In brief
A formal KSC audit under Poland's National Cybersecurity System Act may be performed by an accredited conformity assessment body, at least two auditors with a listed certificate or documented practice, or a sectoral CSIRT. Nobody who ran ISMS or incident tasks at the entity in the year before the audit may audit it.
Key takeaways
- A KSC audit is performed by an accredited conformity assessment body, at least two qualified auditors or a sectoral CSIRT (art. 15(2) of the KSC act).
- Auditors qualify through one of 11 certificates in a 2018 regulation (including CISA, CISM, CISSP and ISO/IEC 27001 Lead Auditor), 3 years of practice, or 2 years plus a postgraduate diploma in audit.
- Nobody who performs art. 8 or 9-13 tasks at the audited entity, or did so in the year before the audit starts, may audit it (art. 15(2a)).
- Entities that were essential on 3 April 2026 (other than former operators of essential services) must complete their first audit by 3 April 2028, then at least every 3 years.
- An essential entity sends the audit report to the competent authority within 3 working days of receiving it (art. 15(1a)).
A formal KSC audit is the information system security audit required by art. 15 of Poland's National Cybersecurity System Act (KSC), which implements NIS2 in Poland. It may be performed by an accredited conformity assessment body, at least two qualified auditors or a sectoral CSIRT. Each auditor needs a listed certificate or documented practice, and nobody who did ISMS or incident work for you in the past year may audit you. We do not perform formal KSC audits. Our NIS2 audit readiness service is the pre-audit review: we find the gaps and tell you who may audit you.
Who can perform a KSC audit?
Art. 15(2) of the KSC act gives three options. The first is a conformity assessment body accredited under Poland's Act on Conformity Assessment and Market Surveillance. The second is a team of at least two auditors, each meeting one of the qualification routes.
The third is a sectoral CSIRT whose auditors meet the same conditions.
Most entities will take the second route: an audit firm or two independent auditors. The act sets up no register of KSC auditors and no ministry license (as of 16 October 2026). You check the credentials before you sign, because the report goes to the authority under your name.
| Who | Condition |
|---|---|
| Conformity assessment body | accredited under the Polish Act on Conformity Assessment and Market Surveillance |
| Audit team | at least two people, each with a listed certificate or documented practice |
| Sectoral CSIRT | auditors who meet the same conditions as an audit team |
Which certificates and practice qualify a KSC auditor?
The certificates are listed in the annex to a 2018 regulation of the Minister of Digital Affairs (Journal of Laws 2018, item 1999). The 2026 amendment neither repealed it nor changed its legal basis in art. 15(8), so the list still applies. It has 11 entries:
- CIA (Certified Internal Auditor)
- CISA (Certified Information Systems Auditor)
- lead auditor certificate for information security management systems under PN-EN ISO/IEC 27001, issued by an accredited personnel certification body
- lead auditor certificate for business continuity management systems under PN-EN ISO 22301, on the same terms
- CISM (Certified Information Security Manager)
- CRISC (Certified in Risk and Information Systems Control)
- CGEIT (Certified in the Governance of Enterprise IT)
- CISSP (Certified Information Systems Security Professional)
- SSCP (Systems Security Certified Practitioner)
- Certified Reliability Professional
- ISA/IEC 62443 Cybersecurity Expert
Without a certificate, an auditor qualifies through practice: at least 3 years auditing information system security, or 2 years plus a postgraduate diploma in information system security audit.
The practice must be documented, for example by 3 audits carried out in the 3 years before the audit starts (art. 15(3)). What the certificate itself proves is covered in our piece on why the CISA certification matters for compliance.
What does the one-year independence rule mean?
The new art. 15(2a) says the audit may not be performed by a person who performs tasks under art. 8 or art. 9-13 at the audited entity, or did so in the year before the audit starts.
Art. 8 is the information security management system (ISMS). Art. 9-13 include the designated contact person, incident handling and incident reporting.
The rule targets people, not companies. It excludes your ISMS owner, the administrators who handle incidents, and outside consultants who built your ISMS or run it under an ongoing support contract. Internal audit staff can join the team only if they did none of those tasks themselves.
When is the first audit due, and for whom?
The mandatory audit applies to essential entities. Those that were essential when the amending act entered into force (3 April 2026) must complete their first audit by 3 April 2028 (art. 33(2) of the amending act). Former operators of essential services keep their existing cycle.
After the first audit, the next ones follow at least every 3 years.
- A new essential entity completes its first audit within 24 months of meeting the criteria (art. 16 point 2).
- An important entity has no periodic audit. The authority can order one by decision after a serious incident or another breach of the act (art. 15(1b)). The decision names who may perform it and the deadline for sending a copy of the report.
- The audit report goes from the essential entity to the competent cybersecurity authority within 3 working days of receipt (art. 15(1a)).
Missing the audit deadline is a separate ground for a fine (art. 73). These fines can be imposed from 3 April 2028 (art. 35 of the amending act).
The dates are on the Ministry of Digital Affairs page on entity duties (in Polish), and the full text is Journal of Laws 2026, item 252. For the work up to 2027, see our 26-week NIS2 implementation plan for Poland.
How is a pre-audit review different from a KSC audit?
A KSC audit ends with a report that goes to the authority and discharges the art. 15 duty. A pre-audit review does neither. It is a review that shows the gaps before the formal audit: missing evidence, controls that exist only on paper, an unfinished risk analysis. The firm that implemented your ISMS may run it, because it does not replace the audit.
| Criterion | Pre-audit review | Formal KSC audit (art. 15) |
|---|---|---|
| Who | any team, including the implementers | accredited body, at least two qualified auditors or a sectoral CSIRT |
| Independence | not required | one-year gap from art. 8 and 9-13 tasks (art. 15(2a)) |
| Output | gap list and remediation plan | audit report to the authority within 3 working days |
| Meets the legal duty | no | yes |
Be careful with offers where one firm implements your ISMS and then "audits" it in the same year. If the same people did art. 8 work, the report fails the art. 15(2a) test. Run the review first, fix the gaps, then hand the formal audit to people who did none of the art. 8 work.
How do you vet auditors before you sign?
- Team. Ask for the names of at least two auditors who will actually run the audit.
- Qualifications. For each person: a copy of a certificate from the 2018 list, with its validity date, or proof of practice such as a list of 3 audits from the last 3 years. For a conformity assessment body: the scope of its accreditation.
- Independence statement. Each auditor confirms in writing that they did no art. 8 or 9-13 tasks for you in the year before the start. Check it against your list of vendors and consultants.
- Scope. The audit covers the information system used to provide the service. List the systems, sites and suppliers in scope.
- Timeline. Start date, report date and your 3 working days to send it to the authority. Leave a buffer before 3 April 2028.
- Access to evidence. Agree how auditors get your ISMS documentation, logs and registers. Automatically generated system logs count as operational documentation (art. 10(4)).
Have the evidence ready before the audit instead of collecting it under deadline pressure. Our piece on data lineage for NIS2 asset management shows where to start. If your Polish entity is still not in the register, read what to do after the KSC registration deadline first.
What to do before your first audit
First, confirm whether you are an essential entity and since when, because that sets your deadline. Then list the people who perform art. 8 and 9-13 tasks for you: none of them can run the audit. Finally, choose the audit team and book a slot in 2027, with time left for fixes.
We do not run the formal audit ourselves. We run the pre-audit review, help close the gaps and tell you who may audit you. The scope is described under NIS2 compliance and IT consulting. If you want to talk through your timeline, contact us.
Frequently asked questions
- Can a single auditor perform a KSC audit?
No. Unless an accredited conformity assessment body runs it, art. 15(2) requires a team of at least two auditors, each with a listed certificate or documented practice.
- Can the firm that implemented our ISMS perform the KSC audit?
Not with the same people if they performed art. 8 or 9-13 tasks for you in the year before the audit starts (art. 15(2a)). The rule applies to people, so a separate team at that firm is not ruled out, but the firm has to prove that team's independence.
- Is there a register of qualified KSC auditors?
No (as of 16 October 2026). Qualification comes from a certificate in the 2018 regulation (Journal of Laws 2018, item 1999) or from documented practice, and you check it yourself.
- When is the first KSC audit due?
Entities that were essential on 3 April 2026 have until 3 April 2028, unless they were operators of essential services and keep their existing cycle. New essential entities have 24 months from meeting the criteria, and the audit then repeats at least every 3 years.
- Does an important entity need a KSC audit?
Not on a fixed cycle. An important entity has no periodic audit. The authority can order one by decision after a serious incident or another breach of the act (art. 15(1b)).
