Cybersecurity (KSC and NIS2)
Software for KSC Act and NIS2 compliance
The amended Polish National Cybersecurity System Act (KSC), implementing the NIS2 directive, has applied since 3 April 2026. The Incidents (KSC) and ISMS modules guide a public office or company through the new obligations: reporting incidents on time, an information security management system, risk assessment and documentation ready for inspection.
154
days to the ISMS implementation deadline
3 April 2027
Obligations of the Act
Every KSC obligation has its place in the system
Information security management system
The ISMS implementation wizard builds a plan with deadlines, the catalogue of Art. 8 requirements shows the compliance score, and the security policy, incident procedure and other document templates are generated in DOCX with your organisation's data.
Watch the videoOn-time incident reporting
Early warning to CSIRT within 24 h, notification within 72 h, the final report and a breach notification to the data protection authority within 72 h — deadlines calculated automatically, with reminders and a ready-made report text.
Watch the videoRisk assessment
A risk register with a 5×5 matrix and typical threat suggestions for each asset, plus ICT asset and supplier registers with a security questionnaire.
Training and management accountability
Cyber hygiene e-learning with a knowledge test created in one click, plus tracking of the training of the head of the organisation, who is accountable for the ISMS.
Ready for inspection and audit
A ZIP package with documentation and evidence for the inspector, a PDF compliance report for management and tracking of security audit deadlines.
Data and AI in your network
We install the system on the client's server. The AI assistant runs on a locally hosted language model, PESEL numbers, e-mail addresses and phone numbers are masked, and every suggestion must be approved by an employee.
Who it is for
KSC modules in two systems
LS PUPportal — for county labour offices
The Incidents (KSC) and ISMS modules with a requirements catalogue and threat suggestions tailored to a labour office, alongside the GDPR register, asset records and the PULS and SEWIB archives.
Discover LS PUPportalLS Portal — for companies and institutions
The same modules for essential and important entities outside labour offices, alongside asset records with phone stocktaking and the GDPR, contract and certificate registers.
Discover LS PortalTry the ISMS module without a licence
The demo version includes the dashboard, wizard, requirements catalogue, documents, training and the AI assistant, with registers limited to 3 entries.
Frequently asked questions
Questions and answers
Who does the amended KSC Act apply to?
Essential and important entities in the sectors listed in the Act, including public administration bodies. The entity's status determines the scope of obligations and reporting deadlines — you set it once in the system, and the requirements catalogue and deadlines adjust automatically.
What is the ISMS implementation deadline?
The amended Act has applied since 3 April 2026, and the information security management system must be implemented by 3 April 2027. The wizard in the ISMS module splits the work into stages with deadlines so you finish before that date.
What are the incident reporting deadlines?
An early warning to CSIRT within 24 h, an incident notification within 72 h and a final report, plus a notification to the data protection authority within 72 h for a personal data breach. The Incidents module calculates these deadlines automatically and will not let you close a serious incident without registered notifications.
Who is accountable for implementing the ISMS?
The entity's management is accountable for the obligations of the Act — in a public office, personally the head of the office. The PDF report from the ISMS module shows them the current compliance status, and the system also tracks their training.
Is the requirements catalogue updated when regulations change?
Yes. Annual support includes new system versions, including updates to the KSC requirements catalogue after regulatory changes, installed from the administrator panel.
Where is the data stored?
On the client's server. We install LS PUPportal and LS Portal in the client's infrastructure, and the data never goes to the cloud or to third parties.
Does the AI assistant send data outside?
No. The language model runs on a server in the office network (e.g. a virtual machine with 8 vCPU, 16 GB RAM and 40 GB of disk), and PESEL numbers, e-mail addresses and phone numbers are masked. Other features need no extra hardware.
Will your ISMS be ready by the deadline?
We will show you the Incidents (KSC) and ISMS modules in action and help you plan the rollout in your organisation.
Book a presentation