Poland KSC Act

Polish Act on the National Cybersecurity System - operators of essential services, CSIRT obligations.


Short name	KSC PL
Region	Europe
Country or scope	Poland
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers KSC PL

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for KSC PL.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for KSC PL and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PL-KSC-8-RISK` Systematic Risk Assessment	Operators of essential services must implement a security management system including systematic risk estimation, which requires an inventory of the software components their information systems comprise (KSC Act Art. 8)	Scan
`PL-KSC-8-SEC` Proportionate Technical Measures	Operators must apply technical and organisational measures proportionate to the assessed risk, including maintaining information systems with known, updatable software versions (KSC Act Art. 8)	Scan
`PL-KSC-8-INTEG` System Integrity Protection	Required security measures include protecting information systems against unauthorised modification, supported by verifiable integrity hashes for deployed software (KSC Act Art. 8 security-measures obligation)	Scan
`PL-KSC-DOC` Security Documentation	Operators must produce and maintain documentation of information-system security, so machine-readable records must carry a document identity and creation timestamp (KSC Act documentation obligation, Art. 10)	Scan
`PL-KSC-11-INC` Incident Handling and Reporting	Serious incidents must be handled and reported to the competent CSIRT within 24 hours of detection, requiring rapid matching of deployed components against vulnerability identifiers (KSC Act Art. 11)	Scan
`PL-KSC-VULN` Vulnerability Information Management	Operators must collect information about cybersecurity threats and vulnerabilities of the systems used to provide the essential service, which requires complete component records with names and versions (KSC Act vulnerability-monitoring obligation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`KSC-Art5`	Essential Service Operator: Identification
`KSC-Art6`	OES Cybersecurity System
`KSC-Art7`	OES Risk Management
`KSC-Art8`	OES Incident Reporting
`KSC-Art9`	OES Security Audit
`KSC-Art14`	CSIRT Responsibilities
`KSC-Art15`	CSIRT Cooperation and Information Exchange
`KSC-Art21`	Digital Service Provider: Cybersecurity Measures
`KSC-Art22`	Digital Service Provider: Incident Handling
`KSC-Art23`	Digital Service Provider: Supervisory Measures
`KSC-Art24`	Digital Service Provider: Non-EU Establishment
`KSC-Art26`	Sectoral CSIRT Designation
`KSC-Art27`	Sectoral CSIRT Tasks
`KSC-Art28`	Cooperation Between CSIRTs and Authorities

Policy templates

Written for KSC PL:

Poland KSC Incident Response and Reporting Procedure

And 22 from the standard set, adapted to KSC PL.