For local government: municipalities, counties, subordinate units
Cybersecurity training for local government, with documentation for the KSC Act
Video micro-lessons, quizzes, games and phishing simulations for officials, with certificates and training reports. For municipal offices, county offices and subordinate units, including after the Cyberbezpieczny Samorząd project has ended.
- A separate path and report for the head of the unit (Art. 8e)
- Numbered certificates and reports by department
- Scenarios based on attacks we see every day
Who in local government is covered by the KSC Act
The amended Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, Dz.U. 2026 poz. 252) has been in force since 3 April 2026. Local government sits in a separate “public entities” sector, in Annexes 1 and 2.
Essential entities
- A municipal office, if on 1 January of a given year it employs at least 50 people under employment contracts, counted as full-time equivalents
- A county office (starostwo powiatowe), with no headcount threshold
- In regional (voivodeship) government: budgetary units and budgetary establishments, excluding among others educational units, foster care, most social welfare units and regional labour offices
Important entities
- Local government budgetary units and local government budgetary establishments
- Local government cultural institutions
- Companies performing public utility tasks
- Condition: the entity carries out a public task using information systems
This is why a school, a social welfare centre or a municipal services company may have obligations of its own. The status of each unit is determined separately, based on its legal form and headcount. A local government unit can provide shared handling of cybersecurity obligations or conclude an agreement with another local government unit (Art. 16e(5) and (6)), in which case one unit can run training for all of them.
This description is indicative only and does not replace legal analysis. Take the test to check whether the KSC Act applies to your unit.
Training obligations of the office and subordinate units
The Act separates training for management from staff education. An important entity that is a public entity implements an information security management system according to Annex 4 to the Act (Art. 8(3)), which explicitly lists training topics.
The head of the entity may be fined for failing to meet the obligations under Art. 8, 8d and 8e. In a public entity, the upper limit is 100% of salary, calculated in the same way as the cash equivalent for annual leave (Art. 73a(5)). The obligations must be implemented by 3 April 2027, and fines can be imposed from 3 April 2028.
What goes into your audit folder
- A report with the date, scope and score of every training session, by department
- Certificates with a unique number for verification
- A separate path and a separate report for the head of the unit, for Art. 8e(3)
- Phishing simulation results as a test of cyber hygiene rules
Art. 8e
Head of the unit: once every calendar year
The mayor (wójt or burmistrz), the county head (starosta) or the head of the unit, and the person they have entrusted with cybersecurity duties, complete training once every calendar year. Participation must be documented (para. 3).
Annex 4, point I.17
Training for people who process information
With particular emphasis on four areas:
- types of cyber threats
- basic cyber hygiene rules
- responding to an incident
- awareness of the consequences of breaching information security rules
Annex 4, point I.14
Cyber hygiene in everyday work
Employees, including the head of the entity, apply cyber hygiene rules. Part II of the Annex additionally provides for testing these rules (point 6), for example with a phishing simulation.
After Cyberbezpieczny Samorząd: how to sustain the project’s results
Cyberbezpieczny Samorząd (FERC, Measure 2.2) is run by the Digital Poland Projects Centre (Centrum Projektów Polska Cyfrowa, CPPC) with NASK PIB as the Operator. One of its four support areas was raising the competences of key local government staff.
- final deadline for project completion and eligibility of expenditureCPPC, announcement of 16.06.2026
- 30.09.2026
- deadline for the Operator to verify final payment claimsCPPC, announcement of 16.06.2026
- 31.03.2027
- period for sustaining results under the grant agreementCPPC, announcement of 16.06.2026
- 2 years
Most local government units are now settling their projects and sustaining the results. We found no information in CPPC sources about another call in this format, so whatever was implemented has to be maintained from the unit’s own budget. New employees still have to be trained.
- 1
Onboarding new staff
A basic module before the employee gets full access to systems.
- 2
Annual cycle
A refresher for everyone and annual training for the head of the unit and the person responsible, recorded in the ISMS policy.
- 3
Phishing simulations
Several campaigns a year at different difficulty levels. You inform employees in advance and agree the scope of data collected with the data protection officer.
- 4
Documentation for inspections
Training plan, named attendance lists, test results, certificates and campaign reports in one folder.
Whether a specific expense is eligible is decided by the competition rules, the grant scheme and the grant agreement, not by a supplier’s declaration. Details and sources: Cybersecurity training for local government: how to train the office and its units.
Free material
NIS2/KSC checklist for the office and subordinate units
What should be in the training documentation for the head of the unit and employees before an audit or inspection. With references to specific provisions.
NIS2/KSC checklist: training for staff and the head of the entity
What to prepare in the training documentation for staff and the head of the entity, with references to specific provisions.
- Annual training for the head of the entity (Art. 8e)
- Staff education and cyber hygiene (Art. 8(1)(2)(i) and (j))
- A list of the evidence an auditor will ask for
Questions before you buy
Invoices, data processing agreement, accessibility, hosting. Don’t see your question? Ask it during the presentation or write to us.
Could the training be funded from the Cyberbezpieczny Samorząd programme?
The programme included a competence area, i.e. raising the knowledge of key local government staff. According to the CPPC announcement of 16.06.2026, the final deadline for eligibility of expenditure passed on 30.09.2026. Whether a specific expense was eligible is decided by the competition rules, the grant scheme and the grant agreement, and in case of doubt by the Operator’s helpline.
Do you issue invoices to local government units?
Yes, we issue VAT invoices to local government units.
Will you sign a data processing agreement?
Yes, we sign a data processing agreement with the office or unit in line with Art. 28 GDPR.
Does the platform meet WCAG 2.1 AA?
Yes, the platform meets WCAG 2.1 at level AA. This is the standard the Polish Digital Accessibility Act (ustawa o dostępności cyfrowej) requires for websites and apps of public entities.
Where is employee data hosted?
In Poland. We store employee data on servers located in Poland.
Does online training meet the requirements of Art. 8e?
The Act does not specify the form of training, only its frequency, scope and the obligation to document it. Online training can meet these requirements if the programme covers the provisions listed in Art. 8e(2) and the platform records named proof of participation with the date and score.
Can one office buy training for its subordinate units?
The Act allows a local government unit to provide shared handling of cybersecurity obligations or to conclude an agreement with another local government unit (Art. 16e(5) and (6)). One unit can then run training for all of them, which simplifies purchasing and reporting.
See the Academy in a local government setting
We’ll show you reports, certificates and phishing simulations for the office and its subordinate units. The call takes about 30 minutes, with no obligation.