Policies, procedures and entity registration

The act requires essential and important entities to have an information security management system (ISMS). For you, that means written rules and roles that say who is responsible for what, so that data and systems run securely, plus evidence that the rules are followed. We write it in Polish, for existing positions, at a length that can be read in full. A company that was already an essential or important entity on 3 April 2026 implements these obligations by 3 April 2027; a company covered later has twelve months to do so.

Policies are the company's decisions in the areas named in the act and the directive. Access: who grants and withdraws permissions, and who checks it. Backups: what is backed up, where the backup is kept and how often you test restoring it. Business continuity: what you do when the main system stops. The safeguards that enforce these rules in the system, and the provisions for suppliers, are separate scopes: technical measures in an IT project, and supplier contracts.

An incident is an event that threatens information security or the operation of a system, for example a break-in or a data leak. The procedure says who recognises the event, who assesses whether it is significant, who reports it externally and who informs the board; each step has a person, a deputy and a time limit in hours. The act sets three deadlines towards the sectoral CSIRT, the incident response team responsible for your sector. Early warning: no later than 24 hours after detecting a significant incident. Notification: no later than within 72 hours. Final report: no later than one month after the notification. Under the directive, a significant incident is one that causes or may cause severe disruption of services, financial loss or considerable damage to other persons.

The register of essential and important entities is a list of the companies and institutions covered by the act, kept by the competent authority for each sector. We prepare the application for entry with a written justification on which the head of the company bases their statement. The deadlines in the act:

• a company already covered by the act on 3 April 2026 submits the application no later than 3 October 2026;
• a company that meets the conditions later has six months from that day; changes to the data must be reported within 14 days;
• entry takes effect when the application is submitted, and if no application is submitted on time, the authority may enter the company itself.

We train the people who hold roles in the procedure using examples from their own work. The act requires the head of the entity to complete training once every calendar year, and the directive encourages training for employees. We set the review of policies and procedures as a rule: at a fixed time and after every significant incident, with a person responsible. Members of the team have legal training; if the justification for the application needs a legal opinion, it is issued by a law firm.

1. We check what the company already has: regulations and instructions. Result: a list of documents to write, correct and withdraw, in order of the deadlines in the act.
2. We write with the people who will carry it out. We go through every policy and procedure with the department it concerns and test it against situations from the past year. Result: a full set of documents for approval by the board.
3. We put the procedures and the application into use. The head of the company receives the application to sign, the people in the roles complete training, we test the incident procedure on a mock event, and the reviews go into the calendar. Result: the application submitted, the procedures in use, the documents in the care of a named person.