ProductsModulesPricingBlogAbout PL Log in See demo
NIS2 / KSC Compliance

NIS2 Fines. Up to 10 mln EUR and management liability.

NIS2 and the Polish KSC amendment (KSC 2.0) raise the stakes: fines counted in millions of euros or percentages of turnover, and for the first time personal liability for executives. Below: how much is at risk, who is in scope, what the obligations are, and how to prepare before sanctions kick in.

Sanctions

What non-compliance costs

  • up to 10 mln EUREssential entities ; or 2% of annual worldwide turnover, whichever is higher
  • up to 7 mln EURImportant entities ; or 1.4% of annual worldwide turnover
  • personal liabilityManagement ; Financial penalties for executives and even a temporary ban on holding management roles for failure to supervise
Scope

Who NIS2 applies to

Sectors in Annexes I and II

Energy, transport, banking, financial market infrastructure, health, drinking water and wastewater, digital infrastructure, public administration, space, postal services, waste management, chemicals, food, and manufacturing.

Size threshold

As a rule, medium-sized and larger entities (by headcount and either turnover or balance sheet total). Certain entities are in scope regardless of size.

Supply chain

ICT suppliers with access to the systems of NIS2-covered entities are subject to security assessment.

Not sure whether you are in scope? Check in the Regulatory Checker.

Plan

Obligations and how to prepare

STEP 01

Register with the competent authority

Identify your status (essential or important) and register with the relevant authority under the KSC framework.

STEP 02

Risk management (Art. 21)

Implement measures across 10 technical and organisational areas: risk analysis, incident handling, business continuity, supply chain security, encryption, MFA, access and asset management, and training.

STEP 03

Incident reporting 24h/72h/30d

Early warning within 24 hours, formal notification within 72 hours, final report within 30 days to CSIRT.

STEP 04

Management oversight

Leadership approves and supervises cybersecurity measures. Personal liability rests with the board.

Entity profile, 24h/72h timeline, Art. 21 mapping, and vendor assessment ; all in the NIS2 module.

FAQ

Frequently asked questions about NIS2 fines

For essential entities up to 10 million EUR or 2% of annual worldwide turnover; for important entities up to 7 million EUR or 1.4% of turnover, whichever is higher.
Yes. NIS2 introduces personal liability of management for failure to oversee cybersecurity, including financial penalties and a potential temporary ban on holding management roles.
Essential and important entities of medium size or larger in the sectors listed in Annexes I and II of the directive. In Poland this is transposed by the amendment to the National Cybersecurity System Act (KSC 2.0).
Early warning within 24 hours of discovery, formal notification within 72 hours, and a final report within 30 days to the competent CSIRT.
Determine your status, register as an entity, implement the 10 areas of Art. 21, set up an incident reporting procedure with timers, and involve management in oversight. RealSec handles this operationally: entity profile, incident timeline, control mapping, and vendor assessment.

NIS2 in practice, not just on paper.

30-minute demo: entity profile, incident timeline with CSIRT export, and vendor risk assessment.

Book a demo → See the NIS2 module