KSC Entity Register

What the KSC Entity Register is

The KSC Entity Register — in Polish, wykaz podmiotów KSC — is an administrative record kept by the Polish public administration of organisations covered by the national cybersecurity system. KSC stands for krajowy system cyberbezpieczeństwa; the abbreviation is used untranslated in Polish practice and this entry keeps it that way, because the thing it names belongs to the Polish legal order and has no equivalent to borrow from English.

The function of the register is administrative, not promotional: it establishes who participates in the system, in what capacity, and whom the authorities should contact when something happens.

It is worth naming the ambiguity behind the question itself. Some readers want to see a list. Far more want an answer to one of two questions: are we covered, and what follows if we are. This entry addresses both — it does not settle the first on an organisation’s behalf, but it does show where that question is settled.

What entry into KSC means

Being listed is not an award, a licence or a certificate. It means the organisation is treated as a participant in the national cybersecurity system, so the duties designed for such participants apply. In practice that comes down to three things:

• Procedures — a settled way of handling an incident, rather than improvisation on the day.
• People — duties mapped onto named roles: who decides, who reports, who talks to the authority.
• Reporting — events meeting defined criteria are passed outside the organisation through the designated channel.

The direction of causation matters: the listing follows from what the organisation is; it is not the origin of its obligations. A company supplying services that a covered sector depends on does not stop mattering to that sector because no letter has arrived yet.

Who this typically concerns

Scope is set by the rules of the national cybersecurity system, not by headcount read off an org chart or by industry custom. Typically it concerns organisations whose continuity matters beyond themselves — energy, water and transport infrastructure, healthcare, digital services, public administration — together with the suppliers those sectors depend on.

That last group is the one most often caught off guard. A vendor of a sector-specific system, an integrator, an infrastructure maintenance provider or a cloud service supplier can matter as much in this picture as the operator itself — and usually learns about it from the requirements its client passes down into the contract.

What the register will not tell you

• It is not a vendor list or an endorsement. Being listed says something about the nature of the activity, not about the quality of the security controls.
• It is not an incident reporting tool. A separate channel exists for that (System S46).
• It is not a substitute for analysing your own position. The register is a record on the administration’s side, not a guide from which an organisation can derive its own status.
• It is not fixed forever. The set of participants and the wording of the duties in this area get amended, which is why this entry deliberately gives no deadlines, no provision numbers and no penalty figures. For the current wording, go to the official source.

Where the authoritative source is

Whether a given organisation is covered by the national cybersecurity system, and in what capacity, is determined by the competent Polish authority on the basis of the rules in force. That is the address for the question — not an IT vendor, not a write-up on the internet and not this entry. EITT does not keep the register, does not broker entries in it and issues no opinions on any entity’s status.

What is worth doing without waiting for a determination: settle internally who would decide to report an incident, on what basis, and in what order. Organisations that have this settled treat the scoping question as a formality. Organisations that do not discover two gaps at once — and usually at the least convenient moment.