NIS2 and cybersecurity: who has obligations and what they are

The NIS2 Directive (the EU directive on the cybersecurity of networks and information systems) is the biggest extension of EU cybersecurity regulation since 2016. Poland implemented NIS2 by an Act of 23 January 2026 amending the Act on the national cybersecurity system and certain other acts (Journal of Laws 2026, item 252), which came into force on 3 April 2026. For thousands of medium-sized and large companies this means completely new obligations, from a security policy to reporting incidents within 24 hours.

This article explains which companies NIS2 applies to, which technical requirements have to be put in place and how to prepare for an audit in practice. Legal position as at 22 October 2026.

Who is subject to the obligations

NIS2 divides entities into two categories:

Essential entities

Large companies (more than 250 employees or revenue of more than EUR 50 million) from critical sectors:

1. Energy: power stations, transmission networks, filling stations
2. Transport: airports, ports, railways, roads
3. Banking and finance: banks, fintech (already covered by DORA)
4. Health: hospitals, laboratories, medicine producers
5. Drinking water: waterworks, treatment plants
6. Waste water
7. Digital infrastructure: DNS, TLD, IXP, data centres, cloud
8. Public administration
9. Space
10. Management of B2B ICT services
11. Industry (key sectors under Annex I)

Important entities

Medium-sized companies (more than 50 employees or turnover of more than EUR 10 million) from 7 additional sectors:

• Postal and courier services
• Waste management
• Manufacture of chemicals
• Food processing
• Manufacture of medical devices and pharmaceuticals
• Motor vehicles, electronics and other manufacturing
• Providers of digital services (B2C marketplaces, search engines, social media)

Technical obligations: 10 areas

NIS2 sets out ten areas of minimum technical and organisational requirements. Every company covered by the Directive must put them in place:

1. Information security policy: a formal document, updated at least annually
2. Incident management: a procedure for detecting, responding to and reporting
3. Business continuity and crisis management: BCP/DRP plans, tests at least annually
4. Supply chain security: vetting of IT suppliers, security SLAs
5. System security: updates, patch management, configuration harmonisation
6. Assessment of the effectiveness of security measures: audits, pentests
7. Cryptographic practices: encryption of data in transit and at rest
8. Identity and access management: MFA, the principle of least privilege
9. Human resources security: vetting of employees, training
10. Security in projects and system development: DevSecOps, secure coding

Incident reporting: the 24/72/30 timeline

One of the most concrete NIS2 obligations is three-stage incident reporting:

| Stage | Deadline | Scope | |------|--------|--------| | Early warning | 24 hours from detection | Basic description, channels, initial impact | | Incident notification | 72 hours | Full assessment, cause, scale | | Final report | 1 month | Root cause analysis, remedial action |

A significant incident (one that must be reported) is one that:

• Causes serious disruption to the provision of a service
• Affects third parties
• Affects personal data (in which case GDPR also applies: 72h to the Personal Data Protection Office, UODO)
• Has a significant financial impact

Reports go to CSIRT NASK (for most sectors) or to dedicated sector CSIRTs (for example CSIRT KNF for the financial sector, KNF being the Polish Financial Supervision Authority).

Responsibility of the management board

NIS2 introduces personal responsibility of members of the management board for the company’s cybersecurity. The board must:

• Approve the security policy: a formal board resolution
• Oversee implementation: regular reports on the state of security
• Take part in training: in cybersecurity, at least annually
• Take decisions during incidents: ultimate responsibility

For failings in these areas, board members can be punished personally. The supervisory authority can impose a fine on them and, in extreme cases, a ban on holding management positions.

Registration with CSIRT NASK

Entities covered by NIS2 must register in the register kept by CSIRT NASK. Registration includes:

1. Notification of status: essential or important entity
2. Naming a contact person: responsible for cybersecurity
3. A description of the services provided: the scope of the activity covered by NIS2
4. Updating the data: within 14 days of changes

Failure to register, or out-of-date data, is already grounds for penalties. A key or important entity files an application for entry on the list within 6 months of the day it began to meet the conditions.

How to prepare: a checklist

For a company that is only starting to implement NIS2:

1. Eligibility analysis: is the company essential, important, or outside the scope
2. Audit of the current state: a gap analysis against the 10 technical areas
3. Risk mapping: identifying key assets and threats
4. Security policy: a formal document, approved by the board
5. Implementation plan: budget, schedule, people responsible
6. Registration with CSIRT NASK: if not yet done
7. Training for the board and key staff
8. External tests and audits: at least annually
9. Incident documentation: logs, procedures, escalation
10. Review of the supply chain: IT suppliers, external partners

Summary

NIS2 is not an IT project but a strategic change in the approach to operational risk. Companies that treat cybersecurity as “an IT matter” will have problems at audits. At Profais we work with clients and their IT and security departments on documenting procedures and analysing risks from an accounting and operational perspective. See our full accounting service. See also the articles on CSRD and the AI Act, related 2026 regulations.

Sources: ec.europa.eu/nis2, csirt.nask.pl, EU Directive 2022/2555, Act on the national cybersecurity system (amendment: Journal of Laws 2026, item 252).