Security Audits
and Compliance
We help organizations meet regulatory requirements and industry security standards. We carry out comprehensive compliance audits against ISO 27001, NIS2, GDPR, the NCSA, PCI DSS and DORA - from gap analysis to full support during certification.
- Experience with ISO 27001, NIS2 and DORA audits
- Auditors certified in CISA, CISSP, Lead Auditor
- End-to-end support: from gap analysis to certification
Choose your audit
Each audit has its own page: what we check, how it runs and what you get at the end. Not sure where to start? Get in touch and we will help you choose.
NIS2 Directive
Verification of compliance with the requirements of the NIS2 Directive for essential and important entities. Assessment of risk management, incident reporting and supply chain security.
Ask about the scopeNCSA / Act on the NCSS
For essential entities, which must undergo a security audit under Article 15 of the Polish KSC Act at least once every 3 years, and for important entities that the authority has ordered to undergo one.
Ask about the scopeISO 27001 audit
For organizations building an ISMS, running internal audits or preparing for ISO/IEC 27001 certification.
Scope and processDORA audit
For banks, insurers, investment and payment firms, and the ICT providers that receive DORA requirements from them.
Scope and processISO 22301 audit
For organizations building or running a business continuity system that want it checked before certification, a customer audit or a real outage.
Scope and processGDPR
Audit of personal data processing, data protection impact assessment (DPIA), verification of legal bases, breach notification procedures and the security of IT systems processing data.
Ask about the scopePCI DSS
Assessment of compliance with payment card data security requirements. ASV scanning, penetration testing and preparation for PCI DSS v4.0 certification.
Ask about the scopeHow do regulations connect with each other?
ISO 27001, NIS2 and DORA do not exist in a vacuum. They form a coherent ecosystem in which one standard is the foundation for the next. Understanding these dependencies is the key to efficient implementation.
ISO 27001
FoundationThe international ISMS standard. It forms the base on which the NIS2 and DORA requirements rest. Holding an ISO 27001 certificate significantly facilitates demonstrating compliance with both regulations.
NIS2 Directive
EU LawArticle 21(1) of NIS2 requires measures that take into account, where applicable, relevant European and international standards. A certified ISO 27001 ISMS covers a large part of these measures.
DORA Regulation
Financial SectorDORA is lex specialis relative to NIS2 for the financial sector. It requires an ICT risk management framework analogous to ISO 27001 and, for entities designated by the supervisory authority (in Poland the KNF), TLPT (red teaming).
Strategy: start with ISO 27001
Implementing ISO 27001 as the first step lets you build a solid ISMS foundation and cover a significant portion of the NIS2 and DORA requirements at the same time. It is the most cost-effective path to full regulatory compliance.
Regulatory timeline
GDPR adopted
The General Data Protection Regulation enters into force (applicable from May 2018). It establishes data protection standards across the EU.
ISO 27001:2022
The updated version of the standard is published with 11 new controls, including cloud security, threat intelligence and data protection.
NIS2 & DORA adopted
The European Parliament adopts the NIS2 Directive and the DORA Regulation. The transposition and preparation periods begin.
NIS2 transposition deadline
Member states were required to transpose NIS2 into national law. Poland is working on an amendment to the NCSA (Act on the NCSS).
DORA applies
The DORA Regulation begins to apply directly in all EU countries. Financial institutions must be fully compliant.
Entry into force of the NCSA (Poland)
The amendment to the NCSA transposing NIS2 enters into force after a vacatio legis of 1 month. New obligations for essential and important entities.
Entity registration (+6 months)
Obligation to submit a notification to the register of essential and important entities maintained by the minister responsible for digital affairs.
ISMS implementation (+12 months)
Deadline for implementing an information security management system compliant with the NCSA/NIS2 requirements.
First audit (+24 months)
Mandatory first Article 15 audit for essential entities. An important entity has to undergo it only when ordered to by the authority.
ISO 27001:2022
The gold standard of information security management. An Information Security Management System (ISMS) based on a process approach and continual improvement (PDCA).
Relationships with other regulations
Article 21(1) of NIS2 requires appropriate and proportionate risk management measures that take into account, where applicable, relevant European and international standards. ISO 27001 covers a large part of these measures, including incident management, business continuity and supply chain security.
The ICT risk management framework in Chapter II of DORA resembles ISO 27001, so a certified ISMS keeps your policies, risk assessment and controls in use. You still need to add major incident reporting within DORA deadlines, the register of information, Article 30 clauses in ICT provider contracts and TLPT if the KNF designates your entity.
ISO 27001 supports compliance with Article 32 of the GDPR (security of processing). It is complemented by ISO 27701 - an extension of the ISMS for privacy management (PIMS), which maps directly to the GDPR requirements.
Key NIS2 requirements
Risk management (Article 21)
Mandatory implementation of appropriate technical, operational and organizational measures. The risk assessment must cover the supply chain.
Incident reporting (Article 23)
Early warning within 24h, notification within 72h, final report within 1 month. Reporting to the CSIRT or the competent national authority.
Management accountability (Article 20)
Management bodies are personally accountable for approving and overseeing cybersecurity measures. Mandatory training for senior staff.
Supply chain security
Assessment of ICT suppliers, management of risks related to outsourcing and relationships with technology partners.
The NIS2 Directive
The broadest cybersecurity regulation in EU history. It sets strict requirements for essential and important entities in 18 sectors of the economy. The Polish KSC Act, which transposes NIS2, lists 19 sectors in its annexes.
Implementation timeline for NIS2 in Poland
From the entry into force of the act, organizations have strictly defined deadlines for registration, implementation of a security management system and the first audit.
DORADigital Operational Resilience Act
The first pan-European regulation on the digital operational resilience of the financial sector. It applies directly from 17 January 2025 - with no need for transposition.
The 5 pillars of DORA
ICT risk management
A framework for identification, protection, detection, response and recovery. ICT security policies, asset classification and business continuity.
Incident reporting
Classification of ICT incidents and reports to the supervisor. Initial notification within 4 hours of classifying the incident as major and, as a rule, no later than 24 hours after becoming aware of it. Intermediate report within 72 hours of the initial notification, final report within a month of the last intermediate report.
Digital resilience testing
Regular penetration testing, vulnerability scanning, scenario-based testing. Entities designated by the supervisory authority also undergo TLPT (Threat-Led Penetration Testing) at least every 3 years.
ICT third-party risk management
Due diligence of ICT providers, contractual clauses, exit strategies. Critical ICT providers are subject to direct oversight by the EBA/ESMA/EIOPA.
Threat information sharing
Encouragement to share information on cyber threats among financial entities within trusted communities (ISACs).
ISO 22301:2019
The standard for business continuity management systems (BCMS). Our audit checks whether, after a ransomware attack, a server room fire or a supplier going under, your organization will be back at work within the time it has itself defined as acceptable.
What we check during the audit
BIA and risk assessment (clause 8.2)
We check that the analysis covers all prioritized activities and that RTO and RPO were set by process owners, not by IT alone. Values copied from a template fall apart at the first question about where they came from.
Continuity strategies (clause 8.3)
We compare the RTO with what the organization can actually do. If restoring the database takes 12 hours, a 4-hour target is unrealistic.
Plans and communication (clause 8.4)
A plan should name specific people and their deputies. We also check whether the team can activate it when company email and chat are down.
Exercise programme (clause 8.5)
A plan nobody has exercised is a hypothesis. We read the post-exercise reports and check whether the lessons learned made it back into the plans.
Technical backup review
Ransomware groups usually start by deleting backups. We check whether backups are separated from the domain and the production network, and when someone last restored a whole system from them, not just a single file.
What does our audit look like?
We carry out audits in a structured and transparent way. At every stage we report on progress and involve the right people from your organization.
Kick-off and Scoping
Kick-off workshops with stakeholders. We define the audit scope, the selected standards/regulations, the schedule and the key systems to be assessed.
Documentation Review
Review of existing policies, procedures and registers. Mapping of information processing processes and identification of critical assets.
Technical and Organizational Audit
Interviews with key personnel, verification of system configuration, access control, logs, backups. Technical security testing.
Reporting and Remediation Plan
A detailed report with nonconformities, priorities and specific recommendations. An implementation roadmap with estimated time and resources.
Implementation and Support
We help implement the recommendations - from drafting policies, through system configuration, to preparing the team for the certification audit.
Co deliver?
We don't stop at the report. We deliver a comprehensive package of documents, policies and recommendations, and then help you implement them.
Gap Analysis
A detailed compliance matrix comparing the organization's current state with the requirements of the chosen standard or regulation. Identification of missing controls and implementation priorities.
Policies and Procedures
Development or update of complete ISMS documentation: Information Security Policy, incident management procedures, business continuity plan (BCP/DRP).
Risk Assessment
Methodical identification, analysis and evaluation of information security risks. A risk matrix with assigned responsibilities and risk treatment plans.
Technical Audit
Verification of the configuration of IT systems, networks, servers and applications against regulatory requirements. Hardening, access control, encryption and event logging.
Employee Training
Awareness programs for employees and management. Phishing simulations, incident response workshops and training on security policies and procedures.
Certification Support
We accompany you during the certification audit. We help answer auditors' questions, present evidence and close any nonconformities within the set deadline.
Why choose PWNONE?
We combine technical expertise with audit experience. Our specialists not only find compliance gaps, but understand the technical context and can point to the most effective solutions.
Certified auditors
CISA, CISSP, ISO 27001 Lead Auditor, CRISC - our team holds internationally recognized audit and security certifications.
Risk-based approach
We don't implement "blindly" - we prioritize controls based on the real risk to your business, industry and threat model.
Pentest + Compliance = the full picture
As both a pentesting and an audit firm, we combine both worlds. We complement compliance audits with real technical security testing.
Compliance audits conducted
Of clients achieved certification
Standards and regulations covered
Certified auditors
Questions about security audits
Which audits are mandatory and which are voluntary?
The security audit under Article 15 of the Polish KSC Act is mandatory. An essential entity undergoes it at least once every 3 years and, if it met the criteria on 3 April 2026, for the first time by 3 April 2028. An important entity undergoes it only when the authority orders it. A NIS2 gap analysis and ISO 27001 and ISO 22301 audits are voluntary, although business partners increasingly require ISO certification.
How do I choose an audit for my company?
A company covered by the Polish KSC Act starts with a NIS2 audit, that is, a gap analysis against the Act's obligations, and an essential entity also needs the Article 15 audit. A financial institution chooses a DORA audit. Before ISMS certification an ISO 27001 audit is useful, and if a few hours of downtime means real losses for you, an ISO 22301 audit. Not sure whether the Act covers you? Start with self-identification.
How is a compliance audit different from a penetration test?
A compliance audit compares your processes, documents and configuration with the requirements of a standard or a law. A penetration test checks in practice whether your security controls can be bypassed. We do both, so we complement compliance audits with technical testing.
How is an audit carried out?
We start with a workshop where we agree on the scope, standards and schedule. Then we review documents, talk to the people responsible and check system configuration, access rights, logs and backups. We finish with a report and a remediation plan. The Article 15 KSC audit is subject to an independence requirement (Article 15(2a)), so for any one client we do either the audit or the preparation for it.
What do I get after an audit?
A report listing nonconformities with their priorities and recommendations, plus a remediation plan with estimated time and resources. With a gap analysis you also get a compliance matrix that sets the requirements of the standard or law against what already works in your company.
Who conducts audits at PWNONE?
Audits are conducted by auditors from the PWNONE team, and you agree on the type and scope of the audit with Bartosz Machnik, an ISO/IEC 27001 lead auditor and NIS2 auditor certified by TÜV NORD Polska. In 2026 we carried out more than 10 audits related to the Polish KSC Act.