We implement NIS2 / local cybersecurity law compliance. Readiness audit, cybersecurity policy, risk management plan, incident response procedures, reporting. Full package for essential and important entities.
01
Fines up to EUR 10 million or 2% of turnover (essential entities) or EUR 7 million or 1.4% (important entities)
02
Incident reporting: 24h early warning, 72h notification, final report within one month
03
Personal liability of management (fines of up to 300% of salary)
Affiliated company
ALGORSEC is a separate, affiliated company specialising in cybersecurity. It delivers NIS2 implementations, IT security audits and vCISO services — we run projects together whenever an AI or automation rollout requires security expertise.
Customer problem
The NIS2 Directive and, in Poland, the amended National Cybersecurity System Act (in force since 3 April 2026) require essential and important entities to have: cybersecurity policy, risk management plan, incident response procedures, incident reporting to CSIRT, training, audits. The deadline for registering in the list of entities passed on 3 October 2026; the security management system and other obligations must be in place by 3 April 2027. Fines: up to EUR 10 million or 2% of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities (whichever is higher).
NIS2 implementation is a 6–12 month project in a typical company. We run it in stages: readiness audit, organization-tailored policy design, technical and organizational safeguards rollout, leadership and employee training, CSIRT reporting preparation. Pace depends on the baseline maturity of cybersecurity, organization scale and availability of the client-side team.
Why it matters
Fines up to EUR 10 million or 2% of turnover (essential entities) or EUR 7 million or 1.4% (important entities)
Incident reporting: 24h early warning, 72h notification, final report within one month
Personal liability of management (fines of up to 300% of salary)
Supervision by competent authorities and mandatory security audits (essential entities)
Need for cybersecurity policy and procedures
What we deliver
Full NIS2 compliance package — from audit to operational readiness.
NIS2 readiness audit (gap analysis)
Assessing current cybersecurity state against NIS2 requirements. List of 50–100 recommendations prioritized by risk and obligation.
Cybersecurity policy
Full policy document tailored to organization. Covers: risk management, access control, data protection, supply chain security.
Risk management plan
Asset inventory, threat identification, per-asset risk analysis, risk mitigation plan. Annual update.
Incident response procedures
Incident classification, escalation paths, CSIRT reporting procedures within 24h, crisis communication. Procedure testing.
Technical safeguards implementation
Implementation/audit of safeguards: IAM (Microsoft Entra ID), MFA, monitoring (SIEM), backup 3-2-1, network segmentation, encryption. Working with your IT.
Supply chain security
IT supplier inventory, NIS2 readiness assessment, contract templates with cybersecurity clauses, regular audits.
Leadership and employee training
Session for leadership on NIS2 liability, awareness training for employees (phishing, social engineering), phishing tests.
Reporting and documentation
NIS2 dashboard for leadership with key metrics. NIS2-required documentation: incident register, procedures, audits, training.
Technology stack
Technology stack matched to company's scale and current infrastructure.
Your solution
Usually large companies in Annex 1 sectors. Risk-management obligations are the same as for important entities, but supervision is both ex ante and ex post, and the first security audit is due by 3 April 2028. Policies, 24/7 monitoring, procedures, incident reporting to CSIRT.
Solution fit
Let’s identify which parts of the solution will cut manual work and streamline your processes the fastest.
Impact and metrics
Clients we have implemented NIS2 for report similar effects after the first 3 months.
10
NIS2 article 21 risk-management areas covered by policies and procedures
50–100
readiness audit recommendations, prioritised by risk
24h
incident reporting time compliant with requirements
1
coherent policy and procedure package
Business benefits
NIS2 obligations are implemented and documented, so the company is ready for an inspection by the supervisory authority. The risk of fines (for essential entities up to EUR 10 million or 2% of turnover) drops significantly.
Ready procedures, escalation paths, CSIRT reporting. In case of incident — company acts professionally.
Regular training, phishing tests, security culture. People are weakest link — much stronger after rollout.
Who this is for
Companies in sectors: energy, transport, finance, health, drinking water, digital infrastructure, ICT, space, telecom, administration.
Companies providing IT, advisory, logistics services to essential and important entities — customers pass security requirements on to them in contracts (supply chain).
Organizations 50–500 people in NIS2 sectors — in Poland obligations must be in place by 3 April 2027.
Groups with several entities being NIS2 entities — shared approach saves costs and ensures consistency.
Implementation process
We implement the solution in a structured model that clarifies project stages, integration with the current environment and further development across the organization.
Gap analysis against NIS2 requirements. Asset inventory, gap identification. Report with 50–100 prioritized recommendations.
Cybersecurity policy design, risk management plan, response procedures. Leadership approval.
Technical and organizational safeguard rollout. IAM, MFA, monitoring, backup, segmentation, encryption.
Leadership training on NIS2 liability. Awareness training for employees. Phishing tests, response procedure tests.
NIS2 audit simulation. Post-audit corrections. 30 days of support with documentation and procedure updates.
Stage 1 of 5
NIS2 qualification of your company
Readiness audit (preliminary gap analysis)
Implementation plan with concrete phases
FAQ
NIS2 covers 18 sectors listed in two annexes. It usually applies to at least medium-sized companies: 50+ employees, or annual turnover and balance sheet total both above EUR 10 million (EU SME definition, including partner and linked enterprises). Some entities are covered regardless of size. The full list of sectors is in the national law (in Poland: the National Cybersecurity System Act). We do free qualification of your company.
Typically 6–12 months for a mid-sized company. In Poland the deadline for the security management system and other obligations is 3 April 2027, and the deadline for registering in the list of entities passed on 3 October 2026. Pace depends on the baseline cybersecurity state, organization scale, client-side IT team availability and the scope of required technical safeguards.
Essential entities: fines up to EUR 10 million or 2% of worldwide annual turnover; important entities: up to EUR 7 million or 1.4% (whichever is higher in both cases). In Poland, up to PLN 100 million in case of a serious cyber threat. Management can be fined personally, up to 300% of salary. Supervision and inspections are carried out by sector competent authorities, and audits by authorised auditors (not CSIRTs).
Yes. Significant incidents are reported to the competent CSIRT in three steps: early warning within 24h, incident notification within 72h and a final report within one month. We implement procedures and train the team.
NIS2 requires risk-based measures in 10 areas (article 21 of the directive), including risk analysis, incident handling, business continuity and backups, supply chain security, cryptography and multi-factor authentication where appropriate. Specific tools (e.g. SIEM, 3-2-1 backup, network segmentation) are chosen after the risk analysis. In a Microsoft environment Entra ID, Defender and Purview cover part of these areas, but compliance also requires procedures, risk analysis and documentation.
Yes. Sessions for leadership (NIS2 liability), employees (security awareness), IT (technical procedures). Plus phishing tests.
We can offer vCISO retainer (ongoing compliance support), annual audits, documentation updates. NIS2 requires annual reviews.
Related materials
Related solutions
Contact
Filling out the form takes just a moment, and we will get in touch to understand your requirements.
In-depth analysis
NIS2 is the EU directive on information system security, transposed into local cybersecurity law. Covers 18 sectors: energy, transport, finance, health, digital infrastructure, ICT, telecom and others. It usually applies to companies with 50+ employees, or with turnover and balance sheet total both above EUR 10 million. Fines: up to EUR 10 million or 2% of turnover for essential entities and up to EUR 7 million or 1.4% for important entities.
A good NIS2 rollout is a project covering: readiness audit (gap analysis), cybersecurity policy, risk management plan, incident response procedures, safeguards implementation (IAM, MFA, monitoring, backup, segmentation), training, documentation. Without these elements you risk fines and personal liability. Implementation pace depends on baseline environment maturity and typically takes 6–12 months. In Poland the statutory deadline for implementing the obligations is 3 April 2027.
NIS2 implementation delivers biggest impact in companies in directive-covered sectors (essential and important) and providers of services to these companies (supply chain). Typical ROI: audit readiness, lower risk of fines, professional incident response, competitive advantage in B2B tenders.
