Delegating cybersecurity does not delegate the manager's responsibility
A board may assign scanning to an administrator, monitoring to a SOC provider and documentation to a security officer. It cannot assign its statutory responsibility to someone else.
The official FAQ for the amended Polish KSC Act is explicit: entrusting duties to another person does not release the head of the entity from responsibility. The key question is therefore not only who performs cybersecurity work, but how the manager oversees its performance.
What may be delegated
Operational work may be delegated: scanning, alert analysis, updating, registers, reports and cooperation with a CSIRT. In a small organisation most of it may be outsourced.
The delegation should define scope, responsible people, expected outputs, reporting frequency and risk escalation. "IT is responsible for security" is too vague.
What the manager needs
A compact oversight pack should show covered assets, material open risks, overdue work, accepted exceptions with expiry dates and decisions that need management involvement. The head of the entity must also undergo training at least annually.
The Act provides for a possible fine of up to 300 per cent of monthly remuneration in a private entity or up to 100 per cent in a public entity. These are ceilings, not automatic sanctions.
A tool cannot sign the decision
Secvalis can collect vulnerabilities, deadlines, owners and decision history. It cannot approve security measures for the manager or assume statutory responsibility. Its value is current material for an informed decision instead of a quarterly presentation assembled from several spreadsheets.
To see such an oversight trail on fictional data, open the Secvalis demo.
Sources
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.