POLAND

1. Implementation status

   Law adopted (published and entering into force).

2. Name of the local law

   Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts.

• Link: https://api.sejm.gov.pl/eli/acts/DU/2026/252/text.pdf – the act was published in the Journal of Laws in early March 2026.
• Date of entry into force: The act enters into force on 3 April 2026 (after a one-month vacatio legis from publication).

3. Essential and important sectors
• Division into essential entities (e.g., energy, transport, banking, healthcare, digital infrastructure, public administration) and important entities (e.g., manufacturing, food, waste management, postal services, chemicals).

4. Technical measures
• Firewalls and IDS/IPS: Mandatory as part of network and information systems security.
• MFA (Multi-Factor Authentication): The act explicitly requires strong authentication, especially for remote and administrative access.
• Encryption tools and SIEM: Required to ensure data confidentiality and continuous incident monitoring (anomaly detection).
• Endpoint protection (EDR/XDR) and vulnerability management: Key elements of proactive defence, required by Polish supervisory authorities.
• Backup and recovery: A direct statutory requirement related to business continuity and crisis management.
• Supply chain security: New in the amended National Cybersecurity System Act – entities must technically and contractually verify the cybersecurity of ICT suppliers.
• High-Risk Supplier (HRS) mechanism: Allows exclusion of hardware/software suppliers deemed a threat to national security (this provision was referred by the President to ex post review by the Constitutional Tribunal, but it currently remains in force).

5. Organisational measures
• Security management and incident handling: Establish permanent reporting channels to the national-level CSIRTs (NASK, GOV, MON) and procedures for immediate analysis and containment of attacks on a 24/7 basis.
• Supply chain oversight: Introduce rigorous vetting of ICT service and product suppliers, including resilience assessment and enforcing security requirements in contracts (including procedures for phasing out solutions from “high-risk suppliers”).
• Systematic testing and effectiveness verification: Perform mandatory security audits (every 2 years for essential entities) and conduct cyclical penetration tests verifying real-world resilience.
• Continuous vulnerability identification and patch management: Run ongoing monitoring of software and infrastructure vulnerabilities, combined with a prioritised update schedule (Patch Management).
• Formalised access control and use of cryptography: Implement procedures granting privileges only to necessary resources, plus management-approved rules for encrypting data at rest and in transit.
• Privileged Access Management (PAM): Introduce enhanced oversight of administrator and technical staff access to prevent privilege abuse and insider attacks.
• Business continuity and disaster recovery (BCP/DRP): Maintain up-to-date contingency plans and data recovery procedures based on backups to enable rapid restoration after an incident.
• Education and awareness (Cyber Hygiene): Deliver recurring training programmes for employees at all levels, covering safe work practices, phishing recognition, and protection against social engineering.
• Asset management and removable media: Maintain an inventory of all IT/OT equipment and procedures for secure use of external storage and physical protection of data media.
• Personnel security rules: Implement screening processes for key roles before hiring and procedures for immediate revocation of access upon termination.

6. Mandatory and recommended training
• End-user resilience programmes (Cyber Hygiene): Run recurring workshops for all employees focused on recognising manipulation attempts (social engineering, phishing), secure remote work practices, and physical protection of information assets.
• Specialist training for IT and Cybersecurity teams: Systematically develop technical competencies of staff responsible for infrastructure. This includes certified courses in incident response, malware analysis, and advanced administration of security systems.
• Training on operating and configuring deployed cybersecurity solutions: Mandatory technical sessions dedicated to specific tools used in the organisation (e.g., EDR/XDR, SIEM, next-generation firewalls, PAM). This ensures tool owners fully leverage capabilities and correctly interpret generated alerts.
• Operational and response procedure workshops: Practical exercises for technical teams based on simulations of real attacks, aimed at building incident-handling habits aligned with the organisation’s operating playbooks.
• Management awareness building: Board-level training is mandatory (annual) and covers legal liability, risk management, and crisis response. In addition, leadership must complete the same programme as all employees-from phishing recognition to password hygiene-to set an example and understand real internal threats.
• Continuous threat knowledge updates (Threat Intelligence): Provide IT specialists with access to current information on new attack methods (TTPs) and training on deploying adequate controls against newly discovered zero-day vulnerabilities.