NIS2/KSC · Local government

NIS2 and the KSC Act in local government units (JST)

For the public sector in Poland, NIS2 means obligations under the National Cybersecurity System Act (KSC Act) - and local government units (JST) are covered regardless of their size. Municipal (gmina) offices employing at least 50 people in full-time equivalents, district (powiat) offices and regional (voivodeship) government units are essential entities, while smaller municipal offices, schools, social welfare centres, cultural institutions and municipal companies are important entities.

Request a gap analysis Check your status

01Status

NIS2 in the public sector: which local government units are in scope

The “public entities” sector appears in both annexes to the Act. The status of a local government unit does not depend on its size - except for municipal offices, where the threshold of 50 full-time equivalents applies.

Essential entities (Annex 1)

regional (voivodeship) government - budgetary units and establishments, including the marshal's office (the administrative office of the regional government), but excluding schools and educational institutions, family support and foster care units, social welfare units (other than the regional social policy centre), regional labour offices and landscape parks,
district (powiat) offices,
municipal (gmina) offices that, on 1 January of a given year, employ at least 50 people under employment contracts, counted in full-time equivalents.

These units are essential entities regardless of their size (Art. 5(1)(4)(d)) and apply the full information security management system under Art. 8.

Important entities (Annex 2)

Local government budgetary units and establishments, local government cultural institutions and companies performing public utility tasks are important entities if they carry out a public task using information systems (Art. 5(2)(8)). Examples include:

According to the Ministry of Digital Affairs, a municipal office employing fewer than 50 people (employment contracts, in full-time equivalents, as at 1 January) is an important entity as a local government budgetary unit, while a municipal office with a unit that supplies water is an essential entity (Annexes 1 and 2, Public entities sector; Ministry of Digital Affairs, Q&A of 1 October 2026, questions 1.8, 1.29 and 3.24).
According to the Ministry of Digital Affairs, a public school run by a municipality, as a local government budgetary unit, is an important entity entered in the register ex officio, separately from the municipal office; non-public schools are in principle not subject to the Act because they are not public finance sector units (Art. 5(2)(8); Ministry of Digital Affairs, Q&A of 1 October 2026, questions 1.31-1.32).
The Ministry also classifies municipal social welfare centres and local government public libraries as important entities (Q&A of 1 October 2026, questions 3.36 and 2.40).

Associations of local government units are not part of the public entities sector - but they may be subject to the Act in another sector, e.g. as water suppliers (Q&A, question 3.25).

Local government public entities under the KSC Act (Annexes 1 and 2)
Type of entity	When it is subject to the Act	Legal basis
Regional (voivodeship) government: budgetary units and establishments - e.g. the marshal's office. Excludes schools and educational establishments, family support and foster care units, social assistance units (other than the regional social policy centre), voivodeship labour offices and landscape parks.	Essential regardless of size	Annex 1, Public entities sector, point 2
District (powiat) office	Essential regardless of size	Annex 1, Public entities sector, point 3
Municipal (gmina) or city office - an office with a unit that supplies water is, according to the Ministry of Digital Affairs, an essential entity; also check the “Supplier of water intended for human consumption” option.	At least 50 full-time equivalents - essential; smaller office - important (according to the Ministry of Digital Affairs)	Annex 1, Public entities sector, point 4; Annex 2, Public entities sector
Local government budgetary unit or establishment - e.g. a school, social assistance centre, road management authority, municipal services establishment.	Important if it performs public tasks using information systems	Annex 2, Public entities sector; Art. 5(2)(8)
Local government cultural institution - e.g. a library, cultural centre, museum, theatre.	Important if it performs public tasks using information systems	Annex 2, Public entities sector; Art. 5(2)(8)
Municipal company performing public utility tasks - if the company also operates in a listed sector (e.g. water, heat, waste), check that option as well.	Important if it performs public tasks using information systems	Annex 2, Public entities sector; Art. 5(2)(8) (Municipal Services Act)

You can also check the status of your unit with our NIS2 scope checker.

02Obligations

Local government obligations: Art. 8 or Annex 4

Essential and important entities have the same obligations regarding registration, contact persons and training for the head of the entity. The differences lie in the security management system, incident reporting and the audit.

Essential entity: municipal office with 50 or more FTEs, district office, regional government

An information security management system under Art. 8(1) - risk assessment, policies, business continuity, supply chain, monitoring and incident management.
Significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
At least two persons to liaise with the national cybersecurity system (Art. 9(1)).
A security audit at least once every 3 years, the first one by 3 April 2028.

Important public entity: smaller offices, schools, cultural institutions

Important entities that are public entities apply the requirements of Annex 4 to the Act instead of Art. 8(1) (Art. 8(3)). The Annex 4 requirements include an ICT inventory, access rights management, logically and physically separated backups with restore tests, anti-virus protection, up-to-date software versions without critical vulnerabilities, training and incident procedures; the system is reviewed at least once a year (Annex 4, Parts I and III; Art. 8(3)).
An important entity that is a public entity does not submit an early warning or any reports (Art. 12c).
At least one contact person (Art. 9(3)).
An audit only if ordered by the authority (Art. 15(1b)).

For both types of entity: the fine for the head of a public entity is up to 100% of their remuneration, and the measures under Art. 53(9) (including the ban on performing functions) do not apply to public entities (Art. 73a(5), Art. 53(10)). In a public finance sector unit, the head of the entity is the head of that unit (Art. 2(8a)), who also undergoes the annual training (Art. 8e).

03Authority and register

Competent authority, ex officio registration and incident reporting

Authority and supervision

The competent authority for the public entities sector is the Minister of Digital Affairs (for Ministry of National Defence units - the Minister of National Defence; for units of the Minister of Finance - the Minister of Finance); the minister may entrust supervisory tasks over essential public entities to CSIRT NASK, except for issuing decisions (Art. 41a(1)-(3) and (5)). A public entity that is also listed in another sector is supervised by the authority for that sector - except for local government public entities (Art. 41a(4)). A municipal company in the water or heat sector therefore remains under the supervision of the Minister of Digital Affairs as a public entity.

Registration

Local government public entities are entered in the register ex officio by the Minister of Digital Affairs - the unit does not apply, but supplies any missing data within 6 months of being asked to do so (Art. 7a(2), Art. 7b(2)). The notice is sent to the unit's address for electronic delivery or, if it does not have one, by post (Ministry of Digital Affairs Q&A, question 2.34).

Incidents

Notifications are submitted through the S46 system. Until the sectoral computer security incident response teams (CSIRTs) announce their readiness, incidents go to the competent national-level CSIRT - for local government units, as a rule, CSIRT NASK (Art. 26(6) of the KSC Act, Art. 44 of the amending act).

A small unit usually has no security team of its own - the Act allows it to entrust these tasks to a managed security service provider (Art. 14). The head of the unit nevertheless remains responsible (Art. 8c).

04Risks

Systems and risks in offices, schools and municipal companies

Systems

electronic document management and the electronic submission box,
line-of-business systems: local taxes and charges, finance and accounting, HR,
the Public Information Bulletin (BIP), the website and e-services for residents,
the electronic school register and other school systems,
systems provided by other public entities - Art. 8(4) requires them to be covered by the security management system.

What to look out for

A small IT team or a contracted IT specialist - the tasks under the Act have to be assigned, and suppliers bound by requirements in their contracts.
Shared services - a shared services centre may serve many schools or welfare centres, but each unit has its own entry in the register and its own obligations.
Backups and recovery - Annex 4 requires logically and physically separated backups and restore tests.
Accounts and access rights - revoking access when an employee leaves and suspending accounts after a month of absence (Annex 4, Part I, point 6).
Training - including for the head of the unit.

05How we help

Gap analysis, implementation and testing for local government

NIS2 gap analysis - classification of your units (essential and important), a review of the gaps against Art. 8 or Annex 4 and an implementation plan to meet the 3 April 2027 deadline.
NIS2 implementation - policies, incident procedures, backups and supplier requirements - also for a group of units served jointly.
Penetration testing - e-services, the BIP and the office network.
Board training - the duties of the head of the unit.

Municipal offices with at least 50 FTEs, district offices and regional government units undergo a security audit. We carry out the Art. 15 audit in cooperation with a partner whose auditors meet the statutory requirements - and we do not audit a unit that we helped to implement its security management system in the year before the audit.

Local government buys these services through public procurement - how to describe the subject of the contract and compare bids is explained in our NIS2 audit pricing guide. The obligations, with questions to check against, are collected in our NIS2/KSC checklist.

06Deadlines

NIS2 and KSC Act deadlines for local government

Registration: ex officio (Minister of Digital Affairs); missing data to be supplied within 6 months of the request.
Implementing the obligations in Chapter 3 of the Act: by 3 April 2027.
First training for the head of the unit: according to the Ministry of Digital Affairs, in 2027 at the latest (Q&A, question 3.46), then once every calendar year.
First audit of an essential entity: by 3 April 2028.
Moratorium on fines: fines under Art. 73(1)-(4), Arts. 73a-73c and Art. 76b may be imposed for the first time 2 years after the amendment entered into force (according to the Ministry of Digital Affairs - after 3 April 2028). The moratorium does not cover the fine of up to PLN 100 million (Art. 35 of the amending act).

Frequently asked questions

Does NIS2 apply to schools?

To public schools run by a municipality - yes. According to the Ministry of Digital Affairs, a public primary school run by a municipality is a local government budgetary unit, so it is an important entity and is entered in the register ex officio, separately from the municipal office (Q&A of 1 October 2026, question 1.31). It applies the simplified security management system set out in Annex 4 to the Act. Non-public schools are generally not subject to the Act because they are not public finance sector units - even if they receive a subsidy (question 1.32).

Is a small municipal office (fewer than 50 FTEs) subject to the KSC Act?

Yes - as an important entity. A municipal office is an essential entity if, on 1 January of a given year, it employs at least 50 people under employment contracts, counted in full-time equivalents; according to the Ministry of Digital Affairs, all other municipal offices, as local government budgetary units, are important entities (Q&A, question 1.8). Civil-law contracts and external contractors do not count towards the FTEs (question 1.29). An office with a unit that supplies water is an essential entity (question 3.24).

Does a local government unit have to apply for registration itself?

As a rule, no - public entities are entered in the register ex officio by the Minister of Digital Affairs, and the unit supplies any missing data within 6 months of being asked to do so (Art. 7a(2) and Art. 7b(2)). If a unit or a municipal company also operates in another sector listed in the annexes, e.g. it supplies water or heat, the ex officio entry does not release it from supplying data on that activity (Ministry of Digital Affairs Q&A, question 2.41).

Does an important public entity have to undergo a security audit?

There is no recurring Art. 15 audit - an important entity is audited only if the authority orders it by decision, e.g. after a significant incident. Annex 4 does, however, require the information security management system to be reviewed at least once a year. Essential entities - municipal offices with at least 50 FTEs, district offices and regional government units - carry out an audit at least once every 3 years, the first one by 3 April 2028.

Is a municipal company subject to NIS2?

A company performing public utility tasks is an important entity if it carries out a public task using information systems (Art. 5(2)(8)). If it also operates in a sector listed in Annex 1 - e.g. water supply or heat - it is also subject to the size rule for that sector: a large water company is an essential entity. In that case, the higher status applies (Art. 5(4)).

Sources

Legal status as of 8 October 2026 Updated 8 October 2026

Related services

NIS2/KSC · Gap analysis