CyberSec Update#35: How to prepare for KSC registration

Before You Click “Submit” – How to Prepare for Registration in the KSC Register

September 1 marks the beginning of a new school year for many children and teenagers. We would like to draw attention to another important date that is approaching just as quickly.

On 3 October 2026, the deadline for registration in the register of essential and important entities expires for organisations that already met the qualification criteria on 3 April 2026, the date the amended Act entered into force.

In the previous edition of #CyberSec Update, we explained which organisations are subject to the registration obligation and what the consequences of non-compliance may be. This time, we focus on the practical steps worth taking before starting the registration process itself.

Three Preparatory Steps Before Submitting an Application

Registration in the S46 system should be the final stage of the process, not the first. Proper preparation can help avoid unnecessary delays, mistakes and subsequent corrections.

1. Self-Identification

The first step should be a documented legal assessment addressing three key questions:

• Is the organisation subject to the Act?
• Why does it fall within the scope of the Act, or why does it not?
• Should it be classified as an essential entity or an important entity?

This internal assessment should be prepared before any registration activities are undertaken. It forms the basis for all subsequent actions. The Ministry of Digital Affairs has expressly indicated that organisations should first determine whether they meet the relevant sectoral and size-related criteria.

It is worth remembering that qualification depends primarily on the nature of the activities actually performed and the size of the organisation, rather than its legal form.

2. Collect the Information Required for the Application

The application submitted via the S46 system requires a specific set of information. Preparing this information in advance will significantly streamline the registration process.

Identification data:

• entity name,
• sector, subsector and entity type in accordance with the relevant annexes to the Act,
• registered office address and correspondence address,
• electronic delivery address,
• email address,
• tax and statistical identification numbers,
• registration number in the relevant regulated activity register, where applicable.

Technical data:

• public IP address ranges continuously used by the organisation,
• internet domains used by the organisation.

Contact details:

• details of individuals responsible for communication with the national cybersecurity system,
• details of the administrator of the organisation’s S46 account.

3. Key Internal Decisions

Several organisational decisions should be made before anyone logs into the S46 platform.

• Contact persons – the Act requires at least two individuals to be designated for maintaining communication with entities operating within the National Cybersecurity System.
• S46 account administrator – the organisation should appoint a person responsible for managing its account within the system.
• Application signatory – the application must be completed and signed by an authorised individual. This may also be a representative acting under a power of attorney, such as a lawyer, legal counsel or IT specialist.
• Group structure analysis – each entity meeting the statutory criteria must register independently. This also applies to subsidiaries. Notably, a company providing cybersecurity services exclusively to other companies within the same corporate group may also fall within the scope of the Act as a separate service provider.

Registration Is Not the End – Keep Your Data Up to Date

The obligation does not end once registration has been completed. Information included in the register must remain accurate and current.

If any registered information changes, the entity has 14 days from the date of the change to submit an application updating its registration data. This obligation also covers changes concerning internet domains and public IP addresses.

What Are the Benefits of Registration?

Registration is more than a regulatory obligation. It also provides access to tools and communication channels operating within the National Cybersecurity System.

Once registration is completed and all required information has been provided, the entity gains access to the S46 Cyber Hub platform. The system supports incident reporting through a “single window” mechanism, but it also serves as a communication and information-sharing platform within the KSC framework.

Among other things, users receive:

• cybersecurity alerts and warnings,
• technical recommendations,
• information regarding vulnerabilities,
• updates on emerging cyber threats.

A Final Pro Tip – Don’t Leave It Until the Last Minute

Submitting an application on the final day may not be the best strategy.

If thousands of organisations decide to click “submit” on 3 October, the resulting load on the system could be significant. One might therefore say, only half-jokingly, that waiting until the last moment risks contributing to something resembling an accidental DDoS event.

That is probably not the type of contribution to cybersecurity the legislator had in mind.

This is another article in our #CyberSec Update series. If you are unsure how to perform self-identification or prepare the information required for registration, our team will be happy to assist you throughout the process.