How to report to CSIRT NASK under the CRA

1. Who receives your notification: CSIRT NASK, CSIRT GOV and CSIRT MON

CSIRT NASK, CSIRT GOV and CSIRT MON are the three national authorities, with competences split by sector: NASK for the civil sector, GOV for state administration, MON for defence. NASK operates from Warsaw and is at once a research institute, the national domain registry and a response team: a rare combination in Europe.

The chain is exactly this: the authority as the institution, CSIRT NASK as the operational team that reads your notification and, together with ENISA, forms the recipient set out in Art. 14.

Poland does not have one national CSIRT but three: CSIRT NASK for the civil sector, CSIRT GOV for state administration — housed within ABW — and CSIRT MON for defence. They are three distinct authorities, with competences split by sector under the national cybersecurity system act.

2. The national channel, in practice

The language of the notification is Polish. NASK publishes advisories and technical material in Polish, with some in English; for a foreign manufacturer this is the point that needs most preparation among the countries covered by these pages.

A private manufacturer normally falls to CSIRT NASK. The split does not depend on the type of event but on the sector you operate in, and in mixed cases — a civil supplier that also serves defence — it should be settled beforehand, not during.

CSIRT NASK · official website

3. The landscape around it

Poland built its framework on the 2018 national cybersecurity system act, later aligned with NIS2. It is a three-pillar model, explicitly designed to keep the military chain separate from the civil one.

For the CRA, the designation of the CSIRT receiving manufacturers' notifications follows the national implementation of the Regulation and does not automatically flow from that split. Check the designation in force before you file.

One last practical point: NASK is also a research institute and runs the national domain registry alongside the CSIRT. It is a technically broad counterpart, but the split across the three CSIRTs remains the variable worth settling first, because it is the one you cannot deduce from your product.

4. How filing works, in short

Filing is not an email to the authority: it goes through the single reporting platform established by Art. 16, and access requires EU Login credentials validated beforehand.

The chain of deadlines — 24 hours, 72 hours, final report — is the same across the Union and is set out in full on the Art. 14 page. For the article’s other trigger the final deadline changes: it is on the severe incident page.

5. What to prepare before an incident

Five things, arranged calmly, make the difference between a report filed in time and one filed too late. The first is the contact point to CSIRT NASK, designated and validated, with a named substitute: on the day of the case you do not go looking for whoever holds the credentials.

In Poland it pays to prepare the Polish version of recurring technical content in advance and to confirm in writing which of the three CSIRTs is yours: those are the two things that, when missing, cost hours exactly when there are none.

And a note on time: Poland runs on CET/CEST. Art. 14's twenty-four hours do not stop on public holidays, which in Poland are numerous and clustered. If technical documentation has to be translated into Polish before filing, that time comes out of the twenty-four hours, not on top of them.

This guide describes our reading of the regulatory text and the public procedures; it does not constitute legal advice, and the platform's operational details may evolve.