Security / Governance, Risk & Compliance

Training for the head of an essential or important entity (Article 8e of the Polish National Cybersecurity System Act)

A four-hour online training for the head of an essential or important entity and the person entrusted with the head's cybersecurity duties. The scope follows Article 8e(2) of the Polish National Cybersecurity System Act, and every participant receives a named certificate documenting attendance.

Article 8e of the Polish National Cybersecurity System Act (KSC) provides that the head of an essential or important entity, and the person entrusted with the head’s cybersecurity duties, completes training once every calendar year, and that attendance is documented. This training covers the scope set out in Article 8e(2) in four hours, without going into technical detail.

The training is not legal advice. Whether a given organisation is an essential or important entity has to be assessed case by case.

Benefits

Knowledge of the obligations of an essential or important entity covered by the Article 8e(2) training
Understanding of the decisions the Act assigns to the head of the entity in the information security management system
Knowledge of how a major incident is reported and what role management plays in it
A named certificate documenting attendance (Article 8e(3))

Who is this training for?

Heads of essential and important entities: board members, CEOs, directors of public bodies

Persons entrusted by the head with cybersecurity duties

Supervisory board members who want to understand the board's obligations

Prerequisites

No technical prerequisites

Training program

When an organisation is an essential or an important entity
Entry in the register of essential and important entities and keeping it up to date (Articles 7b–7f)

Requirements for the information security management system (Article 8)
Decisions and oversight the Act assigns to the head of the entity (Article 8d)
Vetting of persons performing cybersecurity tasks (Article 8f)
Security documentation (Article 10) and internal structures or a managed security service provider (Article 14)

Contact persons for the national cybersecurity system (Article 9)
Incident handling, early warning, notification and final report (Articles 11–12b)
The role of management in the first hours of a major incident

Security audit of the information system
Annual training of the head of the entity and documenting attendance (Article 8e)
Participants' questions and discussion of their organisations' situation

Delivery Methods

Online

Convenience of participating from anywhere
Interactive live sessions with trainer
Materials available for 30 days
No travel costs

On-site

Direct contact with trainer and group
Intensive hands-on workshops
Networking with other participants
Full focus on learning

Training Topics

NIS2 KSC Article 8e head of entity information security management incidents

Frequently asked questions

How much does training for the whole board cost?

A closed online session for a group of up to 15 people costs PLN 6,500 net, and an on-site session for a group of up to 12 people costs PLN 8,900 net plus travel costs. The open-session price is PLN 790 net per person.

Can the training be purchased for the following years?

Yes. The Act provides for the head of the entity to be trained once every calendar year, so we offer a contract for three consecutive annual editions with the price locked for the whole period and a 10% discount. The package includes a reminder about the date, a programme updated for changes in the law and named certificates every year.

In what format is the training delivered?

By default, live online in a single four-hour block. Open editions run once a quarter. A closed session for the board of one organisation can also be held on site.

Does the participant receive a document confirming attendance?

Yes. Every participant receives a named certificate listing the training scope. Article 8e(3) of the KSC Act requires attendance to be documented.

How does this training differ from the two-day programme for executives?

This module covers the Article 8e(2) scope in four hours and is designed as an annual update. The two-day NIS2/KSC programme for executives also covers strategy, supply-chain risk and a crisis simulation.