Is your company covered by Poland's KSC Act? Sector alone is not enough
The most dangerous sentence in KSC preparations is: "we employ fewer than 50 people, so it does not apply to us". It may be true, but it is not a sufficient assessment.
Coverage under the amended Polish KSC Act depends mainly on the activity and size of the entity. There are exceptions, and partner or linked enterprises may matter when size is calculated. The headcount on one payroll therefore does not always settle the question.
Three questions instead of one
Start with the sector. Check whether the actual service falls within the sectors and entity types named in the Act. A primary business code or marketing label is not necessarily decisive.
Next comes size. The official FAQ refers to the rules for classifying micro, small and medium-sized enterprises. The assessment covers staff and financial data and, depending on the structure, may include partner or linked enterprises.
Finally check exceptions. Some categories are covered regardless of size. Conversely, supplying an essential entity does not automatically make the supplier a regulated entity, although security requirements may reach it through contracts and supply-chain controls.
What the assessment should leave behind
Keep a short record containing the activities compared with the Act, the data used to determine size, included partner and linked entities, relevant exceptions, the assessment date and the approver. It does not replace legal advice. It demonstrates that self-identification was a controlled process.
Where IT work begins
Secvalis does not decide whether an organisation is legally covered. Once the answer is yes, IT needs an asset inventory, ownership, vulnerability history, deadlines and evidence of action. That is the part the platform supports.
Not sure whether your organisation is covered at all? Check it in three questions - no registration, instant result.
Sources
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.