{"id":12468,"date":"2026-09-01T10:03:55","date_gmt":"2026-09-01T08:03:55","guid":{"rendered":"https:\/\/prosteit.pl\/?p=12468"},"modified":"2026-09-01T10:04:01","modified_gmt":"2026-09-01T08:04:01","slug":"nis2-in-poland-who-does-it-apply-to-and-how-to-prepare-your-company","status":"publish","type":"post","link":"https:\/\/prosteit.pl\/en\/nis2-in-poland-who-does-it-apply-to-and-how-to-prepare-your-company\/","title":{"rendered":"NIS2 in Poland \u2013 who does it apply to and how to prepare your company?"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"12468\" class=\"elementor elementor-12468\" data-elementor-post-type=\"post\">\n\t\t\t\t<div data-particle_enable=\"false\" data-particle-mobile-disabled=\"false\" class=\"elementor-element elementor-element-5e6dd2d7 e-flex e-con-boxed e-con e-parent\" data-id=\"5e6dd2d7\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a64322f elementor-widget elementor-widget-heading\" data-id=\"a64322f\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"Wprowadzenie\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Introduction<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div data-particle_enable=\"false\" data-particle-mobile-disabled=\"false\" class=\"elementor-element elementor-element-4a2a224 e-flex e-con-boxed e-con e-parent\" data-id=\"4a2a224\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1175f83 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"1175f83\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div data-particle_enable=\"false\" data-particle-mobile-disabled=\"false\" class=\"elementor-element elementor-element-583c125 e-flex e-con-boxed e-con e-parent\" data-id=\"583c125\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b287eb3 elementor-widget elementor-widget-heading\" data-id=\"b287eb3\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NIS2 - what is it, who does it apply to and what does it mean for companies?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f886de elementor-widget elementor-widget-text-editor\" data-id=\"0f886de\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Cybersecurity increasingly directly impacts business operations. A ransomware attack, employee account takeover, server failure, or loss of access to an ERP system can disrupt a company&#039;s operations for hours or days.<\/p>\n<p>That is why the European Union introduced the directive <strong>NIS2<\/strong>, which aims to increase the level of cybersecurity of organizations that are of significant importance to the economy and society.<\/p>\n<p>In Poland, NIS2 requirements were implemented through amendments to the National Cybersecurity System Act. For some companies, this means new responsibilities not only related to securing IT infrastructure but also to risk management, incident response, and management accountability.<\/p>\n<p>In this article, we explain the most important information without going into technical details.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c032116 elementor-widget elementor-widget-heading\" data-id=\"c032116\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><a href=\"https:\/\/www.biznes.gov.pl\/pl\/portal\/005120\" target=\"_blank\" rel=\"noopener\">What is NIS2?<\/a><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a65324f elementor-widget elementor-widget-text-editor\" data-id=\"a65324f\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 is a European Union directive on the security of networks and information systems.<\/p>\n<p>Its main task is to increase the resilience of organizations to cyber threats and unify the basic principles of cybersecurity in European Union countries.<\/p>\n<p>However, this is not a guide specifying what firewall, antivirus program or server a company should purchase.<\/p>\n<p>NIS2 introduces primarily an approach based on <strong>risk management<\/strong>.<\/p>\n<p>A company should know:<\/p>\n<ul>\n<li>\u00a0\u2022 what systems and data are most important to him, \u2022 what threats may affect the business,<\/li>\n<li>\u2022 what security measures have been implemented,<\/li>\n<li>\u2022 who is responsible for cybersecurity,<\/li>\n<li>\u2022 how the company will respond to a serious incident,<\/li>\n<li>\u2022 how quickly she will be able to return to normal operation.<\/li>\n<\/ul>\n<p>Cybersecurity shouldn&#039;t be limited to the IT administrator. It&#039;s becoming part of enterprise-wide management.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bfcc899 elementor-widget elementor-widget-heading\" data-id=\"bfcc899\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why NIS2 is being implemented<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-043243b elementor-widget elementor-widget-text-editor\" data-id=\"043243b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The scale of cyber threats has increased significantly in recent years. Companies rely on email, ERP systems, cloud services, network infrastructure, business applications, and data access.<\/p>\n<p>A problem for one organization can simultaneously impact its customers, suppliers, or other businesses that use its services.<\/p>\n<p>Therefore, the aim of NIS2 is to increase the resilience not only of individual companies, but of entire sectors of the economy.<\/p>\n<p>NIS2 also aims to change the way we approach security. Companies shouldn&#039;t just react when a problem occurs. They should identify risks in advance, prepare safeguards, and know how to respond during an incident.<\/p>\n<p>The new regulations are intended to make organizations better prepared for, among other things:<\/p>\n<ul>\n<li>\u00a0\u2022 cyberattacks,<\/li>\n<li>\u00a0\u2022 ransomware,<\/li>\n<li>\u00a0\u2022 data leaks,<\/li>\n<li>\u00a0\u2022 takeover of user accounts,<\/li>\n<li>\u00a0\u2022 infrastructure failures,<\/li>\n<li>\u00a0\u2022 problems on the part of IT service providers.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d57e802 elementor-widget elementor-widget-heading\" data-id=\"d57e802\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Who does NIS2 apply to?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac7ded5 elementor-widget elementor-widget-text-editor\" data-id=\"ac7ded5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>One of the most common questions entrepreneurs ask is: <strong>does NIS2 apply to our company?<\/strong><\/p>\n<p>Not every company operating in Poland is automatically covered by the new requirements.<\/p>\n<p>The regulations distinguish, among others: <strong>key entities<\/strong> and <strong>important entities<\/strong>.<\/p>\n<p>Regulations may cover companies operating in areas such as energy, transport, healthcare, banking, digital infrastructure, telecommunications, selected IT services, manufacturing, the chemical and food sectors, and waste management.<\/p>\n<p>In practice, the list of activities is much more extensive. Therefore, a company shouldn&#039;t judge its status solely on its industry or number of employees. It&#039;s essential to verify the criteria set forth in the Polish Act on the National Cybersecurity System.<\/p>\n<p>The first step for a company should therefore be to determine, <strong>whether it is subject to NIS2 requirements<\/strong>. Only then can the scope of actions needed to adapt the organization be determined.<\/p>\n<p>The following are of primary importance:<\/p>\n<ul>\n<li>\u00a0\u2022 type of business activity,<\/li>\n<li>\u00a0\u2022 economic sector,<\/li>\n<li>\u00a0\u2022 size of the enterprise,<\/li>\n<li>\u00a0\u2022 the importance of the services provided.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55a29dc elementor-widget elementor-widget-heading\" data-id=\"55a29dc\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What must a company covered by NIS2 meet?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e162ea0 elementor-widget elementor-widget-image\" data-id=\"e162ea0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00-1024x683.png\" class=\"attachment-large size-large wp-image-12473\" alt=\"What must a company fulfill?\" srcset=\"https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00-1024x683.png 1024w, https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00-300x200.png 300w, https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00-768x512.png 768w, https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00-18x12.png 18w, https:\/\/prosteit.pl\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-14-sie-2026-10_52_00.png 1536w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f624695 elementor-widget elementor-widget-text-editor\" data-id=\"f624695\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 does not require one specific product or a single IT solution.<\/p>\n<p>A company subject to regulations must, above all, properly manage cybersecurity. In practice, this means streamlining several fundamental areas.<\/p>\n<p><strong>Risk management: <\/strong>An organization should know what threats may impact its systems, data and business continuity.<\/p>\n<p><strong>Securing IT infrastructure: <\/strong>Computers, servers, networks, user accounts and systems used should have appropriate security measures.<\/p>\n<p><strong>Backups and business continuity: <\/strong>A company should be prepared for a situation in which it loses access to data or one of its most important systems.<\/p>\n<p><strong>Incident response: <\/strong>It is necessary to define what should be done in the event of a cyberattack, who is responsible for the response and how the incident should be handled.<\/p>\n<p><strong>Supplier Security: <\/strong>The security of external companies with access to the company&#039;s infrastructure, systems or data is also important.<\/p>\n<p><strong>Employee training: <\/strong>Even well-secured infrastructure can be attacked by user error. Therefore, employees should know, among other things, how to recognize phishing and other common threats.<\/p>\n<p>The NIS2 requirements therefore cover both <strong>technology, procedures and people<\/strong>.<\/p>\n<p>This doesn&#039;t mean, however, that every company needs to completely rebuild its infrastructure. Some companies already have many of the necessary solutions, but they aren&#039;t properly organized, documented, or monitored.<\/p>\n<p>Therefore, it is worth starting preparations by checking the current environment and identifying the actual deficiencies.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ece24a5 elementor-widget elementor-widget-heading\" data-id=\"ece24a5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to start preparing your company for NIS2?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d97a81d elementor-widget elementor-widget-text-editor\" data-id=\"d97a81d\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Your first step should not be purchasing new security systems.<\/p>\n<p>First, two basic questions must be answered: <strong>Is our company subject to NIS2?<\/strong> If so: what is the current level of security and what are we missing?<\/p>\n<p>Only on this basis can a plan for further action be prepared.<\/p>\n<p>In practice, it may include, among other things, a review of infrastructure, user accounts, backups, network security, cloud services, procedures and vendors with access to company systems.<\/p>\n<p>In such projects, we can help analyze the existing IT environment and prioritize areas requiring change. However, it&#039;s crucial that the security measures implemented are based on the company&#039;s actual needs, not on a pre-defined list of products assigned to the &quot;NIS2&quot; umbrella.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c36adb0 elementor-widget elementor-widget-heading\" data-id=\"c36adb0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><a href=\"https:\/\/prosteit.pl\/en\/artyku\u0142y\/\">NIS2 - what is worth remembering?<\/a><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c9ee361 elementor-widget elementor-widget-text-editor\" data-id=\"c9ee361\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20180001560\" data-wplink-edit=\"true\" target=\"_blank\" rel=\"noopener\">NIS2 is primarily intended to increase the resilience of companies and institutions to cyber threats.<\/a><\/p><p>For businesses, this means a more structured approach to security \u2013 from infrastructure protection, through backups and access management, to incident response procedures and employee training.<\/p><p>The most important first step is <strong>checking whether a given company is subject to new regulations<\/strong>.<\/p><p>If so, the next step should be to determine the current level of security and prepare a plan to adapt the organization.<\/p><p>However, NIS2 is a very broad topic. Risk analysis, ISMS, cybersecurity auditing, incident reporting, and specific technical security measures require separate discussion.<\/p><p>Therefore, in the following articles we will explain in detail the individual elements of preparing your company for the new requirements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>The introduction of NIS2 \u2013 what is it, who is affected, and what does it mean for companies? Cybersecurity increasingly directly impacts the functioning of businesses. A ransomware attack, employee account takeover, server failure, or loss of access to an ERP system can disrupt a company&#039;s operations for hours or days. That&#039;s why the European Union introduced the NIS2 directive, which aims to improve cybersecurity [\u2026]<\/p>","protected":false},"author":5,"featured_media":12472,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[83],"tags":[569,1128],"class_list":["post-12468","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologia","tag-jak-sprawdzic-czy-firma-podlega-pod-nis2","tag-nis2"],"_links":{"self":[{"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/posts\/12468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/comments?post=12468"}],"version-history":[{"count":10,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/posts\/12468\/revisions"}],"predecessor-version":[{"id":12537,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/posts\/12468\/revisions\/12537"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/media\/12472"}],"wp:attachment":[{"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/media?parent=12468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/categories?post=12468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prosteit.pl\/en\/wp-json\/wp\/v2\/tags?post=12468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}