NIS2 and UKSC — sensible compliance, not panic

The law came into force on April 3, 2026. Key deadlines: by October 3, 2026 — self-identification and S46 register application. By April 3, 2027 — ISMS implementation, risk and incident management procedures. By April 3, 2028 — first mandatory audit for essential entities. Administrative penalties may be imposed starting April 2028 (2-year moratorium). But the moratorium doesn't exempt from obligations — inspections can happen earlier, with enforcement after 2 years.

It's a great foundation, but not full coverage. ISO 27001 and NIS2 have significant overlap (about 70-80%) — risk analysis, policies, access control, business continuity are common. But NIS2 adds specific items: obligation to report incidents to CSIRT within specific deadlines, S46 self-identification, mandatory management training, supply chain protection per Polish requirements, S46 integration. If you have ISO 27001 — we'll leverage it fully and add only what's missing. The cheapest scenario.

There's no list of mandatory tools. NIS2 requires "appropriate technical and organizational measures proportional to the risk". This means: if risk analysis shows you're particularly exposed to endpoint ransomware attacks — EDR is practically unavoidable. If you have a large fleet of mobile devices with access to company data — MDM. If you manage critical infrastructure with dozens of systems — SIEM. But for a smaller important entity, a sensible set is often MFA + EDR + backup + external monitoring in the MSP model. Every implementation starts with risk analysis.

Yes — it's one of the most common cooperation models. Often clients want us to do audit + risk analysis + ISMS documentation (because that requires UKSC experience), and the technical implementation is done by their IT team with our consulting support. Or the other way: they write documentation themselves, and we help with tool implementation. Or the whole project is in-house, and we only do the final compliance audit as an independent verifier. Each of these scenarios makes sense. We start with a conversation about what you can already do and where you need support.

A compliance audit (gap analysis) is a verification of the actual state against UKSC requirements. We check: documentation (policies, procedures, regulations), organizational processes (risk, incident, supplier management), technical controls (access control, monitoring, backups, network segmentation, endpoint protection). Format: interviews with administrators and management, documentation review, verification of selected system configurations. Time: for SMEs usually 2-4 weeks. The result is a report with a prioritized list of gaps, estimated remediation cost, and proposed schedule — ready material for board decisions.

Administrative penalties for an essential entity — up to EUR 10M or 2% of annual global turnover (whichever is higher). For an important entity — up to EUR 7M or 1.4% of turnover. Minimum penalty: PLN 20,000 (essential), PLN 15,000 (important). Daily penalty for delay in executing an authority's order: PLN 500-100,000. Personal liability of head up to 600% of remuneration. But administrative penalty isn't everything — in case of incident, there's downtime cost, data loss, contractor claims, customer loss (especially with NIS2 supply chain — large companies don't want to risk working with non-compliant suppliers). The real cost is often higher than the penalty.