Obligations not translated into work and budget
A company may have obligations under the KSC Act and the NIS2 Directive, and nobody says what this changes for its work and budget.
KSC and NIS2
We check which obligations under the Polish National Cybersecurity System Act (KSC) and the NIS2 Directive apply to your company, and put them into practice in documents, the system and contracts.
Scopes
Scopes of this service
-
Impact and gap analysis for KSC and NIS2
A written answer on whether the Polish National Cybersecurity System Act (KSC) covers your company, what obligations and deadlines follow from it, what is missing and in what order to fill the gaps.
See the scope -
Policies, procedures and entity registration
The documents required by the Polish National Cybersecurity System Act (KSC), written with the people who will use them, and an application for entry in the register of entities ready to sign.
See the scope -
Technical measures in an IT project
KSC and NIS2 requirements written into the scope and acceptance of the system you are building or ordering, with evidence for the audit gathered during the project.
See the scope -
Supplier contracts
A list of the suppliers your company's operations depend on, an assessment of each of them, and requirements for contracts and requests for proposal that match the obligations under the Polish National Cybersecurity System Act (KSC).
See the scope
Situations
What clients come to us with
Rules in documents, decisions in the system
The rules are written down in internal regulations, while the process they cover runs in a system that knows nothing about them. During an inspection someone reconstructs by hand who made a decision and why.
A new system must meet the requirements from launch
You are building a system whose output affects decisions covered by legislation, for example on a patient's treatment. Requirements added after launch mean rebuilding a working system with another budget.
Scope
What we do
Impact and gap analysis
We check which KSC and NIS2 obligations apply to your company and which you do not meet today. The result is a gap report with a list of actions.
Policies, procedures and incident handling
We write information security policies and procedures, including the incident reporting path, together with the people who will apply them. The result is a full set of documents for adoption by the management board.
Requirements built into the system
We carry the requirements from the policies into the system we are building or modernising: access control, event log, backups. The result is a system whose event log serves as evidence during an inspection.
Review of supplier contracts
We review your supplier contracts and check whether they allow you to meet your KSC and NIS2 obligations. The result is a list of clauses to change, with the reasons.
Technologies and standards: The KSC Act, the NIS2 Directive, SZBI (ISMS); access control, event log, backups.
Outcome
What you get
- A gap report with a list of actions
- Information security policies and procedures for adoption by the management board
- A system with an event log as evidence
- A list of changes to supplier contracts
Process
How the work proceeds
We establish what applies to you
We compare your business profile, systems and suppliers with the KSC and NIS2 obligations. Result: a gap report with a list of actions.
We write the documents with the people who use them
Policies, procedures and the division of roles are drawn up together with the departments they concern. Result: a full set of documents with a division of roles.
We carry the requirements into the system and the contracts
We implement the safeguards in the system, hand you the contract changes to negotiate with your suppliers and collect the evidence of compliance in one place. Result: the system, contracts and evidence ready for audit.
Services
Related services
- Technology advisoryAn analysis of the process and the systems that support it, ending with a recommendation: reorganise the process, connect the systems or build a new one. Also when the conclusion is ‘do not build yet’.
- Systems and integrationsA new system built around your process, connecting the systems already in use, or modernising the core the company has run on for years. With maintenance after implementation.
- Team and maintenanceWhen you are short of people, or of someone to take responsibility for a system: we strengthen your team for the duration of a project, or take over maintenance and hand the knowledge over at the end.
Book a meeting
Book a conversation about the problem
You describe the process or system that no longer keeps up and what has to change. The conversation costs nothing.
Phone: +48 455 406 404
Regulations
Regulations and scope limits
Obligations under the KSC Act and the NIS2 Directive cover entity registration, policies and procedures, supplier contracts and incident handling. Whether and from when they apply to you depends on the sector and the state of the law. One team handles both the legal side and the system; legal opinions are issued by the law firm we work with. Your company's data can stay in the European Union.
What we don't do
- SOC, that is, round-the-clock security monitoring.
- Penetration testing, that is, controlled attempts to break in; we tell you when it is needed.
Work
Team experience in this area
Situation
A client in the healthcare sector was building an AI platform to support treatment. Software that affects treatment is a medical device, and obligations towards the regulator continue after it enters the market.
What the team did
Our team built the platform as a medical device under FDA, CE and MDR: regulators' requirements were part of the system's scope. We build KSC and NIS2 obligations into systems the same way.
Outcome
FDA, CE and MDR requirements were met during the build, not added afterwards.
How we start
A conversation about the problem
You describe the process or system that no longer keeps up and what has to change. The conversation costs nothing.
Analysis under an NDA
We examine the process and the systems and hand over a recommendation with a scope of work. You know the scope, deadline and price of the analysis before it starts.
Offer
You receive the scope, team, schedule and price of the implementation. You decide whether we go ahead.
The cost of the analysis is credited towards the implementation if you order it.
Phone: +48 455 406 404 E-mail: contact@aliaxit.com