Impact and gap analysis for KSC and NIS2

An impact analysis establishes which rules apply to your company and what they change in how it works; a gap analysis compares those requirements with what the company has.

Since 3 April 2026, an amendment to the KSC act has been in force that transposes NIS2, EU Directive 2022/2555 on cybersecurity, into Polish law (legal position as at 20 September 2026). An essential entity is a company in a sector listed in Annex 1 to the act that is larger than a medium-sized enterprise. An important entity is a company in Annex 1 that is the size of a medium-sized enterprise, or a company in Annex 2 that is medium-sized or larger. Annex 1 lists, among others, transport, banking, healthcare, water and waste water, and digital infrastructure. Annex 2 lists, among others, manufacturing in selected subsectors, food, chemicals, waste and digital services. The medium-sized enterprise threshold: fewer than 250 employees and turnover of up to EUR 50 million or a balance sheet total of up to EUR 43 million, counted together with linked and partner enterprises. A small enterprise (fewer than 50 employees, turnover or balance sheet total of up to EUR 10 million) is outside the scope of the act, with exceptions set out in it. Members of our team have legal training; where the classification is disputed, a legal opinion is issued by a law firm.

A company that met the conditions of the act on 3 April 2026 has until 3 October 2026 to apply for entry in the register. It must implement the obligations under the act, including an information security management system, by 3 April 2027; a company that meets the conditions later has six months to apply and twelve to meet the obligations. An essential entity must complete its first audit by 3 April 2028, and further audits at least once every 3 years. The regulator can impose the first penalties after 3 April 2028. The application for entry, policies, safeguards in the system and supplier contracts are separate scopes; the analysis tells you which of them are needed and when.

Next comes a review of what the company has: policies, safeguards, supplier contracts, and the people responsible for access, backups and reporting failures. We take the requirements from the list of risk management measures in the directive and in the act. Among them: risk analysis, incident handling, business continuity, the supply chain (meaning IT suppliers), security in the acquisition and development of systems, training, encryption and access control.

Each gap gets three descriptions: what is missing against the specific provision, how serious it is (the deadline and what is at stake: a penalty, downtime, liability of the head of the company) and how much work it takes to close. We describe the work on three levels, without hours: a correction to a document, a setting in a running system, or a separate project. The order: rules first, then the safeguards that are meant to enforce them.

1. We establish the status. We check data on activities, headcount, turnover and links with other companies against the conditions of the act and its annexes. Result: a written classification with the date of the legal position.
2. We talk to people and read documents. The people responsible for IT, contracts, HR and finance show us how access, backups, failure reporting and contracts work. Result: a review marking what is backed by evidence.
3. We set the requirements against the review. Each measure gets a status: in place with evidence, in place without evidence, missing. Result: a list of gaps with severity and order.
4. We present the report to the board. We agree which gaps will be closed by our other scopes, which by another contractor and which by your team. Result: a plan with responsibilities assigned.