The new KSC Act (NIS2) and the transmission layer: what network engineers can do right now

The amendment to the National Cybersecurity System Act (Polish: KSC), which implements the NIS2 Directive, has been in force since 3 April 2026. An application for entry in the KSC Register must be filed by 3 October 2026, an information security management system must be operational by 3 April 2027, and from 3 April 2028 mandatory audits and financial penalties begin. The Act does not contain the sentence "encrypt your fibre." What it does require is risk analysis, a cryptography policy, business continuity, and asset management for the entire information system through which you deliver a service. The transport network is part of that system. This text sets out four technical measures in the transmission layer that a network engineer can put in place without waiting for the lawyers, and the documentation an auditor will look at first.

The compliance calendar: seven dates you need to know

Three notes on the calendar. First, an entity that begins to meet the criteria after 3.04.2026 has 6 months from that day to be entered in the register. Second, financial penalties as a rule apply from 3.04.2028, but the extraordinary penalty, up to 100 million PLN for a breach causing a direct and serious cyber threat, including to state security, applies from the day the Act enters into force, and an inspection will cover the period from 3.04.2027. Third, the competent authority for the telecommunications sector is the President of UKE (the Office of Electronic Communications). Medium and large telecommunications undertakings are essential entities subject to the audit obligation; small and micro ones are important entities. Check your own status in Annex 1 to the Act, not in this article.

Why the physical layer is subject to the Act at all

‍
NIS2, in Article 21(2), lists a minimum set of measures that the KSC Act transposes into the obligations of essential and important entities. Four of them concern the transport network directly.

On top of that comes asset management. An ISMS in the sense of the KSC Act covers the information system used in processes that affect the delivery of a service. A DWDM link between two data centres, a leased lambda to an internet exchange point, dark fibre to an aggregation node: these are all assets of that system. An auditor who sees a risk analysis without a tapping scenario and without a route-cut scenario will consider it incomplete. Not because the Act names fibre, but because it requires a risk analysis adequate to the threats, and these two threats are documented and cheap to carry out.

Fibre tapping is a real risk, not a theory

Fibre does not emit a signal outward, but it is enough to bend it. A macrobend coupler, clamped onto the fibre where the secondary coating has been stripped or directly onto a patch cord, draws off a fraction of the optical power to a photodetector. A well-made tap introduces attenuation on the order of tenths of a decibel, below 1 dB. On a link with a power margin of 3 to 6 dB, such a drop will not trigger an alarm if no one has set a threshold. The equipment for making a tap is commercial service tooling, available for a few hundred dollars.

Two consequences for risk analysis. First, unencrypted traffic on a link whose physical route you do not control is traffic available to anyone with access to the manhole. Second, traffic captured today and encrypted with an asymmetric algorithm will be decrypted once a quantum computer appears, in the "harvest now, decrypt later" model. We develop this thread in our QKD series: Your encryption has an expiry date, QKD protocols and integration in a carrier network, and QKD: deploy, plan, or wait.

Unencrypted traffic on a link whose physical route you do not control is traffic available to anyone with access to the manhole.

Four technical measures in the transmission layer

1. Encryption: OTNsec at layer 1 or MACsec at layer 2

‍
The choice of encryption layer follows from what you control, not from preference.

Encrypt at the lowest layer you have access to at both ends. Own DWDM means OTNsec, a leased lambda means MACsec, an IP service means IPsec.

Settings the auditor will check and worth recording in the cryptography policy:

Bulleted list:

• AES-256-GCM, not 128. The cost difference is zero, and a 256-bit symmetric key remains resistant to Grover's algorithm.
• Session key rotation by packet counter or time. In MACsec enforced by MKA, in OTNsec set in the NMS, typically from minutes to hours.
• "Must-secure" mode on inter-site ports. If a MACsec session is not established, the port carries no traffic. "Should-secure" mode, that is traffic in the clear when there is no session, is a configuration error that invalidates the entire measure.
• Replay protection enabled, with the window matched to the actual reordering on the link.
• Logging of session events (establishment, teardown, key change) to a SIEM. Without it you cannot prove that encryption was working on the day the auditor asks about.
• Distribution of the master key (CAK in MACsec, the pre-shared key in OTNsec) is the weakest link. A 256-bit symmetric key is quantum-resistant, but if you distribute it over a channel based on RSA or ECDH, you transfer the risk to that channel. The target: hybrid exchange with a post-quantum algorithm, or keys from QKD via the ETSI GS QKD 014 interface, as in the PIONIER-Q deployment, where quantum keys fed existing IPsec and MACsec encryptors without changes in the network layer.

More on the mechanics of optical encryption in the article Network security at layer one.

2. Route redundancy with documented physical separation

A cable cut is the most common incident in an optical network and, at the same time, the simplest way for an auditor to undermine a business continuity plan.

Two routes in the same duct are one route.

What must be met and recorded:

Bulleted list:

• Two routes with separate SRLGs (shared risk link groups): different duct, different manholes, different building entry, different patch panel. Each route has an SRLG identifier assigned in the link register.
• A route map from the provider (KMZ or vector) as an attachment to the lease agreement, with a clause on notification when the route changes. The mere wording "independent route" in an offer is not evidence.
• Length verification with a reflectometer (OTDR). Two "independent" routes with an identical optical length down to a few metres is a warning sign that they run in the same cable.
• A switchover test with timing measurement. OTN with SNCP/1+1 protection below 50 ms, IP/MPLS with FRR in a similar range. The test report, with date, scenario, measured time, and service impact, goes into the ISMS documentation. The test is repeated after every topology change and no less than once a year.
• RTO and RPO for each service entered in the business continuity plan, with reference to the specific links that provide them.

3. DOM monitoring and reflectometry as a security sensor

A tap changes the received power. A cut zeroes it. Both events are visible in data that optical modules report anyway (DOM or DDM: transmitted and received power, temperature, laser current). The difference between a compliant and a non-compliant network is whether someone collects this data, sets thresholds, and treats a breach as a security event.

Minimum configuration:

Bulleted list:

• An Rx power baseline for every line port, recorded after commissioning and after every service intervention.
• Alarm threshold: a sustained drop in Rx power of 0.5 dB relative to the baseline, with no open service ticket, generates a security event, not just a NOC alarm. Match the threshold value to the stability of the link: 0.3 dB on short, stable routes, 1 dB on long ones with many splices.
• Telemetry via SNMP or gNMI (streaming) to a monitoring system with a retention of at least 12 months. Historical data is evidence for the auditor that the control was operating continuously.
• A baseline OTDR trace for every fibre, stored as a .sor file. After a power alarm, a new measurement is compared with the baseline: a new attenuation event at a specific distance indicates the point of intervention.
• Response scenario: who verifies the alarm, within what time, and when the event becomes an incident. This is where the physical layer connects to the obligation to report serious incidents: an early warning within 24 hours, a report within 72 hours, a final report within a month, all via S46. A confirmed tap on a link carrying service data is a serious incident.

4. Link inventory as an asset register

Asset and supply chain management starts with knowing what links you have, who manages them, and where they run. In most networks this knowledge is scattered between the NMS, a spreadsheet, and the memory of two people.

Tooling: NetBox with custom fields is enough for a network of up to a few hundred links; larger environments need a DCIM system integrated with the NMS. A register in a spreadsheet without version control will not pass an audit as asset management. A separate thread is high-risk suppliers: the amendment introduces a procedure for designating a supplier of hardware or services as a high-risk supplier, with an obligation to withdraw its products by a set deadline. A link register with a "provider" field and a transmission-equipment register with a "manufacturer" field are the only way to answer, after such a decision, in a day rather than a quarter, which elements of the network are affected.

Documentation for the audit: what the auditor will see first

An ISMS audit for essential entities is based on a structure close to ISO/IEC 27001:2022. The measures in this article map onto the Annex A controls: 8.20 (network security), 8.21 (security of network services), 8.24 (use of cryptography), 5.30 (ICT readiness for business continuity), and 5.9 (inventory of assets). If the organisation holds a 27001 certificate, the KSC auditor will start with these points.

What to do this week?

This article is informational and technical in nature. It does not constitute legal advice. The qualification of an entity, the scope of its obligations, and the interpretation of the regulations should be confirmed with a legal counsel or attorney on the basis of the text of the Act and the communications of the competent authorities.

Government and normative sources:
Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, Journal of Laws 2026 item 252 (isap.sejm.gov.pl). Ministry of Digital Affairs, communications on the key deadlines and on the launch of self-registration in the Register (gov.pl/web/cyfryzacja). gov.pl knowledge base, "Amendment to the National Cybersecurity System Act." KSC Register: wykaz-ksc.gov.pl. Directive (EU) 2022/2555 (NIS2), Articles 21 and 23 (eur-lex.europa.eu). IEEE 802.1AE-2018 (MACsec), IEEE 802.1X-2020 (MKA), ITU-T G.709/Y.1331 (OTN), ETSI GS QKD 014, ISO/IEC 27001:2022 Annex A.