Cybersecurity focuses on protecting computer systems, networks, data and other digital devices against attacks, unauthorized access, damage and information theft. We currently live in a world dominated by digital technology. Therefore, cybersecurity is becoming increasingly important as many aspects of everyday life, business, public administration and critical infrastructure rely on information technologies.

Cybersecurity mainly involves:

Cybersecurity also involves legal requirements

Common sense and ensuring security measures are a key element today, and legal requirements resulting from Polish regulations and those required by the EU complement the safety of our public organizations, state-owned enterprises, private companies and non-profit organizations.

The most important Polish legal acts include:

Regulation on the National Interoperability Framework of minimum requirements for public registers and exchange of information in electronic form and minimum requirements for ICT systems (KRI),

General Data Protection Regulation (GDPR-RODO),

Act on the national cybersecurity system (UKSC).

The Act on the national cybersecurity system results in a number of regulations, such as:
– Regulation on the list of essential services and the thresholds for the significance of the disruptive effect of an incident on the provision of essential services
– Regulation on the thresholds for classifying an incident as serious
– Regulation on organizational and technical conditions for entities providing cybersecurity services and internal organizational structures of key service operators responsible for cybersecurity

The EU has developed the CER and NIS2 directives, which complement each other’s requirements aimed at increasing the level of EU cybersecurity against all physical and digital threats.

There are also Directives on attacks on information systems or civil defense and patient rights in cross-border healthcare.

These legal acts impose obligations on Member States and entities operating in the digital space, requiring, among others: applying security measures, responding to incidents and international cooperation. All this aims to increase the EU’s resilience to cyber threats and protect the rights and security of citizens, companies and institutions in the digital age.

How to meet legal requirements regarding cybersecurity?

Meeting the requirements of EU cybersecurity directives requires a coordinated approach and the implementation of appropriate security measures.

This goal can be easily achieved by implementing an information and data security system in accordance with ISO/IEC 27001 and a business continuity system in accordance with ISO 22301.