Poland is at war. Critical infrastructure must be protected

• Work on amending the Act on the National Cybersecurity System - adapting our regulations to the EU NIS2 directive - has been going on for quite a long time.
• - They dragged on a bit, among other things because extensive social consultations were carried out with local governments - said Bartosz Dominiak, director general at the Ministry of Digital Affairs, in an interview with PortalSamorzadowy.pl.
• - It was at the request of the social side that many changes beneficial to local government units appeared in the draft of this act - he added.
• - The regulations regarding smaller local governments, including municipal offices employing up to 50 employees, will be less restrictive and therefore also less expensive - explained director Dominiak.

PortalSamorzadowy.pl: We are witnessing the rapid digitalization of public services. These are inevitable and at the same time very convenient IT solutions for residents and offices. However, are appropriate measures for cybersecurity following this process?

Bartosz Dominiak, Director General at the Ministry of Digital Affairs: Cybersecurity is of course very important due to the ongoing digitalization, but also because of what is happening beyond our eastern border.

Today, Poland is not actually in a state of war as we know it from history, but we are in a state of war in the form of attacks carried out on us in the virtual world. That is why expenditures on cybersecurity in our country are growing, although we would certainly like to have even more funds for this purpose .

As the Ministry of Digital Affairs, we try to support, among others, local governments in this area, because we know that the "mythical" one IT specialist connecting printers will not be able to ensure the security of all units today, even in a small commune.

Last year, the Cybersafe Local Government programme was launched, in which almost 2.5 thousand municipalities signed an agreement for subsidies from the Ministry of Digital Affairs for a total amount of almost PLN 1.5 billion .

What was the purpose of this money?

- These funds were allocated primarily to the organisation of training, as well as infrastructure, conducting audits and improving IT security management systems, which is very much needed by every local government today.

However, there was no imposed single scheme for spending this money. Personally, I believe, also as a former local government official, that training employees in public administration offices in the field of cybersecurity remains key.

Of course, hard infrastructure, software, and good IT support are also very important. However, the weakest link in this area is still human error.

Hence, cybersecurity training should cover all employees of a given institution, not only those dealing with IT or information security issues , but every employee at every level. Starting with local government management, i.e. mayors, presidents, commune heads, voivodeship marshals.

Watch the entire interview with the Director General of the Ministry of Digital Affairs, Bartosz Dominiak, in the video below:

Legislative work is underway to amend the act on the national cybersecurity system (KSC), which will implement the EU NIS2 directive in a rather restrictive manner. This involves additional costs for local governments. Will municipalities, cities and counties also be able to count on government funding in this regard?

- Work on the act amending the national cybersecurity system and adapting our regulations to the NIS2 directive (an EU legal act aimed at strengthening cybersecurity throughout the EU - ed.) has been going on for quite a long time. It dragged on a bit, but among other things because extensive public consultations were conducted, including with the local government side.

It was at the request of the social side that many changes beneficial to local government units appeared in the draft of this act.

In the original wording of the bill, all local government units were to be key entities in the field of cybersecurity. However, in the version currently being processed, smaller local government units - including municipal offices employing fewer than 50 employees - will not be key entities, but will still be important .

In smaller local governments, certain restrictions will of course also apply, but the costs of their implementation will be lower.

Local governments are already well aware that they are responsible for a significant part of the so-called critical infrastructure, including water supply systems.

- It is for this reason that, as part of the aforementioned Cybersafe Local Government program, as well as the Cybersafe Water Supply program, subsequent tranches of money are appearing for the IT reinforcement of local government units responsible for maintaining the water and sewage infrastructure and supplying water to residents.

This is about support for water and sewage companies covered by the national cybersecurity system . This is a very important part of critical infrastructure, which for obvious reasons must be particularly protected.

In addition, the draft act on the KSC envisages the creation of cybersecurity centres at the request of local governments, so that neighbouring municipalities, or even non-neighbouring ones, can jointly create such centres.

This will reduce their operating costs, because the scale effect can really bring a lot. One well-organized cybersecurity center - employing suitably qualified experts - can serve not just one commune, but several or even several dozen local governments.

* * *

The conversation was recorded during the 17th European Economic Congress (Katowice, 23-25 ​​April 2025).