The upcoming October 3, 2026, deadline marks the final stage of registration on the list of key and important entities, but it does not conclude the process of adapting to the amendment to the Act on the National Cybersecurity System. The most important obligation is the implementation of an information security management system (ISMS). Entities that met the statutory criteria on April 3, 2026, must do so by April 3, 2027.
What is ISMS within the meaning of the KSC Act?
The ISMS is a national framework for implementing the requirements of the NIS2 Directive regarding cybersecurity risk management. It is not a set of policies prepared for audit purposes. Pursuant to Article 8, Section 1 of the Act, the system encompasses information systems used in processes affecting the entity's service provision. It must ensure, in particular:
- Systematic risk assessment: Regularly identifying, analyzing, assessing, and managing the risk of an incident occurring.
- Proportionate technical and organizational measures: Security measures tailored to the assessed risk, taking into account the latest knowledge, implementation costs, and the size of the entity. The Act specifies, among other things, security policies, supply chain security, business continuity plans, continuous system monitoring, asset management, and access control.
- Incident and vulnerability management: Collecting information about cyber threats, handling incidents, and mitigation measures, including regular software updates.
Risk assessment
Risk assessment is the starting point for selecting all security measures. The lack of a documented risk analysis undermines the validity of any implemented measure. At this stage, you should:
- Adopt a methodology: Develop and approve a uniform risk assessment method along with risk acceptance criteria.
- Inventory assets: Create a register of systems, data, processes and suppliers covered by the ISMS.
- Develop a risk management plan: Assign countermeasures, risk owners, and implementation deadlines. Decisions in this regard rest with the entity's manager.
- Conduct management training: The entity's manager and the person entrusted with cybersecurity responsibilities must complete training once per calendar year, and participation must be documented. It's a good idea to organize the first training in 2026, before the board begins making key implementation decisions.
Documentation and implementation of security measures
Once the risk analysis is completed, the organization moves on to implementing specific solutions:
- Security documentation: The Act divides it into normative and operational. Normative documentation includes, among others, ISMS documentation, thematic policies, business continuity management system documentation, and technical documentation. Operational documentation consists of records confirming the performance of activities, including system logs. All documentation requires supervision, versioning, and retention for at least two years after decommissioning.
- Incident handling procedure: Escalation paths and reporting templates to meet statutory deadlines with the relevant sector CSIRT: early warning within 24 hours, major incident reporting within 72 hours and final report within one month.
- Business Continuity: Implement, document and test business continuity plans, contingency plans and business recovery plans.
- Technical measures: Continuous system monitoring, access management, regular updates, and, where appropriate, encryption and multi-factor authentication. Each security measure should be based on a risk management plan.
- Supply Chain: Reviewing ICT vendor contracts and implementing assessment procedures. We covered this in detail in the previous article in the series.
Launch and verification
The last weeks before the deadline should be used to check whether the system works in practice:
- Using the S46 system: By April 3, 2027, entities must start using the S46 IT system, which is used for, among other things, reporting incidents.
- Staff training: Training of employees in new procedures and basic cyber hygiene principles, with documentation of participation.
- Procedure Testing: Table-top exercises covering a major incident scenario, including the reporting process to the sector CSIRT and communication with management.
- Effectiveness assessment: Internal or management review to confirm completeness of documentation and effectiveness of implemented measures.
Summary
The April 3, 2027 deadline marks the end of system development, not the end of responsibilities. From that date, the ISMS must operate continuously. Risks must be periodically assessed, incidents recorded, and the effectiveness of security measures assessed. Key entities must conduct their first security audit by April 3, 2028, and then repeat it at least every three years. An audit cannot be conducted by a person who has performed ISMS-related tasks within the entity within the last year. For key entities, an authority may order an external audit, for example, after a serious incident. From April 3, 2028, supervisory authorities may generally impose fines on both the entity and the manager personally.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of September 17, 2026.
