OT · process continuity and resilience · NIS2 and Poland’s KSC Act
Identify actions that protect process continuity and manage NIS2/KSC compliance
We help industrial operators assess safeguards, organise risk management and plan security improvements. We connect process protection with managing compliance with NIS2 and Poland’s National Cybersecurity System Act (KSC): from identifying obligations and assigning responsibilities to reviewing actions and gathering evidence.
For operators and IT/OT teams
Our services are for industrial plants, organisations using automation and infrastructure operators, including water utilities and municipal services. We work with management, those responsible for information security management and KSC compliance, automation engineers, maintenance teams, IT teams and suppliers.
OT includes control systems and technologies that affect physical processes. When assessing security, we consider service continuity, plant reliability and possible consequences for people, the environment and production quality.
We support organisations subject to the KSC Act and suppliers whose customers impose security requirements. We help organise the information needed to assess whether the legislation applies and define further work. Having OT systems alone does not determine whether an organisation falls within the Act’s scope.
Assessment, audit or training
OT assessment
Establishing the current situation through interviews, self-assessment and selected documents. We identify critical processes, key risks and readiness to fulfil applicable NIS2/KSC obligations. Outcome: a map of needs, missing information and actions over 30, 90 and 180 days.
OT audit
An assessment of an agreed scope against defined criteria and evidence. We combine a review of technical safeguards with an assessment of processes, responsibilities and documentation. Outcome: findings, risk assessment, gaps against the adopted requirements and prioritised recommendations with verification methods.
Training and exercises
Preparing management and IT/OT teams to fulfil their responsibilities and make decisions during an incident. Scenario exercises may cover loss of SCADA visibility, misuse of service access or failure of IT systems supporting OT. Outcome: agreed working arrangements, identified gaps and follow-up actions.
How the work progresses
We first define the service or process, environment boundaries, assessment criteria and permitted methods. For organisations operating in Poland, we relate requirements to the current KSC Act implementing NIS2, taking account of the organisation’s circumstances and relevant sector-specific provisions.
- Scope: we identify critical services and processes, assets, IT/OT dependencies and responsible people. We agree requirements and safe ways to collect data.
- Information: we conduct interviews and review documentation, records and available test results. We establish what is confirmed and what needs clarification.
- Risk: we link findings to consequences for people, the environment, service continuity and recovery. We distinguish gaps against requirements from risks to the process.
- Priorities: we identify urgent actions, management decisions and changes requiring a maintenance window or supplier involvement.
- Plan: we assign tasks, owners, deadlines and ways to confirm completion. We establish review and progress-reporting arrangements.
We organise the links: requirement → process → responsibility → action → evidence. The team knows what to do, management has a basis for decisions, and the organisation can demonstrate how it fulfils the adopted requirements.
Our reports distinguish interview statements, documented information and verified facts. We identify missing evidence and assessment limitations. We link documents, exercise results and system records to specific findings and the scope they substantiate.
Areas we can assess
- Obligations and oversight: applicable NIS2/KSC requirements, management roles, allocation of tasks, deadlines and the relationship between OT security and the information security management system (ISMS).
- Services, processes and assets: plant criticality, inventories, ownership and dependencies between IT, OT and suppliers.
- Risk and architecture: disruption scenarios, process impacts, segmentation and safeguards at environment boundaries.
- Access and servicing: accounts, permissions, remote access, activity logging and emergency access arrangements.
- Changes and vulnerabilities: updates, configurations, legacy devices, support limitations and compensating controls.
- Suppliers and procurement: contractual requirements, servicing arrangements, vulnerability handling and responsibility for system maintenance.
- Continuity and recovery: backups of programs and configurations, contingency plans, availability of documentation, parts and support, and conditions for a safe restart.
- Monitoring and incidents: event detection, assessment of service impact, escalation, operational decisions and preparation for reporting to the relevant CSIRTs.
- People and skills: preparation of management and staff, IT/OT cooperation and exercises appropriate to each role.
- Evidence and effectiveness: records, test results, safeguard reviews, resolution of findings and progress reports to management.
An action plan grounded in operational realities
We turn recommendations into tasks that can be carried out in a working plant. We account for maintenance windows, equipment limitations, supplier dependencies and the resources needed to implement changes.
The plan combines security improvements with compliance work: every task has an owner, a deadline, an expected outcome and a verification method. Our work can include regular implementation reviews, risk updates and evidence updates after changes to the plant.
30 days
Clarify obligations and responsibilities, identify critical processes and urgent risks. Organise information gaps, service access and actions requiring management decisions.
90 days
Implement priority changes, update records and procedures, and carry out agreed exercises or tests. Gather evidence of completion and assess the effectiveness of the measures introduced.
180 days
Complete changes requiring more preparation, review residual risk and progress against requirements. Establish the next cycle of assessments, exercises and reporting.
This is an example plan structure. Timing depends on risk, organisational capacity and applicable legal obligations. The 30/90/180-day framework organises the work and does not replace statutory deadlines.
Scope agreed before work begins
We establish whether the goal is an initial assessment, a detailed OT review, an NIS2/KSC gap analysis, audit preparation or support with an improvement plan. We define criteria, required evidence, team involvement and deliverables.
The initial assessment is based on interviews and a review of materials. Active scanning, penetration testing and a complete process-recovery test require a separate scope, impact assessment and operational agreement.
If the goal is an audit required by the KSC Act, we separately establish its scope and the requirements for the auditor’s qualifications and independence. Initial assessments and gap analyses prepare the organisation for further work.
Assessing an OT environment and the operator’s obligations differs in scope from assessing product security on the manufacturer’s side. Where these areas meet, we clarify the responsibilities of the operator, integrator and suppliers.
CRA services for manufacturers · Cryptographic readiness in long-life systems
Resources and tools
Resources that help explain requirements, prepare information about the organisation and begin work on OT security and NIS2/KSC compliance. We use them to support discussions, self-assessments and workshops.
nis2cra.com
Resources, analyses, qualification tools and initiatives on NIS2, the CRA and OT cybersecurity.
cratrace.com
cratrace — a project for managing information and evidence throughout the product lifecycle in the context of CRA requirements.
Let’s define your OT scope
Describe the type of plant, the key process and your need: an assessment, an audit, clarification of NIS2/KSC obligations or team preparation. Tell us your organisation’s current stage and what has already been done.
A general outline is enough to begin. We will help establish the starting point, expected outcome and scope of cooperation.