Cybersecurity outsourcing under Poland's KSC Act: what transfers and what remains
An external company may scan systems, analyse alerts, maintain tools and support incident response. It does not become the head of the regulated entity.
The official FAQ confirms that tasks may be entrusted to others, while stating that this does not release the head of the entity from responsibility. Outsourcing is an operating model, not a transfer of statutory duties.
The contract should protect the process
Beyond a conventional SLA, define system scope, report format and frequency, client access to history and data, escalation times, incident-reporting cooperation, information protection, audit rights, and data return and process continuity after termination.
Without the last item, an organisation may discover that changing supplier also removed the history needed for an audit.
One source of truth on the entity's side
A supplier may use its own ticketing system, but the entity needs access to evidence and decisions. Risk acceptance in particular should not disappear into a contractor's notes. It needs an owner in the organisation, an expiry date and approval under its authority model.
Secvalis can retain the technical asset, vulnerability and decision record regardless of who runs the scans. It does not replace the contract or supplier oversight.
To see how the history can remain continuous across a supplier change, open the Secvalis demo.
Sources
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.