NIS2 Audit. Know where you stand before an inspector asks An organisational and technical assessment of compliance with the National Cybersecurity System Act (NIS2), KRI and ISO 27001.
- 2–5 days
- from PLN 3,000
- Report for the board and IT
- Results straight on the platform
Checklist result: likely an essential entity. You are subject to a statutory audit at least once every 3 years. See the difference.
When an audit is worth doing
Five situations in which we most often start with an audit. Each one comes with a guide from our knowledge base.
- A letter or an announced inspection
The authority asks for evidence. A report referencing the regulations and an action plan give you a ready basis for your reply.
Guide: what now? - A business partner asks about security
Entities covered by the Act vet their suppliers. An audit answers their questions.
NIS2 and the supply chain - We don’t know if we’re in scope
Start with the initial eligibility checklist, and the audit will show what it means for you.
Check with the checklist - Preparing for ISO 27001
A readiness audit shows how much of the standard you already meet and what is missing for certification.
Guide: where to start - The board asks if we’re secure
Instead of “IT says yes”: a document with findings, risks and decisions to be made.
Guide for the board
Compliance audit or statutory audit
The KSC Act provides for a separate audit for essential entities. We carry out both, but it’s worth knowing which one you need.
| Compliance auditNIS2 Audit | Statutory auditrequired by the KSC Act | |
|---|---|---|
| Who it’s for | any organisation: essential and important entities, suppliers, local government units | mandatory for essential entities; important entities have no such obligation |
| When | before an inspection, rollout, certification or a board decision | at least once every 3 years, at the entity’s expense |
| Who can carry it out | the FortCyber audit team | an accredited body, at least two auditors with the required certificates or experience, or a sectoral CSIRT |
| Scope | agreed: organisation, technology, physical security | the entire information system, not just the part related to the service |
| Independence | not applicable | the auditor may not have run your ISMS or reported your incidents in the year before the audit |
| Outcome | gap report, action plan, tasks on the platform | information system security audit report |
| FortCyber | from PLN 3,000, 2–5 days | we carry it out: two auditors with the required certificates; if we run your ISMS, the audit is done by different people |
What we check
The audit combines organisation and technology, because only this approach gives a true picture of the situation.
Organisation
- security documentation and risk management
- roles, responsibilities and decision-making processes
- evidence of operating in line with the rules
- compliance with ISO/IEC 27001, the KSC Act, KRI and NIS2
- suppliers and the supply chain
Technology
- IT environment architecture
- access management
- updates and vulnerabilities
- backups and business continuity
- monitoring and incident response
Physical security
- rules for access to premises
- procedures for access to physical information assets
KSC Act requirement areas covered by the audit
- risk management
- incident handling and reporting
- business continuity and backups
- supply chain security
- training and awareness, including for management
- access control and cryptography
- management oversight and accountability
Tests of external and internal infrastructure, web applications and APIs, and security configurations. Safe for the production environment, following OWASP, PTES, OSSTMM and NIST SP 800-115.
How the audit works
The process is structured, predictable and safe for the production environment.
- Initial callfree of charge
Whether and to what extent the Act applies to you, an initial assessment, and the audit scope and price up front.
- Kick-off and initial analysis
We gather information about the organisation and its IT environment.
- Documentation and configuration review
Policies, procedures, registers and key security settings.
- Interviews with key people
Management, IT, people responsible for processes.
- Gaps and non-conformities
Every finding with a regulatory reference and a priority.
- Report and board meeting
Results in business language, real risks and a recommended way forward.
What you get
An audit isn’t about ticking off checklists. Its goal is to genuinely reduce business risk and the board’s liability.
A sample excerpt from an audit report (PDF). We’ll send it to the address you provide.
Thank you, the report excerpt is on its way.
- Gap and non-conformity report
With references to the KSC Act, KRI, NIS2 and ISO 27001.
- Management and technical versions
Clear and uncluttered, separately for the board and for IT.
- Prioritised action plan
Quick fixes and strategic actions.
- Board meeting
Results in business language and a recommended way forward.
- Plan on the platform
Straight away as a task list with owners and deadlines. The audit doesn’t end up in a drawer.
Price
The price depends on the size of the organisation, the complexity of the environment and the scope. We quote up front, after the initial call.
2–5 days, hybrid format, report and board meeting.
Infrastructure, application and configuration tests, a vulnerability report with risk ratings.
See detailsThe entire information system, two certified auditors.
Who carries out the audit
- ISO/IEC 27001 lead auditors
- Information systems security auditors (KSC)
- Experienced CISOs and security officers
- Security testers
We don’t maintain IT or sell hardware. That’s why our assessment is independent of the provider that maintains your systems.
Questions about the audit
Can’t see your question?Call +48 699 587 011 or book a meeting.
Is this a certification audit?
No. The audit doesn’t end with a certificate. It shows how ready you are for ISO 27001 certification and what still needs to be done.
Is this a statutory audit?
The NIS2 Audit is a compliance audit for any organisation. If you are an essential entity, we also carry out the statutory audit under the rules described in the comparison above.
Can I show the report to a business partner or the authority?
Yes. A report referencing the regulations and an action plan are documents you can attach to your reply to a letter or to a business partner’s questions.
How much of my team’s time will it take?
Involvement is controlled and planned: a few interviews and sharing documents. We agree the schedule at the start.
Do we then have to do the rollout with you?
No. You can carry out the action plan yourselves. If you wish, we’ll run it as part of NIS2 Implementation or Outsourcing.
Are the tests safe for production systems?
Yes. The audit doesn’t interfere with your systems, and we run pentests safely for production, in an agreed time window.
Before you decide
Guides and a webinar recording from our knowledge base.
Ask about an audit
Or start with a free initial call. In a short conversation with the board, we’ll establish:
- whether and to what extent the KSC Act applies to you
- an initial assessment of your security maturity
- five key actions to get started
- the audit scope and price up front
The call is led by a FortCyber consultant with experience as a CISO and board adviser.
Incident in progress? Call +48 699 587 010
We’ll get back to you within one working day.