NIS2
EU Directive 2022/2555 on a high common level of cybersecurity across the Union. Transposed in Poland via an amendment to the National Cybersecurity System Act.
NIS2 divides entities into essential and important categories across more than a dozen sectors: energy, transport, banking, health, water, digital infrastructure, public administration, manufacturing, and others. The threshold in principle covers medium-sized and larger organisations, but there are exceptions that apply regardless of size.
Obligations include systematic risk management across 10 areas defined in Art. 21, incident reporting within the 24h/72h/30-day timeline to CSIRT, and supply chain security. The most significant new element is personal liability for management.
In Poland, NIS2 is transposed through an amendment to the Act on the National Cybersecurity System. Fines reach EUR 10 million or 2% of total worldwide annual turnover for essential entities. The first step is to determine whether your organisation is in scope at all.
In practice: see the relevant RealSec module.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.