Cybersecurity training for local government: how to train the office and its units

Since the amendment of the Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC; Dz.U. 2026 poz. 252), cybersecurity training for local government has been an obligation, not an add-on to a grant. The municipal office (urząd gminy), the county office (starostwo powiatowe) and many subordinate units must provide education for all staff, and the head of the municipality or county (wójt, burmistrz or starosta) completes training once a year. This article is for the IT specialist, the office secretary and the inspector who have to turn this into a working, documented process: from deciding who to train, through organising training in the office and its subordinate units, to the documentation you will show the auditor.

Once

per calendar year: training for the head of the unit and the person to whom they have entrusted duties

Art. 8e(1) of the KSC Act, Dz.U. 2026 poz. 252

100%

of salary: the upper limit of the penalty for the head of a public entity

Art. 73a(5) of the KSC Act

15

reported ransomware attacks on local government in 2025 (out of 30 on public entities)

CERT Polska, Annual Report 2025

Training and the Cyberbezpieczny Samorząd programme

One of the areas of the Cyberbezpieczny Samorząd (Cybersecure Local Government) grant programme was raising the competence of staff in local government units (JST), so some offices started training as part of the grant. According to a CPPC (Digital Poland Projects Centre) announcement of 16 June 2026, the deadline for completing projects and for eligible expenditure passed on 30 September 2026, and the results must be maintained for two years. The Cybersecurity Strategy of the Republic of Poland (M.P. 2026 poz. 309) announces that the programme will continue, but the rules and deadlines of a new edition have not been published. The obligations under the KSC Act do not depend on the grant, so training for new employees and the annual training for the head of the unit must be planned independently of it. The status of the programme, its settlement and open calls are described on the Cyberbezpieczny Samorząd page on the ZeroLayer website.

What obligations local government units have after the KSC amendment

The Act of 23 January 2026 amending the National Cybersecurity System Act (Dz.U. 2026 poz. 252) entered into force on 3 April 2026 and transposes the NIS 2 Directive into Polish law. Local government is placed in a separate sector, "public entities". We discuss the full list of entities and sectors in our article NIS2 and the KSC Act: who it applies to, and the specifics of public units on the page the KSC Act in a public entity.

Who is an essential entity and who is an important entity

Annex 1 (essential entities) lists, in the public entities sector, among others:

• in voivodeship (regional) government: budgetary units and budgetary establishments, excluding, among others, educational units, foster care units, most social welfare units and regional labour offices,
• in county government: the county office (starostwo powiatowe),
• in municipal government: the municipal office (urząd gminy), if on 1 January of a given year it employs at least 50 people under employment contracts, calculated as full-time equivalents.

Annex 2 (important entities) covers, in this sector, local government budgetary units, local government budgetary establishments, local government cultural institutions and companies performing public utility tasks. The act adds the condition that such an entity performs a public task using information systems. That is why a school, a social welfare centre or a municipal services company may have obligations of its own. The status of each unit has to be determined separately, based on its legal form and headcount. You can do an initial check with the test "Is my organisation covered by the KSC?", which has separate answers for county offices, municipal offices and subordinate units.

Obligations relating to people

Several provisions deal directly with employees and management:

• Art. 8(1)(2)(i) and (j): the information security management system (ISMS, in Polish SZBI) must include cybersecurity education for staff and basic cyber hygiene rules,
• Annex 4 (ISMS of an important entity that is a public entity): training for people who process information, with particular emphasis on types of cyber threats, cyber hygiene rules, incident response and awareness of the consequences of breaching security rules,
• Art. 8d point 4: the head of the entity ensures that staff are aware of their cybersecurity obligations and know the internal regulations,
• Art. 8e: the head of the entity and the person to whom their cybersecurity duties have been entrusted complete training once per calendar year, and their participation is documented.

Deadlines and penalties

Entities that met the criteria for being essential or important on the day the act entered into force have 12 months to fulfil the obligations in Chapter 3, i.e. until April 2027 (Art. 33 of the amending act). An essential entity carries out its first audit within 24 months.

The head of the entity may be subject to a financial penalty for failing to fulfil obligations, including those in Art. 8, 8d and 8e. For the head of a public entity, the upper limit is 100% of salary, calculated in the same way as the cash equivalent for unused annual leave (Art. 73a(5)). If a public entity is also covered by the act through another sector, the higher limit of 300% applies. Penalties under Art. 73 and 73a can be imposed for the first time after two years from the act's entry into force (Art. 35).

We write more about the provisions themselves in our article NIS2 and KSC training.

How to organise cybersecurity training for local government: step by step

This plan assumes a municipal or county office with several subordinate units. In a smaller municipality, some of the steps will take an hour.

Step 1. Establish who the obligation applies to

Make a list: the office, budgetary units, establishments, cultural institutions, municipal companies. For each, record its legal form, the number of full-time positions and whether it performs public tasks using information systems. The act allows a local government unit to provide shared services for fulfilling cybersecurity obligations or to conclude an agreement with another local government unit (Art. 16e(5) and (6)). If you do this, one unit can run training for all of them, which simplifies purchasing and reporting.

Step 2. Divide employees into groups

One training session for everyone rarely works. A practical division looks like this:

Step 3. Match topics to the office's risks

The starting point is the list in Annex 4: types of threats, cyber hygiene, incident response, consequences of breaches. Added to this are topics specific to local government: fake invoices and changes to a contractor's bank account number, impersonation of ePUAP (the Polish public administration e-services platform) or other institutions, sharing residents' data, remote work. Ransomware is not theoretical: in 2025 CERT Polska (Poland's national computer emergency response team) recorded 179 ransomware attacks, 30 of which were reported by public entities, and half of those concerned local government administration. We describe a good starting point for employees without a technical background in our article on cyber hygiene at work.

Step 4. Choose a format that reaches everyone

A social welfare centre employee who spends most of the day visiting clients will not come to a three-hour lecture. Here, microlessons of a few minutes, quizzes and phone access work better. Classroom training is best kept for management and incident response exercises, where discussion matters.

Step 5. Check behaviour, not just knowledge

A knowledge test shows that someone has read the material. A phishing simulation shows what they will do when a message arrives on an ordinary Tuesday at 2 pm. Campaigns are worth repeating several times a year, with different levels of difficulty. We write about how to prepare such tests in an organisation on our phishing tests page. Before the first campaign, tell employees that tests will be carried out and agree with the data protection officer what data will be collected.

Step 6. Build training into onboarding and the annual cycle

A new employee should complete a basic module before receiving full access to systems. Once a year, a refresher for everyone, annual training for the head of the unit and the person responsible, and after a more serious incident or a change in procedures, a short update. Record the schedule in the ISMS policy so that it does not depend on one person.

How to document training for audits and inspections

Art. 8e states explicitly that the head of the entity's participation in training must be documented. For staff training, documentation is just as necessary, because the auditor will check whether the education required by Art. 8 and Annex 4 actually works. Prepare a file containing:

1. the approved annual training plan, with target groups and topics,
2. named lists of participants with module completion dates,
3. knowledge test results and completion certificates,
4. phishing campaign reports (open, click and report rates, without publicly identifying individuals),
5. confirmation of the annual training for the head of the unit and the person responsible, with a scope of topics corresponding to Art. 8e(2),
6. a record of employees having read the internal regulations (Art. 8d point 4).

If the platform generates and exports these reports itself, audit preparation is much shorter. The sample training report shows what such an export looks like, and the NIS2/KSC checklist contains the list of evidence with references to the provisions.

What to show the auditor

The file alone is not enough if it does not show that the training covers everyone and meets the requirements of the act. During an inspection, a short summary that ties the documents together is useful:

• which module covers which requirements: in an important entity that is a public entity, the topics in point I.17 of Annex 4 (cyber threats, cyber hygiene, incident response, consequences of breaches); in an essential entity, the education and cyber hygiene required by Art. 8(1)(2)(i) and (j),
• what percentage of employees of the office and of each subordinate unit completed training in a given year,
• how new employees complete training before being granted full access,
• what changed in the programme after an incident, a change in procedures or the results of phishing simulations.

The summary is usually prepared by the person responsible for cybersecurity. It is worth having it approved by the head of the unit, because they are responsible for fulfilling the obligations (Art. 8c).

Where Akademia ZeroLayer fits in

Akademia ZeroLayer is a remote cybersecurity training platform: video microlessons, quizzes, games, phishing simulations, certificates and a manager dashboard with training reports. Training of this kind can be part of local government projects, and whether the expenditure is eligible under a given programme is always decided by that programme's rules. Security deployments in public units are described on the ZeroLayer for local government page. We describe the available plans in the Options section, and we will go through the scope of training for the office and its subordinate units in a free demo.

FAQ

Does training for the office have to be funded from the Cyberbezpieczny Samorząd grant?

No. The obligation to educate staff and to provide annual training for the head of the unit comes from the KSC Act, not from the grant agreement. The deadline for completing projects in the programme passed on 30 September 2026, and the Cybersecurity Strategy of the Republic of Poland of March 2026 announces its continuation without any rules or deadlines published yet. Training therefore has to be planned in the unit's budget independently of the grant.

Is every municipal office an essential entity?

No. Annex 1 to the KSC Act lists the municipal office if on 1 January of a given year it employs at least 50 people under employment contracts, calculated as full-time equivalents. The county office is listed without a threshold. A smaller office and subordinate units may be important entities if they meet the conditions of the act.

Who has to be trained once a year?

Art. 8e requires annual training for the head of the entity and for the person to whom the head's cybersecurity duties have been entrusted, with documented participation. For other employees, the act requires education and training as part of the ISMS, without specifying how often. An annual cycle is sensible practice.

What penalty does the head of a unit face?

For the head of an essential or important entity that is a public entity, the penalty under Art. 73a can reach up to 100% of salary, calculated in the same way as the cash equivalent for unused annual leave. Penalties can be imposed after two years from the amendment's entry into force, i.e. not before April 2028.

Sources

• Information on changes to the competition documentation for "Cyberbezpieczny Samorząd" (Informacja o zmianach w dokumentacji konkursowej „Cyberbezpieczny Samorząd”) — Digital Poland Projects Centre (Centrum Projektów Polska Cyfrowa), 16 June 2026 (in Polish)
• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw, Dz.U. 2026 poz. 252) — Journal of Laws (Dziennik Ustaw), published 2 March 2026 (in Polish)
• Text of the act Dz.U. 2026 poz. 252 (PDF) — Chancellery of the Sejm, ISAP, 2026 (in Polish)
• CERT Polska Annual Report 2025 (Raport roczny 2025 z działalności CERT Polska) — CERT Polska / NASK PIB, 2026 (in Polish)
• Resolution No. 92 of the Council of Ministers of 10 March 2026 on the Cybersecurity Strategy of the Republic of Poland (Uchwała nr 92 Rady Ministrów z dnia 10 marca 2026 r. w sprawie Strategii Cyberbezpieczeństwa Rzeczypospolitej Polskiej, M.P. 2026 poz. 309) — Monitor Polski, 23 March 2026 (in Polish)