ProductsModulesPricingBlogAbout PL Log in See demo
Module / NIS2

NIS2 and the National Cybersecurity System.

The NIS2 directive and the Polish Cybersecurity Act require essential and important entities to register with the competent authority, report incidents on a 24h/72h/30-day timeline, and maintain technical measures under Art. 21 NIS2. RealSec makes this operational, not just declarative.

01 / Entity Profile

Classification: essential or important?

Classification by sector (energy, transport, banking, health...), size, and supply chain role. The profile determines reporting obligations. Auto-update when the NACE code or company size changes.

  • SECTORAnnexes I and II of NIS2
  • SIZEEmployees + turnover / balance sheet total
  • AUTORe-classification on NACE changes
02 / Incidents: 24h / 72h / 30 days

Reporting timeline to CSIRT GOV.PL.

Early warning at 24h, formal notification at 72h, final report at 30 days. Each threshold has its own template, escalation path and alert. Export to CSIRT in their system format.

  • 24HEarly warning ; minimum scope
  • 72HFormal notification ; impact assessment
  • 30DFinal report with lessons learned
03 / Technical Measures Art. 21

Mapping controls to the 10 areas required by NIS2.

Risk management, incident handling, business continuity, supply chain, secure development, encryption, MFA, access management, asset management, cybersecurity training. Each area mapped to specific controls in the ISMS.

  • AREAS10 areas of Art. 21 NIS2
  • CONTROLSMapping to ISO 27001 + custom
  • EVIDENCELinks to policies and procedures
04 / Supply Chain

Vendors with access to NIS2-covered systems.

Every ICT vendor with access to a critical system requires a security assessment. Cross-linked with the DORA module. Vendor risk assessment with a questionnaire tailored to NIS2 Art. 21(2)(d).

  • CROSSShared vendor register with DORA
  • ASSESSVendor security questionnaire
  • AUDITRight-to-audit captured in contract
FAQ

Najczęstsze pytania

Essential and important entities of medium or larger scale in the sectors listed in Annexes I and II of the directive: energy, transport, banking, health, water, digital infrastructure, public administration, and others. In Poland this is implemented through the amendment to the Act on the National Cybersecurity System (KSC 2.0).
Early warning within 24 hours, formal notification within 72 hours, and a final report within 30 days to the competent CSIRT. RealSec tracks the timeline with templates and alerts for each threshold.
For essential entities up to EUR 10 million or 2% of annual global turnover; for important entities up to EUR 7 million or 1.4% of turnover. This is accompanied by personal liability of management, including a possible ban from holding managerial positions.
Registration with the competent authority, systemic cybersecurity risk management (10 areas of Art. 21), incident reporting procedures, supply chain security, and board-level oversight. RealSec maps all of this to specific controls and evidence.
Yes. RealSec uses a shared vendor and process register, so data for NIS2, DORA, and GDPR is not duplicated. That is the main advantage over narrow single-regulation tools.

NIS2 without the panic.

Demo on real data: incident timeline, CSIRT export, vendor risk assessment.

Umów demo →