NIS2 readiness assessment
I check whether and how you fall under the act (essential / important entity), what you already have and what is missing. You get a gap report and a risk-ordered action plan – no legal jargon.
Wazuh NIS2 compliance – security monitoring
Since 3 April 2026 the amended Polish National Cybersecurity System Act implements NIS2. Thousands of mid-sized companies – and their suppliers – must prove they manage risk, detect incidents and report them within 24 hours. I deploy Wazuh: an open-source SIEM/XDR that covers the technical NIS2 requirements without six-figure licence fees. Plus procedures, documentation and ongoing care so the system does not just exist, but works.
What you get
Wazuh (SIEM / XDR) deployment
Wazuh server on-premise (Proxmox) or in the cloud, agents on Linux / Windows, log integration from firewalls, AD, servers and applications, dashboards for IT and management.
Incident detection and response
Correlation rules, alerts to email / Slack / Teams, Active Response (automatic blocking), response playbooks. Reporting to the CSIRT within 24 h becomes realistic because you see the incident immediately.
Vulnerabilities, configuration, integrity
Vulnerability Detection and configuration assessment (CIS Benchmarks) instead of a once-a-year audit; File Integrity Monitoring on critical systems, log retention and compliance reports from Wazuh – ready for an auditor or a customer.
Foundations: hardening, backup, access
MFA, VPN (WireGuard), network segmentation, Linux hardening, 3-2-1 backups with restore tests. NIS2 requires business continuity – not just monitoring.
Ongoing care
Monthly bundle: alert review, rule tuning, Wazuh and agent updates, a report for management. What the act requires: “continuously”, not “once at rollout”.
Wazuh and NIS2 requirements – what the system covers and what needs procedures
Article 21 of the NIS2 directive (implemented in the Polish KSC Act) lists minimum risk-management measures. This is how I map them to Wazuh and the rest of the rollout – honestly: some requirements are organisational, not software.
| NIS2 Art. 21(2) measure | How I cover it | Coverage |
|---|---|---|
| (a) Risk analysis and information system security policies | Security Configuration Assessment (CIS Benchmarks), Vulnerability Detection and system inventory (Syscollector) as input to risk analysis; policies written together with management. | Wazuh + rollout / procedure |
| (b) Incident handling | Log analysis and correlation rules, real-time alerts, Active Response, playbooks. A full incident timeline for the 24 h / 72 h / one-month reports. | covered by Wazuh |
| (c) Business continuity, backup management, disaster recovery | 3-2-1 backups (Proxmox Backup Server), backup job monitoring in Wazuh, regular restore tests, a continuity plan. | Wazuh + rollout / procedure |
| (d) Supply chain security | Monitoring supplier access and activity (VPN, SSH, service accounts); supplier requirements handled in contracts and procedures. | Wazuh + rollout / procedure |
| (e) Security in acquisition, development and maintenance, incl. vulnerability handling | Vulnerability Detection on every agent, CVSS-based priorities, patch reports, File Integrity Monitoring on configuration changes. | covered by Wazuh |
| (f) Assessing the effectiveness of measures | Wazuh dashboards and periodic reports (vulnerability trend, SCA score, incident count and handling time) – measurable KPIs for management. | covered by Wazuh |
| (g) Cyber hygiene and training | SCA enforces configuration hygiene (passwords, services, updates); staff training is the organisational part. | Wazuh + rollout / procedure |
| (h) Cryptography and encryption | SCA checks for TLS/SSH/disk encryption, a cryptography policy, TLS everywhere in the infrastructure. | Wazuh + rollout / procedure |
| (i) Human resources security, access control, asset management | Hardware and software inventory from agents, monitoring of logins and privilege changes (AD/LDAP, sudo); HR processes on the company side. | Wazuh + rollout / procedure |
| (j) Multi-factor authentication, secured communications | MFA/SSO and VPN (WireGuard) rollout, alerts on logins without MFA and from unusual locations. | Wazuh + rollout / procedure |
Technologies
- Wazuh
- SIEM / XDR
- File Integrity Monitoring
- Vulnerability Detection
- CIS Benchmarks
- OpenSearch
- Suricata
- WireGuard
- OPNsense
- Linux hardening
- Proxmox Backup Server
- Ansible
How we work together
- 01
Readiness assessment
A 2–3 h workshop with IT and management: scope, systems, processes. Within a week you have a gap report and a plan with a quote.
- 02
Wazuh deployment
Installation, agents, integrations, rules – usually 2–4 weeks. In stages, without switching off anything that works.
- 03
Procedures and documentation
Incident handling and reporting procedure, asset register, policies – consistent with what the system actually does.
- 04
Care and improvement
Ongoing bundle of hours: alerts, tuning, updates, reports. Support during audits or inspections.
Frequently asked questions
Does my company fall under NIS2 / the Polish KSC Act?
As a rule: medium and large companies (50+ employees or EUR 10M turnover) in the sectors listed in the act – energy, transport, health, water, digital infrastructure, ICT services, manufacturing, food, chemicals, postal services, waste, among others. But even a small company can be affected indirectly as a supplier to an essential entity. The readiness assessment settles this concretely; on legal questions I work with a law firm or your counsel.
What are the deadlines?
The act entered into force on 3 April 2026. Entities must self-assess and apply for registration by 3 October 2026, and implement an information security management system within 12 months – by 3 April 2027. Incident reporting: early warning within 24 h, notification within 72 h, final report within a month. (As of September 2026.)
Is Wazuh enough for NIS2 compliance?
Wazuh covers the technical layer: incident detection, integrity monitoring, vulnerability management, configuration assessment, audit trail and reporting. On its own it does not make you “compliant” – you also need procedures, management accountability, training and supply-chain security. That is why I combine the deployment with documentation and processes.
Why Wazuh and not a commercial SIEM?
Because it is open source (no per-host / per-GB licences), mature, actively developed and runs on your hardware – data never leaves the company. For a company with 50–500 endpoints the cost difference is typically tens to hundreds of thousands of PLN per year. You pay for deployment and care, not for licences.
How much does it cost and how long does it take?
Readiness assessment – fixed price, one week. Wazuh deployment for a typical company (dozens of servers and workstations) – 2–4 weeks, project quote after the assessment. Care – a monthly bundle of hours. Concrete numbers after a short call about the size of your environment.
What are your qualifications in this area?
For over 3 years I have been responsible for the security and monitoring of production infrastructure as a DevOps Engineer (authentication, hardening, ELK, Sentry), and in 2026 I completed the Securitum training “Wazuh – NIS2 compliance” on mapping the act’s requirements to Wazuh features. I also run Wazuh in my own homelab and in client environments.
Have a project or an infrastructure problem?
Write a few sentences about what you want to achieve. I usually reply within 24 hours and tell you straight away whether and how I can help.
Other things I can help with