System S46

What System S46 is

System S46 is an IT system operated by the Polish public administration and used to report cybersecurity incidents. It is the reporting and communication layer of Poland’s national cybersecurity system, known by its Polish abbreviation KSC (krajowy system cyberbezpieczeństwa): organisations inside that system pass information about incidents to the competent authorities through this channel, and receive messages back the same way.

For a reader coming from outside Poland, two things are worth stating plainly. First, S46 is a proper name, not an abbreviation of a legal provision — so there is nothing to decode in the digits. Second, there is no English equivalent of this system to compare it with. A multinational that reports an incident in Poland reports it through Polish channels; the duty may look similar to duties elsewhere, the plumbing does not.

What it is used for

From the point of view of an organisation inside KSC, the system serves three purposes:

• Outbound reporting — the route by which information about an incident leaves the organisation and reaches the competent authority.
• Inbound communication — the same route carries messages from authorities and response teams back to the organisation.
• A named point of contact — the duty is not abstract; it maps onto specific people and specific roles inside the organisation.

From the state’s point of view the rationale is straightforward: an incident at one organisation is often the first visible sign of a campaign aimed at a whole sector. Reports scattered across phone calls and mailboxes do not add up to a picture of the situation. A standardised channel does.

Who it applies to

Scope is set by the rules of the national cybersecurity system, not by industry habit or by a headcount read off an org chart. Typically it concerns organisations whose continuity matters beyond themselves: energy, water and transport infrastructure, healthcare, digital services, public administration, and suppliers of services that those sectors depend on.

Two practical points that come up in nearly every conversation with clients:

1. Being inside KSC is a property of the organisation, not a choice it makes. There is no programme to opt into or out of.
2. The scope and wording of the duties change. Rules in this area get amended, and write-ups circulating online age badly. That is why this entry deliberately gives no reporting deadlines, no article numbers and no penalty figures — for the current wording, go to the official source rather than to a training company’s glossary.

What System S46 will not do for you

Most of the confusion around this system is about what it is not:

• It is not an incident response tool. It does not isolate a host, restore a backup or run forensics. People do that — your own team or an external one.
• It is not a register where you check your own status. The question “are we in scope” is answered outside the system.
• It is not a substitute for an internal procedure. If an organisation has no agreed reporting threshold, no decision path and no accountable person, having access to the channel fills none of those gaps — it only exposes them at the worst possible moment.
• It is not legal advice. The system accepts reports; it does not tell you whether an event is a reportable incident.

System S46 and organisational readiness

The hard question in KSC and NIS2 work is rarely “which button do we press”. It is who decides that this event is reportable, on what basis, and how fast that decision reaches the board. Access to the channel is the necessary and by far the easiest part. What happens inside the organisation from the moment of detection is the part that needs rehearsing.

In practice that means settling a handful of things while nothing is burning: event classification and a reporting threshold, an unambiguously named decision-maker plus a deputy, an escalation path to the board, a template for describing an event, and an event log good enough to reconstruct the sequence afterwards. None of that depends on the exact shape of the forms inside the system.

Where the authoritative source is

The authoritative source on System S46 — access procedure, reporting scope and the current wording of the rules — is the official government service run by the administration responsible for the system, together with the competent authority the organisation deals with. EITT neither operates the system nor brokers access to it. This entry explains the concept and its context; compliance decisions should rest on the official source and, where the stakes justify it, on legal advice.