ECP vs KSC (Poland): CyFun vs the Polish National Cybersecurity System

No. KSC is Poland's national NIS2 compliance framework. Belgium's NIS2 compliance path is CyFun, issued by the CCB. A Belgian entity audited by a Belgian CAB body is assessed against CyFun, not KSC. The two frameworks overlap substantially — both implement NIS2 Article 21 — but they are not mutually recognized across borders. A Polish entity operating in Belgium must satisfy both the Ministry of Digital Affairs (KSC) and the CCB (CyFun) for each jurisdiction.

Not natively today. ECP implements CyFun (the Belgian CCB framework). Because both KSC and CyFun derive from NIS2 Article 21 and share NIST CSF 2.0 influences, a Polish entity using ECP would build strong foundations — governance, evidence collection, incident workflows, vendor registers — that directly address KSC requirements. But ECP does not generate a KSC-ready ISMS package or map to the Polish CSIRT reporting structure. KSC support is on the product radar as part of the multi-framework engine; it is not yet scheduled.

Different delivery models. KSC is a legislative obligation — it sets what must be done but provides no guided platform, policy templates, or structured evidence collection. Compliance requires hiring consultants or a CISO to build and run an ISMS from scratch, which is why market estimates for a medium Polish entity run €20,000–€60,000 for initial implementation alone. ECP packages CyFun compliance into a guided platform with policy templates, evidence workflows, and a structured audit bundle. The MSP delivers this as a monthly service, not a one-time project. The platform absorbs the complexity; the per-client cost drops dramatically.

Yes, in their own right. Polish MSPs and ICT service providers (managed service providers, managed security service providers, cloud computing, data centres) fall under the "ICT service management (B2B)" sector in NIS2 — which means they are themselves classified as important entities and must comply with KSC for their own operations. They are not exempt because they serve clients. If you are a Polish MSP with 50+ employees or €10M+ revenue, you have your own KSC registration and ISMS obligation, separate from your clients'.

Largely yes. Polish law explicitly names PN-EN ISO/IEC 27001 and ISO 22301 as recognized standards meeting KSC ISMS requirements. An entity with a current ISO 27001 certification would be well-positioned to demonstrate KSC compliance, though the auditor will still assess KSC-specific obligations (sector-specific requirements, CSIRT reporting, registration). ISO 27001 does not automatically satisfy KSC, but it covers the bulk of the technical and governance layer. This is a real advantage of KSC over CyFun: Belgian CAB auditors assess against CyFun controls specifically; an ISO 27001 certificate does not substitute, though CyFun 2025 is NIST CSF 2.0 aligned.