NIS2 guide: what you need to do and by when Your KSC Act obligations as a list of steps. For each one: who does it, the legal basis and the evidence the auditor will ask for.

23 steps in five areas
deadlines up to 3 April 2028
law as of 20.10.2026

Download the checklist (PDF) Check if you’re in scope

Your NIS2 checklist0 of 23

Organisation and roles0 of 5
Risk and documentation0 of 4
Technology and business continuity0 of 5
People0 of 3
Incidents, suppliers and audit0 of 6

Tick steps in the list below and your progress will appear here

Timeline of deadlines

For organisations that met the criteria on the day the Act came into force, i.e. 3 April 2026.

3 April 2026The Act comes into force
The amendment to the KSC Act came into force.
3 October 2026Entry in the register
The self-registration deadline has passed. What to do after the deadline
3 April 2027Obligations and S46
ISMS, incidents, contact persons, documentation.
by the end of 2027Training for the head of the entity
The first annual training (FAQ 3.46).
3 April 2028First audit and penalties
Audit of essential entities. From this date the authority can impose penalties.

Met the criteria later? For example, after exceeding the headcount threshold. You have 6 months to apply for registration, 12 to meet the obligations and 24 for the first audit, counting from that date (Art. 7c, Art. 16, FAQ 2.32, 3.32).

Were you an operator of essential services? You switch to the new incident reporting rules within 6 months of the Act coming into force, and keep your existing audit cycle (Art. 33(4), FAQ 9.5).

Who is responsible for what

The Act names the head of the entity and the contact persons. The other roles are a proven division of work, which you can also see on the platform.

Head of the entity
Approves the ISMS and the budget, assigns tasks, completes annual training. Also remains responsible for duties entrusted to others.
Art. 8c–8e · FAQ 4.1–4.4
ISMS officer or coordinator
Manages risks, documentation, reviews and internal audits. Reports to the head of the entity and prepares decisions.
organisational role
IT and administrators
Technical safeguards, updates, backups, monitoring and first response to an event.
organisational role
Contact persons
Liaison with the CSIRT and the supervisory authority, reports in the S46 system.
Art. 9 · FAQ 3.17, 3.18
Process owners
Identify important processes and data, accept risks in their area and provide evidence.
organisational role
Security service provider
Can take over some tasks, e.g. as the ISMS officer or SOC. Responsibility stays with the head of the entity.
Art. 14 · FAQ 3.19

Common misconceptions

Each one is settled by the Act or the KSC FAQ.

“We bought NIS2-compliant documentation, so we’re compliant”
Documentation must describe your organisation and be applied in practice (FAQ 3.7).
“We must have a SOC”
The Act doesn’t explicitly require a SOC. It requires continuous monitoring and incident handling (FAQ 3.16).
“The provider will take over responsibility”
Tasks can be entrusted to others, but the head of the entity is responsible for their performance (Art. 8c, FAQ 4.4).
“Every incident must be reported within 24 hours”
You handle every incident, but report only major ones (FAQ 6.3).
“The registration deadline has passed, so it’s too late”
You can apply at any time, and the entry is made as soon as you apply (FAQ 2.32, 2.48). What to do after the deadline
“Penalties only apply from 2028, so we have time”
True for penalties, but obligations apply from 3 April 2027 (Art. 33(1), Art. 35).

Printable checklist

An extended version of the list as a PDF, ready to show to management.

23 steps with columns: person, deadline, status, evidence
deadline calendar and division of roles
legal basis for every step

Download the NIS2 checklist (PDF)

We’ll send it to the address you provide.

I accept the terms of the privacy policy.

Full consent wording and data protection information

I consent to the processing of my personal data by iTrust sp. z o.o., with its registered office in Warsaw (00-689), ul. Poznańska 37, for the purpose of responding to my enquiry and conducting further correspondence related to it.

I also confirm that I have been informed of my right to request from the controller access to my personal data and its rectification or erasure (“right to be forgotten”), restriction of processing and data portability, my right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO) – and my right to object to the processing of data for the direct marketing of iTrust sp. z o.o. products and services, in accordance with Art. 15.1 GDPR (2016/679).

The controller of the personal data provided in this form is iTrust sp. z o.o., with its registered office in Warsaw (00-689), ul. Poznańska 37. To exercise data subject rights, contact iod@itrust.pl or write to the registered office address.

When you need support

Missing an assessment, a system or someone to run it? Each of these situations is covered by a different package.

NIS2 AuditWhich steps you already have and which to catch up on. NIS2 ImplementationRolling out the ISMS and documentation, and preparing people. OutsourcingAn ISMS officer and experts run it day to day. Status firstChecklist: are you an essential or an important entity?

Let’s talk about your organisation

Tell us what you want to sort out. We'll show you the platform and suggest a package that fits your situation.

Book a meeting

Offers and quotes+48 699 587 011 Emailkontakt@fortcyber.pl Incident in progress? Customer support+48 699 587 010

NIS2 guide: what you need to do and by when Your KSC Act obligations as a list of steps. For each one: who does it, the legal basis and the evidence the auditor will ask for.

Organisation and roles0 of 5

Risk and documentation0 of 4

Technology and business continuity0 of 5

People0 of 3

Incidents, suppliers and audit0 of 6

Printable checklist

Let’s talk about your organisation