Security audit - Key steps before implementing NIS2 and other european cybersecurity requirements

12.11.2025
Cybersecurity

Although the EU NIS2 directive has been in place in European law for almost three years, Poland, like some EU countries, is only now implementing it into their national laws. However, the new requirements are still ahead of us and will soon become the daily reality for tens of thousands of companies, organizations, and institutions in Poland. Many of them still wonder how to begin the "NIS2 implementation" process? The answer, however, is simple: a security audit.

The NIS2 Directive and other legal acts based on EU guidelines divide information security management into several areas and layers. Each layer allows for the implementation of effective methods for protecting, maintaining, and ensuring the continuity of services provided. Therefore, to answer the question of whether and to what extent our security system meets requirements, it is necessary to have a thorough understanding of its current status and the threats we may face.

Audit in compliance with NIS2 and regulations

The National Cybersecurity System transfers and clarifies NIS2 requirements to important and key Polish entities. Each requirement should be addressed both formally (within a set of procedures, regulations, and practices) and technically.

A comprehensive security audit is a process in which collected data on the current state of the security system is compared to specific benchmark requirements. This benchmark is typically the NIS2 directive and the uKSC, but it's worth adding requirements such as the ISO27001 standard, the National Interoperability Framework (for public entities), or the DORA regulation (for financial institutions).

Security audit methods

The audit covers the full set of methods used to protect resources, including:

  • the formal layer - usually represented in the form of an Information Security Management System,
  • the technical layer - composed of all technologies implemented in the organization to build a cybersecurity system,
  • the competence layer - represented by the general level of employee knowledge about cyber threats and the ability to detect social engineering attacks.

Each layer can be analyzed differently. While the ISMS methodology is based on analytical work, the technical layer offers a wide range of automated tests (vulnerability scans, penetration tests, red teaming, SAST and DAST testing). The crucial user competency layer should not be overlooked, as it can be assessed through social engineering attack simulations or cybersecurity knowledge tests.

Summary

While the security analysis process itself does not directly improve the effectiveness of security systems, it helps identify areas requiring additional attention. It allows for the shift of workload to those elements of our system that may constitute vulnerabilities and increase the risk of an incident. Therefore, it is worth planning such activities in your organization not only for the upcoming requirements arising from the NIS2 directive, but also in the future as part of regular analyses aimed at maintaining the quality of security systems.


Norbert Nowak, Cybersecurity Leader

He gained experience implementing projects in networking, storage, virtualization, and security systems for clients across a wide range of industries. He currently advises, designs, and builds comprehensive systems focused on data and system protection. Information security and cybersecurity are areas in which he continually develops and shares his knowledge through numerous lectures and publications.


Related articles