A KSC compliant ISMS in 12 weeks, at a fixed price
154 days left until 3 April 2027.
art. 8; transitional art. 33(1)
For essential and important entities on the KSC register
We implement the information security management system that article 8 of Poland's National Cybersecurity System Act requires. A lead auditor for ISO/IEC 27001 runs the project, and the documents, risks and evidence stay with you on the QuickISO platform.
Four dates that bind your management board
3.10.2026
passed 28 days ago
The register of essential and important entities closed to new applications. According to figures given to the press, almost 70,500 entities applied.
art. 7c; transitional art. 33(3)
3.04.2027
An information security management system in place: risk, policies, incident handling, business continuity and supplier security.
art. 8; transitional art. 33(1)
every year
Training for the head of the entity and the person given the cybersecurity duties, with participation documented.
art. 8e
3.04.2028
The first audit of essential entities, and the start of financial penalties.
transitional art. 33(2) and art. 35
3.10.2026
passed 28 days ago
The register of essential and important entities closed to new applications. According to figures given to the press, almost 70,500 entities applied.
art. 7c; transitional art. 33(3)
today, 31.10.2026
12 weeks of implementation
latest start: 4 January 2027
3.04.2027
An information security management system in place: risk, policies, incident handling, business continuity and supplier security.
art. 8; transitional art. 33(1)
every year
Training for the head of the entity and the person given the cybersecurity duties, with participation documented.
art. 8e
3.04.2028
The first audit of essential entities, and the start of financial penalties.
transitional art. 33(2) and art. 35
Does the KSC act apply to you? Three questions
Answer about the kind of entity, its activity and its size. The result shows the status, the dates and where to start. The answers stay in your browser; nothing is sent.
KSC checker. The answers stay in your browser.
0 of 3 answered
- Entity
- Activity
- Size
- Result
Twelve weeks from scope to internal audit
We work on your systems and with your people. The documents are written in QuickISO in Polish and English, and a person you name approves each of them.
Week
Scopeweeks 1 and 2
Your status under the act, the boundaries of the system, the systems your service depends on and the process owners.
Approved scope
Riskweeks 3 to 5
The asset and risk register, the risk treatment plan and the board's decisions recorded in the system.
Risk treatment plan
Policies and proceduresweeks 6 to 9
The security policy, topic policies, incident handling with reporting in 24 and 72 hours, business continuity and suppliers.
Peopleweeks 10 and 11
Board training under art. 8e, staff training and an incident handling exercise.
Training certificates
Internal auditweek 12
The audit, the management review and the action plan. You are ready for an inspection and for the audit under art. 15.
Internal audit report
Technical safeguards: your IT team or a partner
Technical safeguards such as MFA, network segmentation or monitoring are implemented by your IT team or a partner. We describe them, set their order and check them.
approved by a person you name
weeks 1 and 2
Scope
Your status under the act, the boundaries of the system, the systems your service depends on and the process owners.
Approved scope
weeks 3 to 5
Risk
The asset and risk register, the risk treatment plan and the board's decisions recorded in the system.
Risk treatment plan
weeks 6 to 9
Policies and procedures
The security policy, topic policies, incident handling with reporting in 24 and 72 hours, business continuity and suppliers.
Approved policies
weeks 10 and 11
People
Board training under art. 8e, staff training and an incident handling exercise.
Training certificates
week 12
Internal audit
The audit, the management review and the action plan. You are ready for an inspection and for the audit under art. 15.
Internal audit report
Technical safeguards: your IT team or a partner
Technical safeguards such as MFA, network segmentation or monitoring are implemented by your IT team or a partner. We describe them, set their order and check them.
- approved by a person you name
Dariusz Zalewski, lead auditor for ISO/IEC 27001
I know what a document nobody follows afterwards costs, so an implementation ends with a working process, not a binder.
For years I have built information security management systems from scratch, on the company's side rather than from outside.
Lead auditor for ISO/IEC 27001 (IRCA), ISO 22301, ISO/IEC 42001 and ISO 9001
- Director of IT & Security at Alokai: ISO/IEC 27001, SOC 2, PCI DSS and NIS2
- Head of Security & Compliance at KeyShot: a security management system and SOC 2 from scratch, business continuity to ISO 22301
- VP, Head of IT Operations at Zoovu: ISO/IEC 27001 and SOC 2 from scratch
- IT Director Central Europe at Ramirent: over 1,000 people and over 300 sites
Net prices, no quote needed
1
KSC board training
PLN 690
per person
- 3 hours, live online
- The board's duties under art. 8c, 8d and 8e
- A test and a certificate documenting participation
- A company group of up to 12 people: PLN 4,900
Next date: Thursday 19 November 2026, from 10:00 to 13:00 Warsaw time.2
KSC Assessment
PLN 7,900
10 business days
- Your status under the act and the scope of the system
- The gaps against art. 8 and an action plan
- A quote for the implementation
The full amount counts towards an implementation signed within 30 days.3
Turnkey ISMS
from PLN 34,000
PLN 34,000 up to 100 people PLN 54,000 101 to 249 people from PLN 84,000 from 250 people or with several sites QuickISO for 12 months included
12 weeks, with a lead auditor for ISO/IEC 27001 throughout the project.4
ISMS maintenance
PLN 2,900
a month
Reviews, support with incidents, the yearly board training, the internal audit and preparation for the audit under art. 15.
5
KSC audit
from PLN 24,000
for essential entities
We do not audit companies whose system we implemented in the last year, because art. 15(2a) forbids it.
QuickISO on its own, without the implementation
If you build the system yourselves or with your own consultant, you can use the platform alone. Net prices with annual billing, and every plan starts with 30 days free.
Start
PLN 490
a month, billed annuallyPLN 5,880 a year
- One workspace, up to 10 people
- ISO/IEC 27001: scope, gap assessment, risks, documents, evidence and registers
- The mobile app for evidence and tasks
- No KSC overlay, questionnaires, integrations or trust page
GrowthFor KSC
PLN 990
a month, billed annuallyPLN 11,880 a year
- One workspace, up to 50 people
- Everything in Start
- The KSC and NIST overlays on ISO/IEC 27001
- Customer questionnaires, integrations and the trust page
Scale
from PLN 2,490
a month
- A group: a parent with its subsidiaries
- Everything in Growth
- No limit on people in the workspace
- The price depends on the number of entities in the group
For consultants and vCISO firms: PLN 190 a month for each client's workspace.
Tell us what you need
What happens next
- 1You confirm your email address with the link we send.
- 2We answer within one business day.
- 3We agree the scope and a time to talk.
What boards ask most often
- Do we need an ISO/IEC 27001 certificate?
No. The act requires an information security management system that meets art. 8, not a certificate. ISO/IEC 27001 is the simplest route to such a system and also answers your customers' security questions, so that is what we build on.
art. 8
- Penalties only start in 2028. Why start now?
The implementation deadline is 3 April 2027, and the yearly board training applies already. The head of the entity is personally responsible, even after giving the duties to someone else. Large customers on the register also have to look after their suppliers' security, and they ask about it today.
art. 8e; transitional art. 33(1)
- Is the training enough for art. 8e?
The training covers the duties art. 8e(2) lists, and the certificate documents participation, which art. 8e(3) requires. It has to be repeated in every calendar year.
art. 8e(2) and (3)
- We did not apply to the register by 3 October. What now?
Apply as soon as you can, because the authority may impose a penalty for a missed application. In the Assessment we check your status, help you apply and plan the remaining dates.
art. 7c; transitional art. 33(3)
- Can you audit us as well?
Yes, if we did not implement your system in the last year. The act forbids the audit to anyone who carried out the duties under art. 8 or art. 9 to 13 in the audited entity during that time.
art. 15(2a)
Legal basis: the act of 23 January 2026 amending the act on the national cybersecurity system and certain other acts, Dz.U. 2026 item 252.
This page summarises the act's obligations in simplified form and is not legal advice.
We answer within one business day.
We agree the scope and a time to talk.