PLN 10 million for a new cybersecurity team. The government's idea has stirred the industry

• The Ministry of Digital Affairs is creating a new unit responsible for cybersecurity - CSIRT Cyfra. The government will pay PLN 10 million for it this year alone.
• However, the MC's announcement stirred controversy in the industry. Questions arose about the liquidation of the computer security incident response team at NASK, a research institute subordinate to the ministry.
• MC denies. As WNP has learned, the new team is to be created on the basis of the current cybersecurity department in the ministry. It is also to have other tasks than NASK.

The Ministry of Digital Affairs has announced the creation of a new cybersecurity team - CSIRT Cyfra. Its task will be to monitor threats on the network, respond to cyberattacks and support digital institutions.

The ministry's terse statement published on Wednesday, however, stirred up a lot of controversy in the industry. Right after the announcement, we spoke to several cybersecurity experts. Among other things, they pointed out that such a unit exists in the NASK research institute subordinate to the Ministry of Digital Affairs. Some admitted that this is an unnecessary multiplication of teams.

The matter was publicly commented on by, for example, Adam Haertle, author of the website ZaufanaTrzeciaStrona.pl.

There are no plans to liquidate CERT Polska in NASK

We asked the Ministry of Digital Affairs for additional clarification. According to the ministry, CSIRT Cyfra is a so-called sectoral cybersecurity team that is supposed to deal with the protection of the digital infrastructure sector. This includes entities such as DNS operators, Internet traffic exchange points (IXP), or domain registries.

As Marek Gieorgica, director of the ministry's communications office, assures us , there are no plans to liquidate CERT Polska in NASK or transfer its team to MC. The new unit is to be an intermediate level between entities of the national security system and similar teams operating at the national level. These are CSIRT GOV (operating within the ABW), CSIRT MON and CERT Polska in NASK.

According to the declaration, MC is to complement and support the activities of experts working in these teams. The principles of cooperation between these units result from the act on the national cybersecurity system.

The organizational structure of CSIRT Cyfra will be developed as part of the project announced on Wednesday. Its financing is fully covered by the National Reconstruction Plan (KPO). The project is supervised by the Digital Poland Project Center.

New unit, old ministry staff

As we hear in the MC, the new unit will be created based on the current staff of the Cybersecurity Department of the Ministry of Digitization and specialists recruited through recruitment both for the civil service and outside the civil service.

PLN 10 million from the KPO is to be enough to build the CSIRT Cyfra team and finance its staff during the project, purchase equipment and cybersecurity systems necessary to carry out CSIRT tasks. The KPO is also to finance training for team employees.

According to MC officials, the introduction of a new computer security incident response team is a response to the challenges related to the upcoming amendment to the Act on the National Cybersecurity System.

Unlucky bill - years to implement, over 20 versions

Successive governments have been working on amending the KSC Act for several years now. It is to introduce restrictive rules for the protection of networks and telecommunications systems and implement the EU NIS2 directive into the Polish legal system.

The most controversial issue is the issue of High Risk Vendors (HRV). These are companies or entities that provide hardware, software or IT services but raise security concerns. HRV exclusions are seen as a blow to the Chinese company Huawei, although ministers in successive governments have denied that they were aimed at specific suppliers .

The bill will probably be presented on Thursday, June 12, at the meeting of the Standing Committee of the Council of Ministers. According to the MC schedule, the government should adopt it by the end of June. Then the bill will go to the Sejm.