For years, cybersecurity at universities was treated mainly as an IT responsibility. Poland’s new cybersecurity framework changes that approach. Under the amended National Cybersecurity System Act, digital security becomes part of managing the entire institution, and university leadership is responsible for ensuring that the organisation has appropriate governance, resources and procedures.
This does not mean a rector is expected to identify software vulnerabilities, configure networks or analyse technical logs. The responsibility is managerial: ensuring that the university has an information-security management system, sufficient funding, clearly assigned roles, incident-response procedures and effective oversight.
What NIS2 changes
NIS2 is the EU directive designed to raise cybersecurity standards across member states. It covers organisations operating in sectors important to the functioning of the state, economy and society. The framework requires not only technical safeguards, but also risk management, incident response, business continuity and supply-chain security.
The most important change is conceptual. Cybersecurity is no longer treated solely as a specialist IT function. Senior decision-makers need to understand the main categories of risk, allocate resources and supervise implementation.
Polish universities are digital organisations
University systems now support almost the entire student lifecycle — recruitment, enrolment, schedules, grades, financial settlements, applications, document circulation and graduation. They process data concerning candidates, students, graduates, lecturers and administrative employees.
A system outage during recruitment or examinations can disrupt core university operations. Unauthorised access can expose data, allow information to be changed or enable an attacker to use a compromised identity for further activity.
Cybersecurity must therefore be assessed not only through the lens of personal-data protection. Availability, integrity and the ability to restore services after an attack or failure are equally important.
Which universities are covered?
Poland implemented the new framework through an amendment to the National Cybersecurity System Act that entered into force on 3 April 2026. The Polish legislation covers higher-education institutions more broadly than the minimum scope of the NIS2 directive.
Universities and selected entities in the higher-education and science system are generally classified as important entities in the research sector. Under certain circumstances, an institution may also be classified as a key entity.
This means the requirements are not limited to the largest technical universities or research institutions. Smaller higher-education schools may also fall within the framework despite major differences in size, risk profile and financial capacity.
Entities that met the statutory conditions when the law entered into force received 12 months to adapt. That period should be used to clarify responsibility, review systems and supplier contracts and prepare the required procedures.
What university management is responsible for
The act places responsibility for cybersecurity obligations on the head of a key or important entity. At a university, this will generally be the rector, subject to the institution’s legal structure and representation rules.
The responsibility is primarily managerial. It includes decisions concerning preparation, implementation, use, review and supervision of the information-security management system. It also includes ensuring adequate financial resources, assigning tasks and verifying that they are performed.
Delegating operational work does not fully transfer responsibility. A rector can assign technical tasks to specialists, but senior management remains responsible for whether the institution has been organised appropriately.
The rules also provide for annual documented training for the head of the entity. Decision-makers responsible for budgets, suppliers and organisation need to understand the main risks and the consequences of their choices.
Responsibility does not mean guaranteeing that no attack will happen
Even a well-protected institution can be attacked. The law does not require a rector to guarantee that no incident will ever occur. What may be assessed is whether the university managed risk properly.
Key questions include whether the institution knew what assets it had, identified threats, kept software updated, controlled access, created backups and tested whether those backups could actually be restored. Incident-response procedures, business-continuity plans and staff preparation are also critical.
Compliance therefore cannot be reduced to buying another security product. The foundation is a documented and continuously improved management system with clear decision-making and accountability.
Cloud providers take tasks, not the university’s legal responsibility
More universities are using cloud-based systems. External providers can handle infrastructure, monitoring, updates, backups, vulnerability management and service restoration. But outsourcing technical work does not remove the university leadership’s responsibility.
Contracts should clearly define security standards, backup and restore testing, response times, incident-notification procedures, access controls, data-processing locations, audit rights and the process for ending cooperation and safely migrating information.
The purpose of outsourcing should be to distribute tasks in a controlled way while the university retains oversight of key decisions.
Formal compliance is not the same as resilience
A university may have procedures and policies on paper and still be poorly prepared for an incident. Documentation needs to describe measures that actually operate and are regularly tested.
That applies especially to backups, access management, monitoring, incident response and continuity plans. What matters in a crisis is not merely whether a procedure exists, but whether staff can demonstrate that it has been tested and can be used effectively.
Where should universities start?
The first step is to determine whether the institution falls under the new obligations and in what category. The university should then inventory its systems, data, processes and suppliers and identify which services are critical.
It should review contracts and procedures, including how quickly a supplier must report an incident, who decides to activate contingency plans, how long restoration will take and how the usefulness of backups is verified. Staff also need clear channels for reporting suspicious messages, unusual system behaviour or accidental data exposure.
The broader lesson from NIS2 is that cybersecurity has become an element of university governance. The rector’s role is not to replace IT specialists but to create the organisational conditions in which digital security is properly funded, managed and controlled.
Source: ManagerPlus.
