Poland has officially launched two new sectoral Computer Security Incident Response Teams: CSIRT Cyfra and CSIRT Infrastruktura. The move follows an amendment to the national cybersecurity act and aims to bolster defenses against growing cyber threats across critical infrastructure sectors.
The new teams became operational at the end of June 2026, with relevant ministerial orders published on June 30. CSIRT Cyfra will cover the digital infrastructure sector, while CSIRT Infrastruktura focuses on transport, water supply, and sewage services. Both are part of a broader overhaul of Poland’s cybersecurity architecture.
Until now, the national system relied on three national CSIRTs (MON, GOV, NASK) and two sectoral ones (KNF for finance, CeZ for healthcare). The expansion addresses gaps exposed by increasing cyber incidents targeting critical services.
New teams for specific sectors
CSIRT Infrastruktura operates under the Ministry of Infrastructure’s Crisis Management Bureau, led by Monika Gliwka since June. It will support entities using industrial automation (OT) systems, such as water, sewage, rail, road, maritime, and inland waterway infrastructure. – One of the key stages of building CSIRT Infra will be training its specialists to familiarize them with the specifics of the industry – – said Aleksander Kostuch, engineer at Stormshield.
CSIRT Cyfra, based within the Department of Cybersecurity at the Ministry of Digitization, will handle incidents for key digital infrastructure operators. The ministry clarified that the team does not duplicate the tasks of CERT Polska or CSIRT NASK. – CSIRT Cyfra will only serve operators of key services in the digital infrastructure sector, while CERT Polska supports citizens and entities not covered by the act – the ministry explained earlier this year.
A response to growing cyber threats
The creation of the two teams was announced earlier in 2026 by Deputy Prime Minister and Minister of Digitization Krzysztof Gawkowski during the European Economic Congress. He emphasized that the goal is to reinforce the weakest links in the national cybersecurity system. A government report also indicated that work on a third sectoral team, CSIRT Energia, is ongoing, funded partly by over 75 million PLN from the National Recovery Plan.
The new CSIRTs are tasked with improving incident response coordination and resilience in sectors previously considered vulnerable. Kostuch noted that OT systems used in water and transport have different sensitivities compared to other critical infrastructure, making specialized teams essential.
Operational capabilities and future outlook
CSIRT Infrastruktura is expected to achieve full operational capability by August 31, 2026. CSIRT Cyfra’s date for achieving similar status has not yet been officially announced, though earlier expectations pointed to June. The Ministry of Digitization added that the team does not take over tasks from any existing unit and operates complementarily.
The government continues to invest in cybersecurity, including training for new CSIRT staff and integration with European networks. Poland’s cybersecurity strategy now covers 11 sectors, with more sectoral teams planned in the coming year to cover energy and other critical industries.
Źródło: WNP.PL, Fot. Ar_TH / Shutterstock
