{"id":1313,"date":"2025-04-13T18:40:16","date_gmt":"2025-04-13T18:40:16","guid":{"rendered":"https:\/\/legalrocketscience.com\/?p=1313"},"modified":"2025-04-23T06:52:33","modified_gmt":"2025-04-23T06:52:33","slug":"nis2-w-grupach-kapitalowych-kto-ma-status","status":"publish","type":"post","link":"https:\/\/legalrocketscience.com\/en\/nis2-w-grupach-kapitalowych-kto-ma-status\/","title":{"rendered":"NIS2 in capital groups \u2013 who is qualified into the system?"},"content":{"rendered":"

Despite the fact that the process of preparing regulations implementing the NIS2 Directive in Poland has not yet concluded, ensuring an adequate level of cybersecurity is important from a practical standpoint. Furthermore, some obligations arising from EU regulations are suitable for application as they are already written. Therefore, in the event of a cybersecurity incident resulting from the failure to fulfill obligations specified in the NIS2 Directive, it will be possible to hold management board members liable. Where should one begin? <\/p>\n\n\n\n

How to check the NIS2 status of a key or important entity?<\/h2>\n\n\n\n

The NIS2 Directive specifies the types of entities that are subject to the obligations outlined within it. However, it leaves a margin of discretion for member states, which can modify certain rules defined in it. How can one go through the subsequent steps related to checking their status?<\/p>\n\n\n\n

The following should be verified, in order:<\/p>\n\n\n\n

    \n
  1. whether the conducted activity is on the list \u2013 <\/strong>that means, whether it falls within the types of activities listed in Annex I or II to the NIS2 Directive, and ultimately also within the provisions of the Act on the NCS adapted to these regulations (according to the draft of February 7, 2025, placed in Annexes 1 and 2 to this act),<\/li>\n\n\n\n
  2. what is the size of the enterprise being checked<\/strong>, in accordance with the same regulations that apply to applications for grants or other public funds, i.e., Recommendation 2003\/361\/EC) \u2013 whether one is a micro, small, medium, or large enterprise, because a significant portion of the obligations has been defined for medium and large entities.<\/li>\n\n\n\n
  3. whether the Act on the NCS (National Cybersecurity System) provides for specific regulations for the conducted activity<\/strong> (e.g., for public authorities or entities providing specific ICT services).<\/li>\n<\/ol>\n\n\n\n

    Until the amendments to the Act on the NCS come into force, any changes in status due to the size of the enterprise need to be checked on an ongoing basis. Ultimately, this will be an action carried out once a year \u2013 at the time of preparing the financial statement (drafted Article 5 paragraph 5 of the Act on the NCS). <\/p>\n\n\n\n

    What changes for entities operating within a capital group?<\/h2>\n\n\n\n

    The fact that within a group of related enterprises one has the status of a key or important entity according to NIS2 does not mean that the remaining enterprises are also subject to cybersecurity requirements. Each entity (natural or legal person) must verify its own status. How does it do that? According to the same steps mentioned above. This means that the mere fact of belonging to a capital group of energy or telecommunications companies will not cause a company to be subject to the requirements arising from cybersecurity regulations. This must be verified individually each time.<\/p>\n\n\n\n

    The Polish draft regulations implementing the NIS2 Directive introduce additional rules that may cause a micro or small entity to be classified in the same way as a medium or large one. In the context of NIS2, this means the status of an important or key entity. When does this happen? If the company being assessed conducts business jointly with other entities in a capital group or uses information systems jointly with them. In that case, its size for the purpose of status assessment is determined based on the data for the capital group (that part of it that operates jointly with such a company).<\/p>\n\n\n\n

    Shared Services Center (so-called SSC) \u2013 why does such a company usually have the status?<\/h2>\n\n\n\n

    Usually, within the structures of a capital group, especially in infrastructure or industrial entities, one entity is chosen to act as a service company. This means it provides technical (IT) and administrative (accounting, equipment supply, support for specific supporting processes) back-office functions. In the case of the Act on the NCS, the status of an SSC-type company is determined precisely by providing services related to server management, help desk support, workstation leasing, or license management for systems for other companies within the capital group. This activity falls under the definition of a managed service provider. <\/p>\n\n\n\n

    Realizacja us\u0142ug zarz\u0105dzanych czy us\u0142ug zarz\u0105dzanych w zakresie cyberbezpiecze\u0144stwa w ramach grupy kapita\u0142owej oznacza kumulacj\u0119 danych do okre\u015blenia wielko\u015bci podmiotu. Co oznacza, \u017ce je\u017celi obs\u0142ugiwane firmy przekraczaj\u0105 pr\u00f3g dla \u015bredniego przedsi\u0119biorcy, CUW wchodzi do krajowego systemy cyberbezpiecze\u0144stwa z w\u0142asnym statusem. W przypadku realizacji us\u0142ug SOC dla grupy kapita\u0142owej – wystarczy osi\u0105gn\u0105\u0107 pu\u0142ap dla ma\u0142ego przedsi\u0119biorcy, \u017ceby by\u0107 podmiotem kluczowym (projektowany art. 6 ust. 6 Ustawy o KSC).<\/p>\n\n\n\n

    \n\n\n\n

    Publication prepared on the basis of the following regulations:<\/sup><\/p>\n\n\n\n