Cybersecurity and NIS2 compliance for companies and public bodies
Most successful attacks start with an ordinary e-mail and a reused password. We close those doors technically, teach your staff to recognise them and prepare the documentation that NIS2 requires.
- Protection of endpoints, e-mail and servers against ransomware
- NIS2 implementation under the Polish KSC act and the German NIS2UmsuCG
- Staff training and simulated phishing campaigns
NIS2 in Poland and Germany in brief
The EU NIS2 directive extends cybersecurity obligations to essential and important entities in more than a dozen sectors, including manufacturing of certain products, transport, digital providers, waste management and public administration. In Poland the amended National Cybersecurity System Act (KSC) has applied since 3 April 2026: covered entities had to register by 3 October 2026 and must meet the requirements by 3 April 2027.
In Germany the NIS2 Implementation Act (NIS2UmsuCG) took effect on 6 December 2025, and the obligations apply without a transition period. Both laws require risk management, incident handling, reporting of significant incidents within 24 hours (early warning) and 72 hours (notification), and make management personally accountable. We help you check whether you are covered and guide you through implementation.
What we do
NIS2 applicability check
We analyse your sector, size and group structure. You get a written answer with the reasoning.
Risk and gap analysis
We compare your current state with the legal requirements and ISO/IEC 27001. The result is a prioritised action plan with costs.
ISMS documentation
Security policy, incident response, business continuity, access and supplier management procedures tailored to your organisation.
Technical controls
EDR on endpoints, e-mail filtering, next-generation firewall, multi-factor authentication (MFA), network segmentation and disk encryption.
Monitoring and response
We collect and analyse alerts, respond to incidents and help prepare the report for the competent CSIRT or the BSI.
Training and phishing simulations
Short practical training for staff and a separate session for management. Controlled phishing campaigns show where the weak points are.
Ransomware-resistant backups
3-2-1 backups with an immutable copy and regular restore tests. Details under backup and disaster recovery.
Recurring audits
Annual or more frequent security review with a management report.
How implementation works
Call and scoping
We establish whether the law applies and where you start from.
Gap audit
Technical and organisational review, interviews with responsible people.
Plan and implementation
High-impact controls first, then documentation and procedures.
Maintenance
Monitoring, training, restore tests and an annual review.
Who we help
- Local government units in Poland that must meet KSC and KRI requirements
- Manufacturers and service companies covered by NIS2 as important or essential entities
- Suppliers to regulated companies that must show evidence of security
- Any company that stores customer data and cannot afford a week of downtime
Frequently asked questions: Cybersecurity and NIS2
Is my company covered by NIS2?
It depends on your sector and size. Obligations usually apply to medium-sized and large companies (50 or more employees or over EUR 10 million turnover) in the sectors listed in the annexes to the law. Some entities, such as DNS providers or public bodies, are covered regardless of size. We prepare a written assessment as part of a free consultation.
What are the penalties under NIS2?
For essential entities up to EUR 10 million or 2% of global annual turnover, for important entities up to EUR 7 million or 1.4%. Both the Polish and German laws also make management personally accountable. In Poland most fines can only be imposed after a two-year transition period, and some penalty provisions have been referred to the Constitutional Tribunal.
How quickly must an incident be reported?
An early warning must be sent without undue delay and no later than 24 hours after becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. That is why the procedure and responsible people must be set up in advance.
Where should we start with ransomware protection?
With three things: multi-factor authentication on e-mail and remote access, a backup that cannot be encrypted or deleted from the company network, and up-to-date systems. These three steps stop most of the attacks we see at small and medium-sized companies.
Does staff training really make a difference?
Yes, if it is short, practical and repeated. After training we run a simulated phishing campaign and compare results, so management sees how many people clicked before and after.
Do you support companies in Germany?
Yes, remotely and on site for planned work. We know the NIS2UmsuCG requirements and BSI registration. Calls are in English, written communication can be in German.
Related services
- Backup and disaster recovery3-2-1 backups, immutable copies, restore tests and a disaster recovery plan.
- Local governmentCybersecurity under the KSC act and KRI, AI in public offices, automation of citizen services.
- Managed IT servicesYour external IT department: helpdesk, server and network administration, hardware service and supply.
Find out whether NIS2 applies to you
In a free consultation we assess whether the law covers you and name the three most urgent steps.
- Phone
+48 501 035 571 - E-mail
kontaktaritmasoft.eu