The first KSC audit: who has a 3 April 2028 deadline and when to start collecting evidence
3 April 2028 may look distant, but first check whether that date is even yours. It applies to essential entities that met the criteria on 3 April 2026 and were not previously operators of essential services. An entity that comes into scope later generally counts 24 months from the day it meets the criteria, so its deadline is different and it moves. Existing operators of essential services who have already carried out an audit keep their three-year cycle.
Whatever the date, an audit checks compliance with the Act, and operational documentation is there to show that the required activities were actually performed. Material assembled in the final week is no substitute for that history.
The deadline for implementing the duties themselves moves in the same way. Entities that met the criteria on 3 April 2026 have until 3 April 2027. Anyone coming into scope later generally has 12 months from that point.
What cannot be reconstructed reliably
A policy can be written, files renamed and a presentation prepared. It is harder to reconstruct:
- when a specific vulnerability was found,
- which deadline it was given,
- who approved an exception,
- whether scanning covered the whole inventory,
- how long remediation took,
- whether management received reports and acted on them.
A screenshot from audit day shows state, not months of process operation.
A compact evidence plan
You do not need a separate "evidence" project. Daily work only has to leave a dated trail:
- an inventory with owners,
- a history of scans and their scope,
- deadlines and states of findings,
- risk acceptance decisions with an expiry date,
- periodic reports for management,
- an export of the data for a chosen period.
The audit is broader than vulnerability management. These records cover only part of the technical scope, but exactly the part that is expensive to recreate manually.
Secvalis records part of that history while vulnerabilities are handled: scans and their results, detection dates and the dates from which entries stopped appearing in successful scans, states, assignments, risk acceptance decisions with a review date, and an export for a chosen period. It does not confirm that the machine inventory is complete, nor that management actually carried out a review. It does not guarantee an audit result or replace the auditor.
To assess the format before building your own export, download the sample Evidence Pack.
Sources
- Polish Ministry of Digital Affairs: key KSC amendment dates
- Official KSC Act FAQ
- Text of the KSC amendment, Journal of Laws 2026 item 252 (transitional deadlines: Art. 16 and Art. 33(2))
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.