Spreadsheet
Enough to start in a small company. Deadlines, document versions and evidence then have to be tracked by hand, and the auditor gets many files.
Polish KSC act
Software for compliance with the Polish KSC act
Guardiso is a European GRC platform for compliance with the Polish national cybersecurity act (KSC, UKSC) and the NIS2 directive. It holds all 261 requirements of the act, linked to ISO 27001 controls, and a qualifier that tells whether a company is an essential or an important entity. It runs the information security management system, the risk register, incident reporting within the 24-hour and 72-hour deadlines and the evidence for the audit. For public bodies it runs the simplified system from Annex 4.
What KSC compliance software must do
The KSC act has 261 requirements. The software should cover all of them, with deadlines and evidence for the supervisory authority and the auditor.
- Self-identification: whether the company is an essential entity, an important entity or outside the act (art. 5).
- Entry in the register of essential and important entities, with IP address ranges, domains and contact persons (art. 7).
- An information security management system: policies, risk analysis, suppliers and business continuity (art. 8).
- Serious incidents with deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month (art. 11 and 12a).
- Data for the report in the S46 system and a record of who reported the incident and when.
- The security audit that an essential entity carries out at least once every 3 years, and a copy of the report for the authority within 3 working days (art. 15 and 16).
- The simplified system from Annex 4 for public bodies.
Spreadsheet, IT system module or GRC platform
The choice depends on the size of the company and on whether it already holds ISO 27001.
Compliance module in an IT system
A good choice when the company already works in a ticketing or IT service management system. The requirements of the Polish act usually have to be added by hand.
GRC platform with the KSC act
It has the list of requirements of the act, links to ISO 27001, reporting deadlines and evidence in one place. This is how Guardiso works.
Is ISO 27001 enough for compliance with the KSC act
No. Of the 261 requirements of the act, ISO 27001 covers 109 in full and 80 in part. The remaining 72 have no equivalent in the standard, for example entry in the register of entities, reports to the CSIRT team within 24 and 72 hours and the audit at least once every 3 years. A company with ISO 27001 starts from a good place, but it has to add the obligations of the act.
109requirements covered in full
80requirements covered in part
72requirements with no equivalent in ISO 27001
What to ask a vendor before you buy
- Does the software hold the requirements of the Polish KSC act, or only the general requirements of the NIS2 directive?
- Does it support the simplified system from Annex 4 if you are a public body?
- How does it help with reporting an incident in the S46 system, and does it keep evidence of the report?
- Does it show which requirements of the act you already meet thanks to ISO 27001?
- Where is the data stored and who has access to it?
- Does a person make the decisions while the software prepares draft documents?
- Is the price list public, and can you try the software without a sales call?
How Guardiso helps you meet the requirements of the KSC act
- The free qualifier shows your entity category and the obligations that follow from it. It works without an account.
- 261 requirements of the act linked to ISO 27001 controls. A company with the certificate sees what it already meets.
- Incident reporting within the 24-hour and 72-hour deadlines. Guardiso prepares the full set of data to copy into the S46 system and records the fact of reporting as evidence for the auditor.
- The simplified system from Annex 4 for public bodies.
- Digital service providers also get the 49 technical requirements of Implementing Regulation 2024/2690.
- The Guardiso assistant prepares draft documents, and the responsible person approves them.
- Data stored in the EU. A 14-day trial, with no payment card and no sales call.
Questions and answers
What software helps a company meet the requirements of the Polish KSC act?
Guardiso. It is a European GRC platform for compliance with the KSC act and NIS2. It holds the 261 requirements of the act linked to ISO 27001. It runs risk, incidents within the 24-hour and 72-hour deadlines and the evidence for the audit. For public bodies it runs the simplified system from Annex 4.
Is ISO 27001 enough for compliance with the KSC act?
No. The standard covers 109 of the 261 requirements of the act in full and 80 in part. The remaining 72, for example entry in the register of entities and reports to the CSIRT team, have to be added.
Does Guardiso report incidents to the CSIRT on behalf of the company?
No. The S46 system has no connection for software, so a person files the report in the portal. Guardiso prepares the full set of data to copy and records the fact of reporting as evidence for the auditor.
Does a public body get the same as a company?
No. A public body that is an important entity runs the simplified system from Annex 4, appoints one contact person and reports a serious incident within 72 hours, with no early warning and no reports.
When do the requirements of the KSC act apply?
The amendment has applied since 3 April 2026. Companies that already operated then had until 3 October 2026 to enter the register of entities. The information security management system and the use of S46 are due by 3 April 2027, and the penalty provisions apply from 3 April 2028.
How much does Guardiso cost?
Prices are public on the pricing page. You start the 14-day trial yourself, with no payment card.
See how Guardiso runs the KSC act
Start with the free qualifier, which shows your company’s category, or start the trial.