3 April 2027: what must operate under Poland's KSC Act
Entry in the national list is an event. Operational compliance is a process. Confusing the two may leave a company on time with the formality but late with the work.
The Polish Ministry of Digital Affairs identifies 3 April 2027 as the end of the adjustment period for essential and important entities. A plan or folder of policies is therefore insufficient. The organisation must be able to show that required measures are applied.
What should operate
The technical side includes an up-to-date inventory and ownership, risk analysis, threat and vulnerability monitoring, risk-based software updating, incident handling and reporting, continuity and recovery, supplier security, and records of actions and decisions.
The Act does not prescribe one product, scanner or universal scanning frequency. Measures must fit the risk, and the organisation must be able to justify them.
A document is not proof of application
The official FAQ distinguishes formal documentation from evidence that the information security management system is actually applied. A policy may promise monthly scans. Only run history and handling records show whether that process operated.
A useful readiness test is to choose a random system and show its owner, scans, open vulnerabilities, decisions, deadlines and completed actions. If the answer has to be reconstructed from email, the process is not yet operational.
The role of Secvalis
Secvalis covers only part of the duties: technical inventory, vulnerabilities, deadlines, decisions and evidence. It does not replace the security management system, legal analysis, continuity management or supplier process.
To inspect an operating vulnerability trail, open the public demo.
Sources
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.