KSC
Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa)
The amended Act (Dz.U. 2026 poz. 252): information security management system, incident handling and reporting, obligations of the head of the entity.
SelfAudyt by ZeroLayer, online compliance self-assessment
Check your compliance with KSC, NIS2 and GDPR before an auditor asks
You answer questions about your security measures, procedures and documents. At the end you get a score for each regulation, a risk register and a remediation plan with deadlines.
Covers
- KSC
- NIS2
- GDPR
- ISO 27001
- Legal referencesEach question cites the article the requirement comes from
- PDF and XLSX reportA summary for the board, the details for IT
Audit resultSample data
64%
Maturity level
Developing
Level 3 of 5
- GDPR78%
- NIS261%
- KSC55%
- ISO 2700166%
Top gaps
- No procedure for reporting incidents to the CSIRTCritical
- Backups without a restore testHigh
- No security assessment of IT suppliersMedium
Gaps come to light at the worst possible moment
Usually during an inspection, after an incident, or when a key customer sends a security questionnaire. That is when there is the least time to fix documents and safeguards.
Obligations under the amended Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC) must be implemented by 3 April 2027. Penalties for the head of the entity (Art. 73a) may be imposed from 3 April 2028.
- Nobody knows where to start. The requirements are spread across the Act, the Directive, the GDPR and the standard.
- The requirements spreadsheet takes on a life of its own. Every department has its own version and nobody owns the whole.
- The board asks how far you are from compliance and gets a list of technical acronyms.
- On the first attempt, the external audit flags things you could have found yourself.
From the first question to a remediation plan
Usually 30 to 90 minutes, depending on how many regulations apply to you. Nothing to install, it runs in the browser.
- 1
Entity classification
A few questions about your sector, size and line of business. SelfAudyt works out which regulations apply to you and switches on only those question modules.
- 2
Audit questions
You answer yes, partly, no or not applicable. Questions are weighted and cite the relevant provisions. For some of them, a “no” or “partly” answer opens follow-up questions.
- 3
Score and risks
An overall score, plus one for each regulation and area. Every gap goes into a risk register, rated on a 5×5 matrix.
- 4
Remediation plan
Quick wins, short-term and long-term actions, with deadlines. You assign them to people in your team and track progress.
Teamwork
- Invite people from IT, your data protection officer and HR to the organisation
- Roles: owner, administrator, team member
- Everyone sees their own tasks from the remediation plan
- Answers are saved every 30 seconds, so you can stop and come back
Try it: your 3-minute mini-audit
This is how SelfAudyt works, only shorter. Find out which regulations apply to you, answer a few questions and see your own risks, remediation plan and board summary.
Who does the audit cover?
GDPR Personal data protection
IncludedEvery organisation processes at least its employees’ data.
NIS2 NIS2 Directive
IncludedA sector listed in the annexes, and the organisation is above the small-enterprise threshold.
KSC KSC Act
IncludedA sector listed in the annexes, and the organisation is above the small-enterprise threshold.
ISO 27001 ISO/IEC 27001:2022
SkippedSwitch this module on if you plan certification.
A simplified example. The classifier in the app also asks about turnover and critical services. It does not replace legal analysis.
A report that works for both the board and the administrator
The same audit gives you two views: a short one for the board and a detailed one for the team that will close the gaps.
Compare successive audits on a chart, e.g. every quarter, and show the board your progress.
Maturity level
Developing
Regulations
- GDPR78%
- NIS261%
- KSC55%
- ISO 2700166%
Areas
- Governance70%
- Processes52%
- Technical64%
- People48%
- Documentation81%
Five maturity levels
- Advancedfrom 95%
- Compliantfrom 80%
- Developingfrom 60%
- Insufficientfrom 40%
- Criticalfrom 0%
What comes after the first audit
The score is only the starting point. These features help you prepare for an inspection and stay compliant in the months that follow.
Inspection preparation
Choose the type of inspection (UODO, NIS2 and CSIRT, ISO 27001 or KSC) and its date. You get a countdown, an auditor’s checklist, the gaps to close and a readiness score.
Auditor interview simulation
Questions an auditor may ask, with a sample answer and tips on which documents to have to hand.
Priority matrix and schedule
Remediation actions plotted by effort and risk reduction, then on a timeline: 14, 90 and 365 days. You can see what to do first.
Partial re-audit
A new audit starts with the answers from the previous one. You only change what has changed.
Recurring reviews
Set how often you come back to the audit, and the app shows when the next one is due. Compare each audit with the previous one on a chart.
Custom questions
Add questions from your internal policies or customer requirements. In the audit they are marked “Custom”.
Sector comparison
Your score against the sector median, and your percentile. The comparison is anonymous and appears when the database holds results from your sector.
Group view
All group companies on one screen: each company’s score, the group average, the total estimated exposure to penalties and a PDF report.
Try it: inspection preparation
Choose the type of inspection, tick off what you already have, and see a question that may come up in the auditor interview.
Until inspection
30 days
Readiness
40%
Auditor’s checklist
Interview simulation
“When did the head of the entity last complete cybersecurity training, and how was it documented?”
In the app, the answer has placeholders for your details, e.g. dates and process names.
Four regulations in one audit
The requirements often overlap: risk analysis, incidents, backups, training. You answer once, and the score is calculated for every regulation that applies to you.
NIS2
Directive (EU) 2022/2555
Risk management measures under Art. 21, incident reporting under Art. 23 and accountability of management bodies under Art. 20.
GDPR
Regulation (EU) 2016/679
Record of processing activities (Art. 30), processing agreements (Art. 28), security of processing (Art. 32) and notifying the supervisory authority of a breach within 72 hours (Art. 33).
ISO 27001
ISO/IEC 27001:2022
Information security management system requirements and the Annex A controls. Useful before a certification audit.
At the start, the classifier switches off modules that do not apply to you, so you do not answer unnecessary questions.
Who SelfAudyt is for
For anyone who has to answer how far the organisation is from compliance and does not want to start from a blank spreadsheet.
Companies without a compliance team
You get a list of actions in the order worth doing them, instead of dozens of pages of legislation.
IT and security
Detailed technical questions, a risk register and a plan that can be split into tasks.
Lawyers and data protection officers
Questions cite the relevant provisions, and the GDPR module checks the record of processing, processing agreements and breach reporting.
Management board
One score, the biggest risks and the decisions to make. In essential and important entities, the head of the entity is responsible for cybersecurity (Art. 8c of the KSC Act).
Corporate groups
Each company runs its own audit, and group management sees all the results and the total exposure in a single view.
Local government and public bodies
District offices, municipal offices and subordinate units. See what you already have and what needs to be in place by 3 April 2027.
The limits of self-assessment
The score shows how the organisation rates its own safeguards and documents. It does not replace an external audit, legal analysis or ISO/IEC 27001 certification. What it does let you do is close the obvious gaps before the audit and have a plan for the rest.
When the time comes for an external assessment, the ZeroLayer team runs audits and vCISO services. See ZeroLayer services.
From the blog
How to prepare the documents and processes that the self-assessment checks and an auditor asks about.
Compliance
Business continuity plan (BCP) and disaster recovery plan (DRP): what to include and what NIS2 requires
Business continuity and disaster recovery plans: how they differ, what to include, how to test them and what NIS2, the Polish KSC Act and GDPR require in 2026.
16 min read
Compliance
GDPR audit step by step: what to check before an auditor or a UODO inspection
GDPR audit step by step: 12 areas with legal provisions, evidence and a remediation plan, plus what Polish law says about how a UODO inspection works.
15 min read
Compliance
Record of processing activities (RoPA): how to build and maintain it in 2026
Record of processing activities step by step: Art. 30 GDPR elements, controller vs processor records, under-250 exemption, a sample entry and typical errors.
15 min read
Frequently asked questions
Your question is not here? Ask it during the demo or write to us.
What is SelfAudyt?
It is a self-assessment of compliance. The organisation answers structured questions about its safeguards, procedures and documents, and the tool calculates a score, points out the gaps and builds a remediation plan. Unlike an external audit, you do it at your own pace, without an auditor.
Does SelfAudyt replace an external audit or ISO 27001 certification?
No. SelfAudyt is a self-assessment: it shows how the organisation rates its own safeguards. It is not an auditor’s opinion, a legal analysis or a certificate. It helps you prepare for the audit, close the obvious gaps and gather the documents the auditor will ask for.
How long does SelfAudyt take?
It depends on how many regulations apply to you and whether you know the answers off the top of your head. You do not have to do everything at once: answers are saved automatically every 30 seconds, so you can stop and come back. You can invite people from your team to help.
How do I know which regulations apply to me?
SelfAudyt starts with a classifier: sector, number of employees, turnover, processing of personal data, critical services and ISO 27001 certification (held or planned). Based on this, it switches on the relevant modules. Whether an organisation is an essential or important entity is decided by the criteria in the Act. The classifier helps you check them initially, but it does not replace legal analysis.
What do I get at the end?
A percentage score for the whole organisation, each regulation and each area, a maturity level, a risk register on a 5×5 matrix and a remediation plan with deadlines. You export the report to PDF (full version and board summary) and to XLSX.
Does SelfAudyt help prepare for a UODO inspection or a NIS2 audit?
Yes. Once the audit is complete, you choose the type of inspection (UODO, NIS2 and CSIRT, ISO 27001 or KSC) and its date. You get a checklist of the documents an auditor usually asks for, a list of gaps to close before the inspection and an interview simulation with sample answers. This is preparation, not a guarantee of the inspection outcome.
Where are our answers stored?
Your answers are stored on servers in Poland.
Can I repeat SelfAudyt?
Yes. Each audit is a separate session, and you can compare the results of successive sessions on a trend chart. A partial re-audit copies the answers from the previous session, so you only change what has changed. A quarterly rhythm works well, or a repeat after a major change in the organisation.
See SelfAudyt applied to your organisation
We will show you the classifier, the questions and a sample report. The call is free and there is no obligation.
- Initial classification: KSC, NIS2, GDPR, ISO 27001
- A sample report for the board
- Answers to your questions about rollout