The government issued cybersecurity recommendations for more than 70,000 entities

The recommendation of the Government Plenipotentiary for Cybersecurity is a catalogue of safeguards for key and important entities. It is intended to help them implement the obligations arising from the amendment to the KSC Act, which will become mandatory in April 2027.

On October 16, 2026, the Ministry of Digital Affairs published a recommendation from the Government Plenipotentiary for Cybersecurity. It concerns organizational and technical measures protecting information systems. The document is addressed to entities of the national cybersecurity system (KSC). According to the ministry's announcement, there are more than 70,000 of them.

The recommendations include, among others:

• risk management and security policies under the active oversight of management,
• full inventory of IT and OT assets (operational technology, e.g. production control systems),
• the principle of least privilege and multi-factor authentication (MFA, i.e. logging in with more than one identity confirmation),
• regular updates and vulnerability management,
• backups according to the 3-2-1 principle (three copies, two types of media, one copy outside the main environment) together with tests of their restoration,
• risk control for hardware and software suppliers,
• monitoring, incident response, employee training, and audits.

The document is not a set that every organization must implement in full. The selection of measures should depend on the nature of the activity, the level of risk, the importance of the services provided, and the infrastructure used. The recommendation supplements the Plenipotentiary's earlier recommendations. Those concerned, among other things, specific vulnerabilities in WordPress and cPanel/WHM panels, and those issued a few days earlier concerned securing water supply and sewage systems. The ministry announces further, more detailed guidelines.

The amendment to the KSC Act, which implements the EU NIS2 Directive, has been in force since April 3, 2026. Key and important entities had until October 3 to submit an application for entry in the register. By April 3, 2027, they must implement the new obligations, including an information security management system, incident response procedures, and supply chain protection. Penalties reach 10 million euros or 2 percent of global annual turnover for key entities, and 7 million euros or 1.4 percent of turnover for important entities.

The act mainly covers large and medium-sized companies from sectors such as energy, transport, healthcare, food production, and digital services. They can use the recommendation as a checklist before the April deadline. The full text of the document is available on the Ministry of Digital Affairs website (opens in a new tab).