Organizational capabilities in the field of cybersecurity for important entities under the NIS2 directive. An analysis of selected management challenges. The Polish perspective

Abstract

Purpose: The purpose of this paper is to identify and analyse key management challenges related to building organizational capabilities in important entities in Poland, which are subject to the NIS2 Directive and its national implementation. Design/methodology/approach: The research is based on qualitative analysis of regulatory documents and industry literature. The study uses desk research of EU and Polish legal acts, complemented by a review of standards and best practices and recent academic publications on cybersecurity management and organizational resilience. On this basis, a conceptual framework of three challenge groups is developed: identification, organizational and operational, with a focus on the Polish interpretation of NIS2 for important entities. Findings: The analysis shows that effective NIS2 implementation requires capabilities in three interrelated dimensions. Identification challenges concern status assessment, sectoral qualification and designation of systems covered by ISMS. Organizational challenges involve responsibility models, competence structures, and governance over internal and outsourced cybersecurity, including ICT supply chains. Operational challenges include monitoring, incident reporting, documentation and cooperation with authorities under time pressure, affecting continuity and costs. Research limitations/implications: The paper is conceptual and based on secondary sources; it does not include empirical verification at the level of individual organizations. Future research should involve empirical studies of important entities in different sectors together with quantitative assessment of the impact of NIS2 on organizational maturity and costs. Practical implications: The results provide a structured lens for managers and policymakers to plan NIS2 implementation as a long-term management process rather than a one-off compliance project. Social implications: By strengthening organizational capabilities of important entities in defined sectors, the implementation of NIS2 contributes to higher digital resilience of the state and economy. This may translate into improved continuity of essential services, greater protection of citizens and increased trust in public and private institutions. Originality/value: The paper offers a management-oriented interpretation of NIS2 and national act focused specifically on important entities. It proposes a clear, three-part framework of challenges that links legal requirements with organizational practice, providing added value for both researchers and practitioners in cybersecurity governance. Keywords: NIS2, important entity, risk management, uKSC, organizational capabilities. Category of the paper: Research paper.