Blog
Practical notes on vulnerability management, NIS2 and ISO 27001 compliance, and the evidence an auditor actually asks for.
A security policy does not prove that a KSC process works in practice
A mechanism can report a green status while covering a fraction of the scope. The KEV catalogue story on my own fleet, and what it means for operational records.
- KSC
- ISMS
- Evidence
The first KSC audit: who has a 3 April 2028 deadline and when to start collecting evidence
The fixed date of 3 April 2028 applies to one cohort of entities; everyone else counts from their own start. Either way, process history has to emerge during the work.
- KSC
- Audit
- Evidence
What is actually sitting on nine ordinary servers
Raw numbers from my own infrastructure: 165,608 open entries, ninety per cent of them waiting on a fix from the distribution, and three hundred and ten things that can actually be done.
- Vulnerabilities
- Prioritisation
- Data
Cybersecurity outsourcing under Poland's KSC Act: what transfers and what remains
A supplier may perform security tasks, but the regulated entity remains responsible for oversight, risk and evidence.
- KSC
- Outsourcing
- Suppliers
The KSC Act requires software updates, not blind patching
Updates should reduce risk without breaking services. See how to connect vulnerabilities, tests, exceptions and decision evidence.
- KSC
- Patch Management
- Vulnerabilities
Does Poland's KSC Act require an internal SOC? No, but it requires capability
The KSC Act does not mandate an internal SOC. See which monitoring and response capabilities must exist regardless of the operating model.
- KSC
- SOC
- Monitoring
Delegating cybersecurity does not delegate the manager's responsibility
A manager may assign IT work but not statutory responsibility. See what evidence of oversight should remain after delegation.
- KSC
- Management
- NIS2
3 April 2027: what must operate under Poland's KSC Act
Registration is not the end of KSC preparation. See which security processes should operate when the adjustment period ends.
- KSC
- NIS2
- Audit
Is your company covered by Poland's KSC Act? Sector alone is not enough
See why KSC coverage depends on sector, size and corporate links, and why a simple 50-employee test may produce the wrong answer.
- KSC
- NIS2
- Compliance
What a free scanner really costs (TCO worked out on an example)
A zero-cost licence is not a zero-cost process. Work out the total cost of a free scanner on 15 servers, with explicit assumptions you can replace.
- TCO
- Vulnerability management
- Cost
Evidence Pack: how to build a verifiable evidence bundle
Instead of 40 screenshots, one ZIP with a checksum manifest. See the anatomy of a period evidence pack and why a checksum changes the conversation.
- Evidence
- Audit
- ISO 27001
A NIS2 incident: you have 24 hours. What exactly has to happen
Early warning in 24h, notification in 72h, report in a month. See hour by hour what a well-prepared NIS2 incident report looks like.
- NIS2
- Incidents
- Compliance
An end-of-life system is not technical debt. It's a risk register entry
An end-of-life system gets no patches, so it is a risk decision, not a backlog item. See the three things an auditor must see to accept it.
- End of life
- Risk
- ISO 27001
NIS2 Article 20: the board is accountable for cybersecurity. Personally
NIS2 makes the board personally accountable for cybersecurity. See what proof of oversight means and five questions a board should put to its IT team.
- NIS2
- Board
- Compliance
KEV before CVSS: why your patch order is usually wrong
Sorting vulnerabilities by CVSS alone is the default and usually wrong. See why the KEV catalogue should come first and how to build a sensible ranking.
- Vulnerability management
- KEV
- Prioritisation
Are we covered by the Polish KSC Act? Three questions to start with
Check whether your organisation may fall under Poland's KSC Act by reviewing its activity, size and exceptions before seeking legal advice.
- KSC
- NIS2
- Compliance
ISO 27001 A.8.8 in practice: the evidence an auditor will ask for
Control A.8.8 is not about whether you scan. See the questions an ISO 27001 auditor actually asks and which artefacts answer each one.
- ISO 27001
- Audit
- Vulnerability management
A spreadsheet as your vulnerability register: it works until it doesn't
A spreadsheet works as a vulnerability register at small scale, then breaks quietly. See where it cracks and what a real register actually needs.
- Vulnerability management
- NIS2
- Process
NIS2 in Poland: an IT checklist for the 3 October 2026 deadline
A practical checklist for the Polish KSC Act deadlines: self-identification, registration, asset inventory and a vulnerability process that survives an audit.
- NIS2
- KSC
- Compliance
Is free Trivy enough for NIS2 compliance? An honest answer
Trivy finds vulnerabilities for free. Learn when that covers NIS2 requirements and when an auditor will ask for things no scanner output contains.
- NIS2
- Trivy
- Vulnerability management
A scan is a snapshot. Administrators need vulnerability history
The latest scan shows the current state. History shows when a CVE appeared, disappeared, returned and what the team did about it.
- CVE
- Scan history
- Operations
Does this new vulnerability affect any of my servers?
Move from a new CVE alert to a list of affected hosts by checking packages, versions, exposure and available fixes across the fleet.
- CVE
- Linux
- System administration
You received a CVE number. What to check in the first five minutes
A practical way to read a CVE using CVSS, EPSS, KEV, impact and remediation, without losing time across several disconnected sources.
- CVE
- Vulnerabilities
- System administration