NIS2 Implementation. A system that works, not a folder of documents Rolling out an ISMS compliant with the National Cybersecurity System Act (NIS2) and ISO/IEC 27001: risk, roles, procedures, business continuity and people who are prepared.
- 4–10 weeks
- from PLN 10,000
- Workshops, remote and on-site
- ISMS run on the platform
Documents are not enough
The Act requires security to actually work. That’s why we roll out both parts of ISMS documentation: what describes the system, and evidence that it works.
Normative documentation: how it should work
Policies and procedures written for how your organisation really works, not to a template.
- information security policy and topic-specific policies
- procedures: access, incidents, backups and continuity, changes, suppliers
- risk assessment methodology and business continuity plans
Operational documentation: evidence that it works
Proof that what the documents describe is actually done — kept on the platform, not in a binder.
- risk, incident and asset registers with change history
- tasks with owners, deadlines and confirmation of completion
- training, review and test results
Bought-in documentation is not enough. An organisation must know its assets and risks and apply its procedures in practice, and ISMS documentation covers both a normative and an operational part.
When to roll out an ISMS
The most common situations in which we start a rollout.
- After an audit
You have a list of gaps and an action plan. Now they need to be closed and turned into everyday work.
NIS2 Audit - Before ISO 27001 certification
Certification is the result of a working system. We start with the system.
Guide: where to start - After an inspection with recommendations
We turn recommendations into tasks with deadlines and evidence of completion.
Post-inspection guide - The documents exist, but they’re dead
A years-old policy, a risk register with one entry. We bring the system back to life instead of writing another one.
Guide: dead documentation - No one is responsible for security
We assign roles, and you can then entrust running the system to us.
Guide: no one in charge
What we roll out
An ISMS brings together people, processes and technology. We run the process so that it doesn’t paralyse your organisation’s day-to-day work.
Assessment and risk
- maturity and readiness assessment for NIS2 and ISO 27001
- risk analysis: threats, business impact, priorities
- risk treatment plan
Rules and documentation
- information security policy: objectives, rules, responsibilities
- procedures: access, incidents, backups and continuity, changes, suppliers
- risk, incident and asset registers, business continuity plans
Going live
- internal implementing orders and assigned roles
- procedures put into practice and an ISMS maintenance process
- support with entry in the register, the S46 System and CSIRT reporting channels
Trained staff and management are part of the system, not an add-on.
- Cyber Course: 12 training modules and a knowledge test
- 2 controlled phishing campaigns
- progress dashboard and completion certificates
- annual management training required by the Act
Statutory obligations and what we roll out
What the KSC Act requires, how we deliver it and where you see it on the platform.
| Obligation | What we roll out | On the platform |
|---|---|---|
| Risk assessment and management | methodology, risk analysis, risk treatment plan | risk register with owners and decisions |
| Security policies | information security policy and topic-specific policies | documents with versions and review dates |
| Roles and responsibilities | role assignment, internal orders, authorisations | roles and tasks assigned to people |
| Technical and organisational measures | procedures: access, updates, assets, changes | technical policies with results from devices |
| Incidents and contact with the CSIRT | response procedure, reporting channels, incident register | incident handling and reporting deadlines |
| Business continuity | continuity and recovery plans, backup rules | tests and reviews in the annual ISMS plan |
| Supply chain | supplier rules, contract review | supplier review tasks |
| Training for staff and the head of the entity | Cyber Course, management training | training results and certificates |
| Register entry and the S46 System | support with the application and setting up on-call duty | tasks with deadlines |
How the rollout works
4 to 10 weeks, depending on your organisation’s size and what you already have.
- Initial callfree of charge
What you already have, what’s missing, scope and an upfront quote.
- Maturity assessment
Your organisation’s current state and NIS2 readiness. After an audit, we go straight to risk analysis.
- Risk analysis
What really matters and what’s just a formality.
- Policies and procedures
Workshops with process owners.
- Rollout and training
Internal orders, roles, procedures in practice, a trained team.
- Starting ongoing maintenance
The system run on the platform, by you or by us.
What you get
A well-designed ISMS is a risk management system that supports board decisions and genuinely protects the organisation.
A checklist of system and documentation elements (PDF). We’ll send it to the address you provide.
Thank you — the checklist is on its way.
- Compliance with requirements
Legal requirements, NIS2 and ISO/IEC 27001.
- Clear accountability
It’s clear who is responsible for what and who makes decisions.
- Working procedures
Rules people know and follow, not just ones they’ve signed.
- Ready for audit and certification
A system ready for audit, certification and ongoing maintenance.
- ISMS on the platform
Risk register and treatment plan, Statement of Applicability, annual ISMS plan, roles and technical policies.
What stays with management
The Act places responsibility for the system on the head of the entity. We help them fulfil it.
Duties of the head of the entity
- decisions on preparing, rolling out, reviewing and overseeing the ISMS
- adequate funding for cybersecurity
- assigning tasks and overseeing their completion
- staff awareness and knowledge of internal rules
- annual cybersecurity training
How we help
- recommendations for approval wait in the management dashboard
- you generate system status reports on the platform at any time
- roles and tasks have owners and deadlines, so oversight is simple
- management training: “Cybersecurity in management decisions”
Price
The price depends on organisation size, scope and complexity. We give you a quote upfront, after an initial conversation.
4–10 weeks, workshop-based, full documentation and system launch.
90-day training and testing campaign, based on the number of users.
Questions about the rollout
Can’t see your question?Call +48 699 587 011 or book a meeting.
We have ISO 27001. Do we start from scratch?
No. We use your existing documentation and add what the KSC Act requires.
Is buying ready-made documentation enough?
No. The Act requires the system to work in practice: the organisation must know its risks and apply its procedures. Documents without a rollout won’t achieve that.
How much of my team’s time will it take?
Your involvement is planned and limited: workshops with process owners and document review. We agree dates at the start.
Will the system be ready for certification?
Yes. The ISMS we roll out is ready for audit, ISO 27001 certification and ongoing maintenance.
Who runs the ISMS after rollout?
Your team, or us as part of Outsourcing. The Act allows some tasks to be entrusted to an external managed service provider.
Do we need a SOC?
The Act doesn’t prescribe specific solutions. We offer round-the-clock monitoring with a SOC team in the Resilience 24/7 Outsourcing add-on, if your situation calls for it.
Before you decide
Guides and a webinar recording from our knowledge base.
Ask about a rollout
Or start with a conversation. We’ll establish:
- what in your documentation can be reused
- what the KSC Act requires of you
- how long the rollout will take and who needs to be involved
- the scope and an upfront quote
The conversation is led by a FortCyber consultant with experience as a CISO and ISMS auditor.
Incident in progress? Call +48 699 587 010
We’ll get back to you within one working day.