NIS2 / KSC review: what you will be asked to show

1. 1.

   Please provide the policy on risk analysis and information system security.

   The basis of the whole list: a documented approach to risk from which the remaining measures follow. The reviewer checks consistency between the declared approach and what actually happens.

   Secvalis covers part of thisVM policy document

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. a (polityki szacowania ryzyka) — transpozycja art. 21 ust. 2 lit. a dyrektywy NIS2

2. 2.

   Please provide the incident register and a description of incident handling.

   The reviewer looks at completeness of entries and response times, and for entities subject to reporting duties, also at notification deadlines.

   Secvalis generates this evidenceIncident register

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 4 (zarządzanie incydentami) i art. 11 ust. 1 pkt 2 (dostęp do informacji o rejestrowanych incydentach dla CSIRT); dowody: art. 10 ust. 4 — transpozycja art. 21 ust. 2 lit. b dyrektywy NIS2

3. 3.

   Please provide business continuity and disaster recovery plans and crisis management arrangements.

   The Act refers to contingency and recovery plans rather than backups as such - backups are the means, not the subject of the request. Questions also cover whether the plan was tested, not only that it exists.

   You prepare this yourself

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. f (plany ciągłości działania, awaryjne i odtworzenia działalności) oraz art. 10 ust. 3 pkt 3 (dokumentacja systemu zarządzania ciągłością działania) — transpozycja art. 21 ust. 2 lit. c dyrektywy NIS2

4. 4.

   Please provide supply chain security arrangements and supplier assessments.

   Covers requirements for suppliers, their verification and the handling of vulnerabilities in supplied components.

   You prepare this yourself

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. e oraz art. 8 ust. 2 pkt 1-4 (łańcuch dostaw) — transpozycja art. 21 ust. 2 lit. d dyrektywy NIS2

5. 5.

   Please provide arrangements for identifying and handling vulnerabilities and for receiving reports, with evidence of their use.

   The core of this measure: identifying vulnerabilities in systems in use, prioritising and remediating them within defined timeframes, with a recorded history.

   Secvalis generates this evidenceRemediation SLA tracking

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 3 (zbieranie informacji o podatnościach) i pkt 5 lit. d (niezwłoczne działania po dostrzeżeniu podatności) oraz art. 9 ust. 1 pkt 3 (kanał zgłoszeń dla użytkownika usługi); dowody: art. 10 ust. 4 — transpozycja art. 21 ust. 2 lit. e dyrektywy NIS2

6. 6.

   Please explain how you assess the effectiveness of the security measures in place.

   A question about metrics rather than declarations: what you measure, how often, and what happens when the result deteriorates.

   Secvalis covers part of thisSLA metrics / reports

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. h (ocena skuteczności środków) — transpozycja art. 21 ust. 2 lit. f dyrektywy NIS2

7. 7.

   Please provide basic cyber hygiene practices and training evidence.

   Two different things under one heading. Training and cyber hygiene rules rest on one basis, keeping software up to date on another. The first requires HR-side documentation, the second follows from technical data.

   Secvalis covers part of thisRemediation SLA tracking

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. i-j (cyberhigiena i szkolenia); aktualizacje oprogramowania: pkt 5 lit. b — transpozycja art. 21 ust. 2 lit. g dyrektywy NIS2

8. 8.

   Please provide the policy on the use of cryptography and encryption.

   Covers algorithm selection, key management and where encryption is applied in transit and at rest.

   You prepare this yourself

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. k (stosowanie kryptografii) — transpozycja art. 21 ust. 2 lit. h dyrektywy NIS2

9. 9.

   Please provide access control arrangements and the inventory of protected assets.

   The reviewer reconciles the declared asset inventory with what the systems show — a discrepancy is a more common finding than a technical gap itself.

   Secvalis covers part of thisMachine inventory + context

   ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. m-n (zarządzanie aktywami, kontrola dostępu) — transpozycja art. 21 ust. 2 lit. i dyrektywy NIS2

10. 10.

    Please provide information on the use of multi-factor authentication.

    Applies to access to systems relevant to the service provided, including administrative tools and security platforms. The requirement is framed as applying where appropriate, not unconditionally.

    Secvalis covers part of thisMFA enforcement + member coverage

    ustawa o KSC (Dz.U. 2026 poz. 252), art. 8 ust. 1 pkt 2 lit. l (bezpieczne środki komunikacji elektronicznej, uwzględniające uwierzytelnianie wieloskładnikowe w stosownych przypadkach) — transpozycja art. 21 ust. 2 lit. j dyrektywy NIS2

Informational material, not legal advice. The list is indicative and not exhaustive — the scope of requests depends on the auditor, the certification body and the specifics of the organisation. It does not determine the reader's legal status or the outcome of an audit.