{"id":35036,"date":"2026-10-26T05:00:00","date_gmt":"2026-10-26T04:00:00","guid":{"rendered":"https:\/\/sii.pl\/blog\/nis2-w-praktyce-co-to-znaczy-zarzadzac-lancuchem-dostaw-i-gdzie-w-nim-jestes-ty\/"},"modified":"2026-10-27T11:46:55","modified_gmt":"2026-10-27T10:46:55","slug":"nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in","status":"publish","type":"post","link":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/","title":{"rendered":"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \u2013 and where you fit in"},"content":{"rendered":"\n<p>A request for proposal from a client in energy, healthcare, or digital infrastructure looks different today than it did not so long ago. Alongside rates and timelines, new questions appear:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>who exactly on the team will have access to the systems,<\/li>\n\n\n\n<li>how that person has been vetted,<\/li>\n\n\n\n<li>how quickly access will be revoked,<\/li>\n\n\n\n<li>what the consultant will do if they notice something worrying.<\/li>\n<\/ul>\n\n\n\n<p>These questions come from the amended Polish Act on the National Cybersecurity System (the KSC Act), which implements the EU NIS2 Directive and has been applied since April 3, 2026. [1] One of its key requirements is <strong>supply chain security<\/strong>. [2]<\/p>\n\n\n\n<p>This text is not a law lecture. It shows what the supply chain is in practice, where an IT professional working at a client fits into it, and what to expect.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong><strong>In short: 5 things to remember<\/strong><\/strong><\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Companies covered by the Act (the Act calls them <strong>essential and important entities<\/strong>) must ensure the security of ICT (Information and Communication Technology) products, services, and processes supplied from outside. [3] A consultant with access to their systems is part of that chain.<\/li>\n\n\n\n<li>Responsibility for this lies with the client&#8217;s management, and from April 2028, financial penalties may be imposed for failures. [4, 5]<\/li>\n\n\n\n<li>Requirements reach the consultant mainly <strong>through the client&#8217;s contract and procedures<\/strong>, not directly from the Act.<\/li>\n\n\n\n<li>An exception worth noting: for some roles, the client must ask for information from the National Criminal Register (KRK). Keep this in mind if you need to join a project quickly. It is worth getting such a certificate in advance (you can apply online &#8211; the answer takes a few days &#8211; or get it immediately at a court that handles such applications. And note &#8211; you do not have to go to the court competent for your place of residence. In particular, you do not have to go to the court in Katowice; the queues for KRK certificates there are already too long. I recommend the courts in Sosnowiec or Gliwice :)) [6]<\/li>\n\n\n\n<li>The client has 24 hours for the first report of a significant incident. [7] <strong>Quick information from the consultant buys the client time.<\/strong><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Timeline: where we are<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td class=\"has-text-align-center\" data-align=\"center\"><strong>Date<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What happens<\/strong><\/td><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">3.04.2026<\/td><td class=\"has-text-align-center\" data-align=\"center\">The new rules enter into force<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">7.05 &#8211; 3.10.2026<\/td><td class=\"has-text-align-center\" data-align=\"center\">Companies covered by the Act apply for entry in the government register [8]<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">3.04.2027<\/td><td class=\"has-text-align-center\" data-align=\"center\">Deadline for implementing the obligations under the Act &#8211; including an information security management system (ISMS, i.e., a set of rules, procedures and safeguards, including towards suppliers), incident reporting and management training [9]<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">April 2028<\/td><td class=\"has-text-align-center\" data-align=\"center\">Deadline for the first audit of essential entities; from then on, penalties may be imposed [10, 5]<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>What it means for IT:<\/strong> companies that were covered by the Act from the day it entered into force have until April 3, 2027, to implement the obligations (the exception is former operators of essential services, who report incidents under the new rules after just 6 months). [9] That is why many clients are reviewing supplier contracts, sending security questionnaires, and adding new clauses right now.<\/p>\n\n\n\n<p>This is not a one-off exercise, but<strong> building a permanent process<\/strong> that the client will have to show to an auditor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What exactly is the &#8220;ICT supply chain&#8221;?<\/h2>\n\n\n\n<p>The Act refers to the security and continuity of supplies of ICT products, services, and processes on which the client&#8217;s service depends. [3] In practice, this means <strong>everything and everyone outside the organization, without whom its systems do not work, or through whom someone could get into them<\/strong>.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6ae0841deadb1&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6ae0841deadb1\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"926\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-1024x926.png\" alt=\"Elements of a typical ICT supply chain. Examples (author's illustration)\" class=\"wp-image-35038\" srcset=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-1024x926.png 1024w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-300x271.png 300w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-768x694.png 768w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-1536x1389.png 1536w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_1_supply_chain_HORIZONTAL_WEB_1-2048x1852.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Fig. 1 Elements of a typical ICT supply chain. Examples (author&#8217;s illustration)<\/figcaption><\/figure>\n\n\n\n<p>The NIS2 Directive gives examples: providers of data storage and processing services, managed security service providers, and software editors. It also points to suppliers &#8220;from other levels&#8221;, i.e., the client&#8217;s suppliers&#8217; suppliers \u2013 for example, your company&#8217;s subcontractors. [11]<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Three questions that help you recognize the &#8220;chain&#8221;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Does the client&#8217;s system depend on it?<\/strong> If a cloud provider&#8217;s outage stops the client&#8217;s service \u2013 it is part of the chain.<\/li>\n\n\n\n<li><strong>Does someone outside get access through it?<\/strong> A consultant&#8217;s account, a technician&#8217;s VPN, an integrator&#8217;s API key \u2013 every such access is a potential way in.<\/li>\n\n\n\n<li><strong>Does something from outside get in?<\/strong> A software update, a library in the code, a container image, and firmware.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What it means to &#8220;manage&#8221; the supply chain<\/h3>\n\n\n\n<p>The rules do not provide a ready-made procedure, but they indicate what the client must take into account:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>the supplier&#8217;s vulnerabilities,<\/li>\n\n\n\n<li>the quality of its products and services,<\/li>\n\n\n\n<li>its secure development practices, and<\/li>\n\n\n\n<li>EU risk assessments and whether the supplier has been designated a &#8220;high-risk supplier&#8221;. [12]<\/li>\n<\/ul>\n\n\n\n<p>The first two points sound great, especially for sales and negotiations, right? Elements that are hard to check and prove, such as &#8220;vulnerability&#8221; or &#8220;quality&#8221;, have been added to the technical assessment. How do you check and document them? Perhaps that is a topic for another article, &#8220;How to live with imprecise requirements&#8221;.<\/p>\n\n\n\n<p>The Directive also encourages putting security requirements directly into contracts with suppliers. [11]<\/p>\n\n\n\n<p>In practice, this creates a cycle:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td class=\"has-text-align-center\" data-align=\"center\"><strong>Activity<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What the client does<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What it means for you<\/strong><\/td><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">1. Inventory<\/td><td class=\"has-text-align-center\" data-align=\"center\">Lists suppliers and the scope of their access<\/td><td class=\"has-text-align-center\" data-align=\"center\">Your name goes into the register together with the scope of your permissions<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">2. Assessment<\/td><td class=\"has-text-align-center\" data-align=\"center\">Questionnaire, certificates, and discussion of processes<\/td><td class=\"has-text-align-center\" data-align=\"center\">Your company answers the questionnaire &#8211; you may get questions about the details of your work<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">3. Contract<\/td><td class=\"has-text-align-center\" data-align=\"center\">Adds requirements: incident reporting, team changes, audit rights<\/td><td class=\"has-text-align-center\" data-align=\"center\">You get specific obligations, e.g. an escalation deadline, a ban on shared accounts<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">4. Monitoring<\/td><td class=\"has-text-align-center\" data-align=\"center\">Access reviews, logs, and supplier audits<\/td><td class=\"has-text-align-center\" data-align=\"center\">Your account and activity may be reviewed periodically (I advise always assuming that everything you do on company equipment is constantly monitored)<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">5. Exit<\/td><td class=\"has-text-align-center\" data-align=\"center\">Revoking access, returning data, and equipment<\/td><td class=\"has-text-align-center\" data-align=\"center\">Access disappears on the last day &#8211; knowledge has to be handed over earlier<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong><strong>Why clients take this so seriously (or rather \u2013 why they should take supply chain security seriously)<\/strong><\/strong><\/h3>\n\n\n\n<p>In September 2024, criminals gained access to the infrastructure of Atende, a Polish IT integrator. From one file server, they took data on the company&#8217;s employees and its contracts with clients. Atende informed its clients about the data concerning them and extended two-factor authentication to all VPN accounts. [13]<\/p>\n\n\n\n<p>In January 2025, EuroCert, a trust service provider (including qualified signatures and seals) for many public institutions, fell victim to a ransomware attack. The Government Plenipotentiary for Cybersecurity advised the company&#8217;s contractors to, among other things, block remote access and IT infrastructure links with EuroCert, change credentials for related accounts, and implement two-factor authentication. [13] Both cases show the same thing: <strong>an incident at a supplier quickly becomes its clients&#8217; problem.<\/strong> When a supplier has an incident, the client first cuts off its access &#8211; and then asks what safeguards it had.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Three project scenarios<\/h2>\n\n\n\n<p><em><em>The scenarios are illustrative and do not describe specific clients.<\/em><\/em><\/p>\n\n\n\n<p>A. SAP consultant at an energy company<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td class=\"has-text-align-center\" data-align=\"center\"><strong>Situation<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What the client expects<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What to have ready<\/strong><\/td><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">The consultant develops a billing module. They have an account in the test environment and limited access to the production environment.<\/td><td class=\"has-text-align-center\" data-align=\"center\">A named account, multi-factor authentication (MFA), production access only on request, training on the client&#8217;s rules before the start, and notice of a project change.<\/td><td class=\"has-text-align-center\" data-align=\"center\">Training confirmation, a named escalation contact on the client side, and a reminder to report the end of work.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>B. Development team at a cloud provider<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td class=\"has-text-align-center\" data-align=\"center\"><strong>Situation<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What the client expects<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What to have ready<\/strong><\/td><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">A six-person team works in the client&#8217;s repositories and CI\/CD pipeline.<\/td><td class=\"has-text-align-center\" data-align=\"center\">Control over who approves changes to production, a list of open source libraries (SBOM), and a process for responding to vulnerabilities in dependencies.<\/td><td class=\"has-text-align-center\" data-align=\"center\">A description of code review and dependency management, a list of people with merge rights, and a vulnerability reporting path.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>C. Remote support at a hospital<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td class=\"has-text-align-center\" data-align=\"center\"><strong>Situation<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What the client expects<\/strong><\/td><td class=\"has-text-align-center\" data-align=\"center\"><strong>What to have ready<\/strong><\/td><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">The company maintains a patient registration system; technicians connect via VPN.<\/td><td class=\"has-text-align-center\" data-align=\"center\">No shared &#8220;service&#8221; accounts, access enabled only for the duration of a ticket, session recording, and quick information about incidents.<\/td><td class=\"has-text-align-center\" data-align=\"center\">Named accounts for each technician, an &#8220;access on demand&#8221; procedure, and a clear incident notification deadline in the contract.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">The consultant&#8217;s path through the client&#8217;s requirements<\/h2>\n\n\n\n<p>Most requirements can be placed on a single timeline \u2013 from the offer to the end of the project. Behind them, on the client side, are obligations relating to personnel security, training, and access control. [14]<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6ae0841dec9c9&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6ae0841dec9c9\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"711\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-1024x711.png\" alt=\"Stages of cooperation and typical requirements (author's illustration)\" class=\"wp-image-35046\" srcset=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-1024x711.png 1024w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-300x208.png 300w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-768x533.png 768w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-1536x1066.png 1536w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_2_journey_HORIZONTAL_WEB_1-2048x1422.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Fig. 2 Stages of cooperation and typical requirements (author&#8217;s illustration)<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">The incident clock \u2013 why hours matter<\/h2>\n\n\n\n<p>When the client experiences a <strong>significant incident<\/strong> (i.e., one that causes or may cause serious disruption of its services, financial loss, or serious damage to others), the client has 24 hours from detection to send an early warning to the competent incident response team (CSIRT), 72 hours to notify the incident, and one month from that notification to submit a final report. [7]<\/p>\n\n\n\n<p>The client reports, not the consultant. But it is often someone from outside who first notices that something is wrong. The Polish Act counts the time from &#8220;detection&#8221; of the incident, the Directive \u2013 from &#8220;becoming aware&#8221; of it. [15] Neither provision settles whether a problem noticed by an external consultant already starts the client&#8217;s clock. <strong>It is safer to assume that it does.<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6ae0841deeb29&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6ae0841deeb29\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"857\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-1024x857.png\" alt=\"Deadlines for reporting a significant incident. The timeline is not to scale\" class=\"wp-image-35042\" srcset=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-1024x857.png 1024w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-300x251.png 300w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-768x643.png 768w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-1536x1285.png 1536w, https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/EN_infographic_3_incident_clock_HORIZONTAL_WEB_1-2048x1713.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Fig. 3 Deadlines for reporting a significant incident. The timeline is not to scale<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Team exercise (5 minutes)<\/strong><\/h3>\n\n\n\n<p>Check whether everyone on the team gives the same answer:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Whom on the client side do I call\/message if I notice suspicious activity?<\/li>\n\n\n\n<li>Whom do I call\/message if I notice something suspicious in the evening or at the weekend, when my client contact does not answer?<\/li>\n\n\n\n<li>Does the client have an emergency number or an out-of-hours security on-call service, and do I know it?<\/li>\n\n\n\n<li>Whom do I inform in my own company, and will that delay the information reaching the client?<\/li>\n<\/ul>\n\n\n\n<p>If the answers differ, that is the first thing to agree with the client.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What does this mean for the consultant?<\/h2>\n\n\n\n<p>The Act places obligations on the companies it covers and on their management. It is the client&#8217;s management that is responsible for cybersecurity, even when it entrusts certain tasks to someone else. The financial penalties provided for in the Act can only be imposed 2 years after it entered into force, i.e., from April 2028. The external consultant is not the addressee of this liability. However, if they &#8220;contribute&#8221; to an incident, the situation is quite different, and we enter the territory of contractual liability.<\/p>\n\n\n\n<p>The absence of liability under the Act does not mean that nothing changes for the consultant.<\/p>\n\n\n\n<p>The changes are mainly <strong>contractual and organizational<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Longer onboarding.<\/strong> The client must ensure personnel security and training [14] \u2013 hence, additional statements and training before access is granted.<\/li>\n\n\n\n<li><strong>Criminal record information \u2013 for some roles.<\/strong> If the consultant is to help build the client&#8217;s security system or handle incidents, before starting work, they present information from the National Criminal Register confirming no conviction for offenses against the protection of information.<\/li>\n\n\n\n<li><strong>Strict access management.<\/strong> An account still active after the project ends is a risk an auditor will spot first.<\/li>\n\n\n\n<li><strong>Fast escalation.<\/strong> It is worth having the reporting deadline and path written into the contract.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>For the legal department to check: can the IT supplier itself be covered by the Act?<\/strong><\/h3>\n\n\n\n<p>The sectors covered by the Act also include <strong>managed service providers<\/strong> (whether a company is actually covered depends on, among other things, its size), i.e., companies that install, maintain, or administer the client&#8217;s systems \u2013 on-site or remotely. [16] A company supplying consultants who administer clients&#8217; systems should assess whether part of its business falls within this definition. If so, the obligations may apply to it directly, not only through contracts with clients.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Clients in the banking sector<\/h3>\n\n\n\n<p>For banks and financial market infrastructure, the EU sector-specific act is the <a href=\"https:\/\/sii.pl\/blog\/all\/dora\/\" target=\"_blank\" rel=\"noopener\" title=\"\">DORA Regulation<\/a>, and the Polish Act excludes most of the ISMS and incident reporting requirements for them. However, the rules on management responsibility, training, and criminal record information still apply to them. [17] For the consultant, the effect is similar: questions about vetting, access, and incidents will be asked anyway.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cheat sheet: the client&#8217;s question \u2013 where does it come from?<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>The client asks&#8230;<\/strong><\/td><td><strong>What lies behind it<\/strong><\/td><\/tr><\/thead><tbody><tr><td>Who exactly on your team has access?<\/td><td>Access control and asset management [14]<\/td><\/tr><tr><td>How do you vet consultants?<\/td><td>Personnel security; for some roles, criminal record information [14, 6]<\/td><\/tr><tr><td>Has the consultant completed training?<\/td><td>The obligation to train personnel [14]<\/td><\/tr><tr><td>How quickly will you notify us of an incident?<\/td><td>24 h\/72 h reporting deadlines [7]<\/td><\/tr><tr><td>Do you use subcontractors?<\/td><td>Assessment of supplier quality and security [12]<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Quick test: Is your team ready for NIS2?<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Do you know what the consultant vetting and onboarding process looks like in your area?<\/li>\n\n\n\n<li>Can you say in one sentence what you do when you notice something worrying in the client&#8217;s system (who, how quickly, through which channel)?<\/li>\n\n\n\n<li>Do you know when access is revoked after a project ends or a role changes?<\/li>\n\n\n\n<li>Does the standard contract include clauses on incidents, team changes, and audit rights, or do you add them every time?<\/li>\n\n\n\n<li>Is there one person or team responsible for answering clients&#8217; security questionnaires?<\/li>\n\n\n\n<li>Do you know whether your role at the client may require criminal record information?<\/li>\n<\/ol>\n\n\n<div class=\"nsw-o-blogersii-banner\">\n            <picture>\n            <source srcset=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/04\/Blog-CybersecDesktop_.jpg\" media=\"(min-width: 992px)\" >\n            <source srcset=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/04\/Blog-Cybersec-Mob_.jpg\" media=\"(min-width: 300px)\" >            <img decoding=\"async\" src=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/04\/Blog-CybersecDesktop_.jpg\" alt=\"\"  class=\"\"  >\n        <\/picture>\n        <div class=\"cnt\">\n                    <div class=\"nsw-m-title-block -h3 -invert  -has-title-margin-bottom-0 -has-title-font-weight-bold\">\n                                <h2 class=\"nsw-m-title-block__title\" >Cybersecurity<\/h2>\n                <\/div>\n                            <p class=\"has-nsw-p-4-font-size has-invert-color\">\n                We protect your data and IT environment with modern solutions and services \u2013 audits, penetration testing, continuous monitoring and incident response.\n            <\/p>\n                            <a  href=\"https:\/\/sii.pl\/en\/what-we-offer\/cybersecurity\/\" class=\"nsw-a-button -ghost -banner-button\"   >\n        <span>Cybersecurity offering<\/span>\n    <\/a>\n            <\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<p>For a client covered by the new rules, it makes no difference whether its environment is accessed by an external system or an external person. In both cases, it must be able to show that it knows the risk, has assessed it, and is managing it.<\/p>\n\n\n\n<p>For IT professionals, this means a few new habits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>named accounts,<\/li>\n\n\n\n<li>documented training,<\/li>\n\n\n\n<li>a known escalation path<\/li>\n\n\n\n<li>and properly closing access.<\/li>\n<\/ul>\n\n\n\n<p>I know, I know \u2013 more training and extra steps in the process are hell for IT, but it is a little compared with the cost of a lost contract, or of an incident nobody reported in time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Footnotes<\/h2>\n\n\n\n<p><em>&#8220;KSC Act&#8221; = the Polish Act of July 5, 2018 on the National Cybersecurity System (ustawa o krajowym systemie cyberbezpiecze\u0144stwa), consolidated text (ISAP, as of 18.08.2026). &#8220;Amending Act&#8221; = Act of January 23, 2026, Journal of Laws (Dz.U.) 2026 item 252. &#8220;NIS2 Directive&#8221; = Directive (EU) 2022\/2555, OJ L 333, 27.12.2022. Quotations from Polish legislation are unofficial translations; quotations from the NIS2 Directive follow its official English text.<\/em><\/p>\n\n\n\n<p>[1] Amending Act, Art. 49: &#8220;This Act enters into force one month after the date of its promulgation.&#8221; Published in the Journal of Laws on March 2, 2026. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20260000252\/O\/D20260252.pdf\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[2] NIS2 Directive, Art. 21(2)(d): the measures include &#8220;supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers&#8221;. <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32022L2555\" rel=\"nofollow\" >[s<\/a><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32022L2555\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" >o<\/a><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32022L2555\" rel=\"nofollow\" >urce]<\/a><\/p>\n\n\n\n<p>[3] KSC Act, Art. 8(1)(2)(e): &#8220;security and continuity of the supply chain of ICT products, ICT services and ICT processes on which the provision of the service depends, taking into account the relationships between the direct supplier of hardware or software and the essential entity or important entity&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[4] KSC Act, Art. 8c(1): &#8220;The head of an essential entity or an important entity is responsible for the performance of cybersecurity obligations (&#8230;)&#8221;; para. 3: &#8220;(&#8230;) also where some or all of the obligations have been entrusted to another person with that person&#8217;s consent.&#8221; NIS2 Directive, Art. 20(1): management bodies &#8220;can be held liable for infringements&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[5] Amending Act, Art. 35: &#8220;The financial penalties referred to in Art. 73(1)-(4) and Arts. 73a-73c and 76b (&#8230;) may be imposed for the first time after 2 years from the date of entry into force of the Act.&#8221; Penalty for the head of the entity: KSC Act, Art. 73a. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20260000252\/O\/D20260252.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[6] KSC Act, Art. 8f(1): &#8220;Before starting to perform the tasks referred to in Art. 8 or Art. 11, the person who is to perform those tasks shall present to the essential entity or important entity information from the National Criminal Register confirming that they have not been convicted of offences against the protection of information.&#8221; Art. 8 concerns the information security management system, Art. 11 &#8211; incident handling. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[7] KSC Act, Art. 11(1): the entity &#8220;4) submits an early warning of a serious incident without delay, no later than within 24 hours of its detection, to the competent sectoral CSIRT; 4a) notifies the serious incident without delay, no later than within 72 hours of its detection (&#8230;); 4c) submits to the competent sectoral CSIRT a final report (&#8230;) no later than within one month of the notification referred to in point 4a&#8221;. The KSC Act&#8217;s term &#8220;serious incident&#8221; (incydent powa\u017cny) corresponds to the NIS2 &#8220;significant incident&#8221;; definition: Art. 2(7). <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[8] Amending Act, Art. 33(3): applications for entry in the register are submitted &#8220;in accordance with the schedule set out in Art. 34(3)(1)&#8221;. Communication of the Minister of Digital Affairs of 8.04.2026 (Official Journal of the Minister of Digital Affairs, item 7): &#8220;from May 7, 2026 to October 3, 2026&#8221;. <a href=\"https:\/\/www.gov.pl\/attachment\/a3b63395-503b-426c-9913-6d0b6d3c205d\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[9] Amending Act, Art. 33(1): entities that meet the criteria on the date of entry into force of the Act &#8220;perform the obligations set out in Chapter 3 (&#8230;) within 12 months of the date of entry into force of this Act&#8221;. Chapter 3 of the KSC Act includes, among others, Art. 8 (ISMS), Arts. 8c-8f (head of the entity, training, criminal record) and Art. 11 (incidents). Art. 33(4): former operators of essential services &#8220;report serious incidents in accordance with Arts. 11-12b (&#8230;) within 6 months of the date of entry into force of this Act&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20260000252\/O\/D20260252.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[10] Amending Act, Art. 33(2): essential entities &#8220;carry out the first audit (&#8230;) within 24 months of the date of entry into force of this Act&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20260000252\/O\/D20260252.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[11] NIS2 Directive, recital 85: &#8220;(&#8230;) such as providers of data storage and processing services or managed security service providers and software editors (&#8230;) In particular, essential and important entities should be encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers. Those entities could consider risks stemming from other levels of suppliers and service providers.&#8221; <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32022L2555\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[12] KSC Act, Art. 8(2): the entity takes into account &#8220;1) vulnerabilities related to the supplier of hardware or software; 2) the overall quality of ICT products, ICT services and ICT processes originating from the supplier of hardware or software; 3) the results of the coordinated security assessment carried out by the Cooperation Group (&#8230;); 4) the results of the proceedings referred to in Art. 67b&#8221; (proceedings to designate a high-risk supplier). NIS2 Directive, Art. 21(3): &#8220;(&#8230;) the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[13] Atende statement of 22.10.2024\u00a0 <a href=\"https:\/\/atende.pl\/pl\/aktualnosci\/komunikat-atende-w-zwiazku-z-upublicznieniem-ukradzionych-danych\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a> ; Statement of the Government Plenipotentiary for Cybersecurity on the data leak resulting from the cyberattack on EUROCERT Sp. z o.o. <a href=\"https:\/\/www.gov.pl\/web\/cyfryzacja\/komunikat-pelnomocnika-rzadu-do-spraw-cyberbezpieczenstwa-ws-wycieku-danych-w-wyniku-cyberataku-wobec-firmy-eurocert-sp-z-oo\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[14] KSC Act, Art. 8(1)(2): &#8220;d) human resources security, (&#8230;) i) cybersecurity education for the entity&#8217;s personnel, (&#8230;) m) asset management, n) access control policies&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[15] NIS2 Directive, Art. 23(4)(a): &#8220;without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning (&#8230;)&#8221;. <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32022L2555\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[16] KSC Act, Art. 2(4i): &#8220;managed service provider &#8211; a natural person, legal person or organisational unit without legal personality that provides services related to the installation, operation or maintenance of ICT products, ICT services, ICT processes or information systems through support or active administration carried out at the service recipient&#8217;s premises or remotely&#8221;. Annex 1 (&#8220;Essential sectors&#8221; ): sector &#8220;ICT service management&#8221; &#8211; &#8220;Managed service provider&#8221;. <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n\n<p>[17] KSC Act, Art. 8i(1): to entities &#8220;in the banking and financial market infrastructure sectors, the provisions of the Act concerning the information security management system or the reporting of serious incidents do not apply, except for (&#8230;)&#8221;; para. 2: \u201c(&#8230;) Arts. 8c-8f, Art. 12(7) and Art. 31(1) apply accordingly.\u201d Link with DORA: NIS2 Directive, recital 28: &#8220;Regulation (EU) 2022\/2554 (&#8230;) should be considered to be a sector-specific Union legal act in relation to this Directive with regard to financial entities&#8221; and Art. 4(1) (primacy of sector-specific Union legal acts). <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20180001560\/U\/D20181560Lj.pdf\" target=\"_blank\" rel=\"noopener\" title=\"\" rel=\"nofollow\" ><\/a><\/p>\n\n\n<div class=\"kk-star-ratings kksr-auto kksr-align-left kksr-valign-bottom\"\n    data-payload='{&quot;align&quot;:&quot;left&quot;,&quot;id&quot;:&quot;35036&quot;,&quot;slug&quot;:&quot;default&quot;,&quot;valign&quot;:&quot;bottom&quot;,&quot;ignore&quot;:&quot;&quot;,&quot;reference&quot;:&quot;auto&quot;,&quot;class&quot;:&quot;&quot;,&quot;count&quot;:&quot;1&quot;,&quot;legendonly&quot;:&quot;&quot;,&quot;readonly&quot;:&quot;&quot;,&quot;score&quot;:&quot;5&quot;,&quot;starsonly&quot;:&quot;&quot;,&quot;best&quot;:&quot;5&quot;,&quot;gap&quot;:&quot;2&quot;,&quot;greet&quot;:&quot;&quot;,&quot;legend&quot;:&quot;5\\\/5&quot;,&quot;size&quot;:&quot;30&quot;,&quot;title&quot;:&quot;NIS2 in practice: what it means to \\u0026quot;manage the supply chain\\u0026quot; \u2013 and where you fit in&quot;,&quot;width&quot;:&quot;159&quot;,&quot;_legend&quot;:&quot;{score}\\\/5&quot;,&quot;font_factor&quot;:&quot;1.25&quot;}'>\n            \n<div class=\"kksr-stars\">\n    \n<div class=\"kksr-stars-inactive\">\n            <div class=\"kksr-star\" data-star=\"1\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"2\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"3\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"4\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"5\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n    <\/div>\n    \n<div class=\"kksr-stars-active\" style=\"width: 159px;\">\n            <div class=\"kksr-star\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 2px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 30px; height: 30px;\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n                \n\n<div class=\"kksr-legend\" style=\"font-size: 24px;\">\n            5\/5    <\/div>\n    <\/div>\n","protected":false},"excerpt":{"rendered":"<p>A request for proposal from a client in energy, healthcare, or digital infrastructure looks different today than it did not &hellip; <a class=\"continued-btn\" href=\"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/\">Continued<\/a><\/p>\n","protected":false},"author":832,"featured_media":35033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_editorskit_title_hidden":false,"_editorskit_reading_time":0,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","inline_featured_image":false,"footnotes":""},"categories":[1320],"tags":[15535,15533,15347,15162,2847,1655,1651],"class_list":["post-35036","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hard-development","tag-supply-chain-management-en","tag-nis2-en","tag-regulated-processes-en","tag-dora-en","tag-legal-regulation-en","tag-cybersecurity-en-2","tag-guidebook-en"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.9 - aioseo.com -->\n\t<meta name=\"description\" content=\"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Edyta Mia\u015bkiewicz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.9\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"blogersii\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"NIS2 in practice: what it means to &quot;manage the supply chain&quot;\" \/>\n\t\t<meta property=\"og:description\" content=\"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"733\" \/>\n\t\t<meta property=\"og:image:height\" content=\"456\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-26T04:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-27T10:46:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sii.Polska\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"NIS2 in practice: what it means to &quot;manage the supply chain&quot;\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#article\",\"name\":\"NIS2 in practice: what it means to \\\"manage the supply chain\\\"\",\"description\":\"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture\",\"inLanguage\":\"en-US\",\"headline\":\"NIS2 in practice: what it means to \\\"manage the supply chain\\\" \\u2013 and where you fit in\",\"author\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/author\\\/emiaskiewicz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/#organization\"},\"datePublished\":\"2026-10-26T04:00:00+01:00\",\"dateModified\":\"2026-10-27T10:46:55+01:00\",\"articleSection\":\"Hard development, Supply Chain Management, NIS2, Regulated processes, DORA, Legal regulation, Cybersecurity, Guidebook\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#webpage\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sii.pl\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Cybersecurity.jpg\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#articleImage\",\"width\":733,\"height\":456,\"caption\":\"NIS2 w praktyce: Co to znaczy \\u201ezarz\\u0105dza\\u0107 \\u0142a\\u0144cuchem dostaw\\u201d \\u2013 i gdzie w nim jeste\\u015b Ty\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/hard-development\\\/#listItem\",\"name\":\"Hard development\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/hard-development\\\/#listItem\",\"position\":2,\"name\":\"Hard development\",\"item\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/hard-development\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#listItem\",\"name\":\"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \\u2013 and where you fit in\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#listItem\",\"position\":3,\"name\":\"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \\u2013 and where you fit in\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/hard-development\\\/#listItem\",\"name\":\"Hard development\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sii.pl\\\/#organization\",\"name\":\"Sii Polska\",\"url\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/\",\"sameAs\":[\"https:\\\/\\\/www.instagram.com\\\/siipolska\\\/\",\"https:\\\/\\\/www.tiktok.com\\\/@siipolska\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCQ3UQ7RJPEYnAWC_rPE5Dxg\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/sii-polska\",\"https:\\\/\\\/clutch.co\\\/profile\\\/sii-poland\",\"https:\\\/\\\/www.crunchbase.com\\\/organization\\\/sii\",\"https:\\\/\\\/www.wikidata.org\\\/wiki\\\/Q16601096\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#webpage\",\"url\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/\",\"name\":\"NIS2 in practice: what it means to \\\"manage the supply chain\\\"\",\"description\":\"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#breadcrumblist\"},\"author\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/author\\\/emiaskiewicz\\\/#author\",\"creator\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/author\\\/emiaskiewicz\\\/#author\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sii.pl\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Cybersecurity.jpg\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#mainImage\",\"width\":733,\"height\":456,\"caption\":\"NIS2 w praktyce: Co to znaczy \\u201ezarz\\u0105dza\\u0107 \\u0142a\\u0144cuchem dostaw\\u201d \\u2013 i gdzie w nim jeste\\u015b Ty\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\\\/#mainImage\"},\"datePublished\":\"2026-10-26T04:00:00+01:00\",\"dateModified\":\"2026-10-27T10:46:55+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/sii.pl\\\/blog\\\/en\\\/\",\"name\":\"blogersii\",\"description\":\"Sii\\u2019s tech blog \\u2013 practical knowledge from experts\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sii.pl\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"NIS2 in practice: what it means to \"manage the supply chain\"","description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","canonical_url":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#article","name":"NIS2 in practice: what it means to \"manage the supply chain\"","description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","inLanguage":"en-US","headline":"NIS2 in practice: what it means to \"manage the supply chain\" \u2013 and where you fit in","author":{"@id":"https:\/\/sii.pl\/blog\/en\/author\/emiaskiewicz\/#author"},"publisher":{"@id":"https:\/\/sii.pl\/#organization"},"datePublished":"2026-10-26T04:00:00+01:00","dateModified":"2026-10-27T10:46:55+01:00","articleSection":"Hard development, Supply Chain Management, NIS2, Regulated processes, DORA, Legal regulation, Cybersecurity, Guidebook","mainEntityOfPage":{"@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#webpage"},"isPartOf":{"@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#webpage"},"image":{"@type":"ImageObject","url":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#articleImage","width":733,"height":456,"caption":"NIS2 w praktyce: Co to znaczy \u201ezarz\u0105dza\u0107 \u0142a\u0144cuchem dostaw\u201d \u2013 i gdzie w nim jeste\u015b Ty"}},{"@type":"BreadcrumbList","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/sii.pl\/blog\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/hard-development\/#listItem","name":"Hard development"}},{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/hard-development\/#listItem","position":2,"name":"Hard development","item":"https:\/\/sii.pl\/blog\/en\/hard-development\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#listItem","name":"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \u2013 and where you fit in"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#listItem","position":3,"name":"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \u2013 and where you fit in","previousItem":{"@type":"ListItem","@id":"https:\/\/sii.pl\/blog\/en\/hard-development\/#listItem","name":"Hard development"}}]},{"@type":"Organization","@id":"https:\/\/sii.pl\/#organization","name":"Sii Polska","url":"https:\/\/sii.pl\/blog\/en\/","sameAs":["https:\/\/www.instagram.com\/siipolska\/","https:\/\/www.tiktok.com\/@siipolska","https:\/\/www.youtube.com\/channel\/UCQ3UQ7RJPEYnAWC_rPE5Dxg","https:\/\/www.linkedin.com\/company\/sii-polska","https:\/\/clutch.co\/profile\/sii-poland","https:\/\/www.crunchbase.com\/organization\/sii","https:\/\/www.wikidata.org\/wiki\/Q16601096"]},{"@type":"WebPage","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#webpage","url":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/","name":"NIS2 in practice: what it means to \"manage the supply chain\"","description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sii.pl\/blog\/en\/#website"},"breadcrumb":{"@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#breadcrumblist"},"author":"https:\/\/sii.pl\/blog\/en\/author\/emiaskiewicz\/#author","creator":"https:\/\/sii.pl\/blog\/en\/author\/emiaskiewicz\/#author","image":{"@type":"ImageObject","url":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg","@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#mainImage","width":733,"height":456,"caption":"NIS2 w praktyce: Co to znaczy \u201ezarz\u0105dza\u0107 \u0142a\u0144cuchem dostaw\u201d \u2013 i gdzie w nim jeste\u015b Ty"},"primaryImageOfPage":{"@id":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/#mainImage"},"datePublished":"2026-10-26T04:00:00+01:00","dateModified":"2026-10-27T10:46:55+01:00"},{"@type":"WebSite","@id":"https:\/\/sii.pl\/blog\/en\/#website","url":"https:\/\/sii.pl\/blog\/en\/","name":"blogersii","description":"Sii\u2019s tech blog \u2013 practical knowledge from experts","inLanguage":"en-US","publisher":{"@id":"https:\/\/sii.pl\/#organization"}}]},"og:locale":"en_US","og:site_name":"blogersii","og:type":"article","og:title":"NIS2 in practice: what it means to &quot;manage the supply chain&quot;","og:description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","og:url":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/","og:image":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg","og:image:secure_url":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg","og:image:width":733,"og:image:height":456,"article:published_time":"2026-10-26T04:00:00+00:00","article:modified_time":"2026-10-27T10:46:55+00:00","article:publisher":"https:\/\/www.facebook.com\/Sii.Polska","twitter:card":"summary","twitter:title":"NIS2 in practice: what it means to &quot;manage the supply chain&quot;","twitter:description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","twitter:image":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg"},"aioseo_meta_data":{"post_id":"35036","title":"NIS2 in practice: what it means to \"manage the supply chain\"","description":"A practical guide for IT professionals working in client environments covered by new cybersecurity regulations (NIS2). Not only a legal lecture","keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2026-10-27 09:27:19","updated":"2026-10-27 10:27:29","ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sii.pl\/blog\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sii.pl\/blog\/en\/hard-development\/\" title=\"Hard development\">Hard development<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tNIS2 in practice: what it means to \u201cmanage the supply chain\u201d \u2013 and where you fit in\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sii.pl\/blog\/en\/"},{"label":"Hard development","link":"https:\/\/sii.pl\/blog\/en\/hard-development\/"},{"label":"NIS2 in practice: what it means to &#8220;manage the supply chain&#8221; \u2013 and where you fit in","link":"https:\/\/sii.pl\/blog\/en\/nis2-in-practice-what-it-means-to-manage-the-supply-chain-and-where-you-fit-in\/"}],"republish_history":[],"featured_media_url":"https:\/\/sii.pl\/blog\/wp-content\/uploads\/2026\/10\/Cybersecurity.jpg","category_names":["Hard development"],"_links":{"self":[{"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/posts\/35036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/users\/832"}],"replies":[{"embeddable":true,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/comments?post=35036"}],"version-history":[{"count":2,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/posts\/35036\/revisions"}],"predecessor-version":[{"id":35061,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/posts\/35036\/revisions\/35061"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/media\/35033"}],"wp:attachment":[{"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/media?parent=35036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/categories?post=35036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sii.pl\/blog\/en\/wp-json\/wp\/v2\/tags?post=35036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}