NIS2 audit
We review your IT security, procedures and documentation. The report identifies what needs improvement and in which order. Management and IT receive an action plan. Before the audit, we agree what will be assessed and how the findings will be delivered.
Trusted by
You do not need a complete set of documents or detailed knowledge of every requirement. We start by discussing your business, systems and current safeguards. We help define what needs reviewing, whether you are preparing for statutory obligations or responding to a customer’s security questions.
We combine discussions with business and IT staff with a review of documentation and system settings. The detailed scope depends on your operations and IT environment. Before commissioning a statutory KSC audit, we agree on the audit team and confirm the qualifications required for its scope.
We discuss the findings with your team. The report should help you make decisions and plan work, not simply describe the current situation.
Our information security management system is certified by TÜV NORD Polska. This certificate covers Virtline; it does not replace an assessment of your company’s NIS2 compliance.
View the certificateWe agree the scope, price and schedule before starting. Assessment and subsequent implementation are separate, so you know what your order includes. The quotation and timeline depend on the number of systems and locations, the availability of documentation and the extent of the technical review. The form offers variants I — technological, II — technological and legal, and III — technological, legal and OT. Your selection helps prepare a quotation. Before work starts, we agree the detailed scope, deliverables and providers for the technical, legal and OT elements. Selecting a variant does not confirm team membership or qualifications for a statutory audit.
We learn about your business, systems and audit objectives. We agree which services, systems, locations and external providers to include. We ask for the documents you already have and identify the people who can explain your processes and safeguards.
We agree a schedule and rules for the technical review, including activities requiring separate approval. We agree how information will be accessed. We analyse documents, discuss working practices and review the agreed parts of your IT environment. We clarify uncertainties with the people responsible. Load testing and configuration changes are not included by default. They require prior agreement.
We deliver findings, priorities and proposed actions. We discuss the business impact of the issues and the decisions needed to address them.
You can implement the recommendations with your own team, appoint another provider or agree separate work with us on documentation, security improvements, training or IT support. These services are not automatically included in the audit. We agree the timing and terms of any follow-up review separately.
Practical scope
The amendment to Poland's KSC Act of 23 January 2026 (Journal of Laws item 252) entered into force on 3 April 2026 and implements NIS2 in Polish law. During the audit, we verify sector and size criteria, entity status, entry in the KSC register and applicable deadlines against the current act and official communications.
a common cybersecurity framework for essential and important entities in the European Union.
Self-registration ran from 7 May to 3 October 2026; check any required entry. New entities have been able to use S46 since 12 June 2026 — this opened access, rather than setting a compliance deadline. Entities meeting the statutory criteria when the amendment entered into force must start using S46 and implement their obligations by 3 April 2027. New essential entities that were not operators of essential services must complete their first audit by 3 April 2028; existing operators retain their audit cycle.
risk management, incidents, business continuity, supply chain security, policies, access, backup, monitoring and training.
risk registers, decisions by risk owners, procedures, test results, logs, backup reports, supplier reviews and action plan.
For MAEM sp. z o.o. we performed a NIS2 assessment and penetration tests within the agreed scope. Based on the findings we delivered recommendations to address identified gaps and strengthen IT protection. This description does not confirm compliance of the entire organisation. The application of NIS2/KSC and DORA depends on the organisation’s sector, status and activities. Technical records can support assessment, but do not by themselves confirm compliance or certification.
Here you will find the official legislation and the KSC register application schedule. We use these sources to establish the requirements and deadlines that apply to your organisation.
Source
The official text of the NIS2 Directive in EUR-Lex.
Open sourceSource
The official act of 23 January 2026 amending Poland's national cybersecurity system act.
Open sourceSource
The Polish Ministry of Digital Affairs' communication on deadlines under the amended KSC Act.
Open sourceIt is an assessment of safeguards, security management and documentation against NIS2 and Poland’s KSC Act. We review agreed areas, including risk management, incidents, business continuity, ICT suppliers and management responsibility. You receive a report with recommendations, not a NIS2 certificate or a guarantee against incidents. If you need a statutory audit, we confirm the applicable scope and auditor requirements before you commission it.
We first establish your organisation’s status and audit objectives, then agree the scope, costs and schedule. We analyse documentation, interview the people responsible for each area and review agreed IT elements, such as accounts, networks, backups and supplier services. Finally, we discuss the report and the order of improvements. Responsibilities and deadlines are agreed with your company. Implementing the recommendations requires a separate agreement.
It is for essential and important entities covered by Poland’s KSC Act, and for suppliers whose customers require confirmation of security measures. These questions may arise in security questionnaires, contracts or discussions about cyber insurance terms. Being a supplier does not in itself determine whether the Act applies. We review your activities, size and the relevant legislation to distinguish statutory obligations from customer requirements.
Examples include unclear management responsibility for security, backups without tested recovery, MFA protecting email but not administrator accounts or remote access, no agreed incident reporting process, or supplier contracts without security requirements. We do not assume that every company has these problems. The report describes the issues actually identified, their significance for your organisation and the proposed actions.
Tell us what your business does, which systems you want reviewed and whether you have a deadline. You do not need a complete list of requirements. We will use this information to discuss the scope, required materials and quotation.
Discuss your audit