satisfies every NIS2 requirement. Most companies, however, already use IT security solutions that help achieve compliance: from access control and network monitoring to unified endpoint management. Automating routine tasks matters most where infrastructure is complex and specialists are in short supply.

Inventory of hardware and software as the basis of risk analysis
Vulnerability management and patching across the whole environment
Access control and encryption for workstations and storage media
Monitoring and logging of activity needed to detect incidents
Documentation of security measures that the regulator expects

NIS2 requirement vs. action

Article 21

IT asset inventory

hardware, software, network and mobile devices

risk analysis

Vulnerability management

scanning, prioritization, patching

effectiveness of measures

Encryption and access control

disk encryption, software allowlists, MFA

cryptography

Backups and recovery

tested disaster-recovery procedures

business continuity

Monitoring and reporting

event logging, reporting system, incident workflow

incident management

Side effect of compliance less downtime

Action plan

Timing is critical

As EU member states roll out and update their national requirements, fast and careful planning, implementation, and regular review of cybersecurity measures are essential. The order below works well for organizations starting from scratch.

NIS2 compliance isn't just a legal obligation — it's an investment in the whole company's resilience
The risk includes administrative and financial sanctions, and even criminal liability for negligence
Effective solutions also improve the quality and reliability of day-to-day IT operations

Seven steps to compliance

Order

Step 1Self-identification

Check whether your company is an essential or important entity. No one will notify you — the obligation to classify and register lies with the company, and failing to do so is itself a violation. The registration deadline for companies meeting the criteria on 3 April 2026 is 3 October 2026.

Step 2Board

Explain to the board the consequences of non-compliance and the benefits of proactive implementation, including stronger cyber resilience and reputation.

Step 3Gap analysis

Identify where action is needed, and pinpoint IT automation solutions that free up your team's capacity.

Step 4Implementation project

Launch a dedicated project and factor it into budget and staffing plans so compliance is reached on time.

Step 5Registration and reporting

Set up processes for timely registration and prepare incident-reporting procedures. Test them so you can act quickly in an emergency.

Step 6Regulatory monitoring

Track current, planned, and new regulations, and continuously assess their impact on the company.

Step 7Training

Make training a priority. Training requirements apply to both management and staff, with details set by the relevant national authority.

Scale of the change

Three numbers worth showing your board

100,000+

Companies in the European Union covered by NIS2, per the European Commission's estimate.

18 sectors

Eleven essential sectors and seven important ones, per the split in the NIS2 Directive; Poland's annexes to the KSC Act split things somewhat differently.

10 million EUR

Maximum penalty for an essential entity, or 2% of revenue — whichever is higher, not less than 20,000 PLN.

Over 100,000 companies in Europe are covered by NIS2.
Check if yours is too.

Cybersecurity stops being an IT project

Sector and size decide, but not only them

Non-compliance is costly. Literally.

Two reporting obligations you can't put off

Areas you need to implement and document

Policies

Incident management

Business continuity

Supply chain

Effectiveness assessment

Training

Cryptography

Personnel and access

Asset management

Authentication

Communication

Crisis response

A large part of the requirements can be automated

Timing is critical

Three numbers worth showing your board

Let's work out together what NIS2 means for your company

Over 100,000 companies in Europe are covered by NIS2.Check if yours is too.

Cybersecurity stops being an IT project

Sector and size decide, but not only them

Non-compliance is costly. Literally.

Two reporting obligations you can't put off

Areas you need to implement and document

Policies

Incident management

Business continuity

Supply chain

Effectiveness assessment

Training

Cryptography

Personnel and access

Asset management

Authentication

Communication

Crisis response

A large part of the requirements can be automated

Timing is critical

Three numbers worth showing your board

Let's work out together what NIS2 means for your company

Over 100,000 companies in Europe are covered by NIS2.
Check if yours is too.