LexLint.ioBeta

Know the law your code answers to.

Law / Poland

Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), System Zarządzania Bezpieczeństwem Informacji

Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20) w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • From , twelve months after the Act's entry into force on , Article 8 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform (Załącznik nr 2, Dostawcy usług cyfrowych) among the digital service providers it reaches expressly; the wider sector classes the Załączniki also reach (critical-facility operators, energy, transport, health, finance, telecommunications and digital-infrastructure providers, and public administration) are reached too, by declaring that you are an essential or important entity.
  • Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.NIST CSF 2.0GV.PO-01
  • Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.NIST CSF 2.0GV.RR-01

These lines are LexLint's reading of the law's text. Also read by: Kancelaria Prezesa Rady Ministrów, portal gov.pl Baza Wiedzy (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

The Act's own sanction for an Article 8 infringement is an administrative fine (kara pieniężna) under Article 73; the Act creates no criminal offence for the infringement.

Penalty structure

Article 73(3), as amended: an essential entity's fine for an infringement of, among other duties, Article 8 or Article 11 may not exceed EUR 10,000,000, converted to zloty at the National Bank of Poland's average rate on the preceding 31 December, or 2 percent of its turnover in the preceding financial year, whichever is higher, with a floor of 20,000 zloty (about EUR 4,600); this structure records that essential-entity tier. Article 73(4) sets an important entity's cap at EUR 7,000,000 or 1.4 percent of its turnover, with a floor of 15,000 zloty, and does not say which amount applies. Both tiers apply to an infringement of Article 8 and to an infringement of Article 11, according to the entity's class.

Rule
Higher of
As of
Currency
EUR
Fixed cap
10,000,000
Turnover percentage cap
2

Who enforces it

Enforcement body

The organ właściwy do spraw cyberbezpieczeństwa (competent authority for cybersecurity) designated for the entity's sector, coordinated by the minister właściwy do spraw informatyzacji (minister responsible for computerisation) and backed by CSIRT NASK, CSIRT GOV, CSIRT MON and the sectoral CSIRTs.

Settledness

As of
Guidance link
https://www.gov.pl/web/baza-wiedzy/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa
Guidance body
Kancelaria Prezesa Rady Ministrów, portal gov.pl Baza Wiedzy
Open questions
Will the Rada Ministrów rozporządzenie under the new Article 8a, setting sector-specific detail for the information security management system, narrow how the fourteen Article 8(1)(2) categories apply to an online marketplace, internet search engine or social-networking-service platform provider specifically?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 8 requires an essential entity or an important entity to implement an information security management system in the information system used in the processes affecting its provision of the service, covering fourteen baseline categories of technical and organisational measure: risk-assessment and information-security policy, secure system acquisition and development, physical and environmental security, personnel security, ICT supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training, basic cyber-hygiene, cryptography, secure communications and multi-factor authentication, asset management, and access control, transposing NIS2 Article 21.

Załącznik nr 2 names an online-marketplace provider, an internet search-engine provider and a social-networking-service-platform provider among the digital service providers this duty reaches expressly. The Act entered into force on , but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until , to carry out this duty.

An entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act continues applying the prior Article 8 regime until it has deployed the new system.

When LexLint raises it

When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank, is a securities firm or provides telecom services.

Back to the example  ·  Lint your app

Page updated .