The IT director of a manufacturing company leaves a board meeting with one question on a sheet of paper: “We have Bitdefender on every workstation. Does that take care of NIS2 for us?”. The question is reasonable — the GravityZone licence was one of the larger items in the budget, and the Polish National Cybersecurity System Act has just entered into force in its new wording. “Yes” would be the convenient answer, and “no” would be untrue in the other direction, because the product genuinely closes a sizeable part of the technical requirements.
An honest answer needs a map. Article 8 of the KSC Act requires a system, not a product, but that system consists of specific controls, some of which the platform delivers. This text lays out the twelve areas in which GravityZone modules provide technical controls, operational capabilities or evidence, shows which bundle you need for a given mapping to be true, and marks the line beyond which the organisation’s own work begins.
What does Article 8 of the KSC Act require, and how does it relate to Article 21 of NIS2?
Article 8(1) of the Polish National Cybersecurity System Act (KSC Act) — as amended by the Act of 23 January 2026 (Journal of Laws 2026 item 252, in force since 3 April 2026) — obliges an essential or important entity to implement an information security management system in the information system used to provide its service. The provision lists the elements of that system: technical and organisational measures (point 2), including continuous monitoring (letter g) and policies for assessing the effectiveness of measures (letter h); collecting information on cyber threats and vulnerabilities (point 3); incident management (point 4). The entity’s manager is personally accountable for their performance (Article 8c(1)).
The Act transposes Directive (EU) 2022/2555, so the same list has its origin in Article 21(2) of NIS2: from the risk analysis policy (point a), through incident handling (point b), business continuity (point c) and supply chain (point d), to cryptography (point h), access control (point i) and multi-factor authentication (point j). The map in this article therefore speaks about both acts at once.
One word settles the rest of this text: the Act requires a system, and a system covers organisational, technical and operational measures. No product writes policies, appoints risk owners or signs an audit report.
Can a single product close NIS2 and the KSC Act?
It cannot. GravityZone does not replace an ISMS, formal risk management, audits or the organisation’s accountability for its NIS2 and KSC Act obligations. That reservation comes straight from the vendor and draws the line of delegation: up to a point an obligation can be handed to a tool, beyond it not.
What the product contributes falls into three categories. Technical controls — mechanisms that block, encrypt, isolate or update. Operational capabilities — detection, event correlation, response, also outside working hours. And the most underrated one, evidence: reports on the state of controls, event history, a record of actions taken. In an inspection by the competent authority the third category is what counts, because Article 8(1)(2)(h) requires an assessment of the effectiveness of measures, and an assessment without data is a declaration.
The line of delegation: a tool can be entrusted with detecting, blocking, encrypting, updating and documenting. It cannot be entrusted with the decision that an event is an incident, the choice of acceptable risk or the signature under an audit report.
How should you read the map of twelve areas?
From area through module to bundle: the map groups the requirements of Article 8 of the KSC Act and Article 21 of NIS2 into twelve areas and assigns to each the platform modules that help in it. The NIS2/KSC Act sections on GravityZone product pages at nFlo use the same names:
- Risk management and control effectiveness assessment
- Vulnerability and patch management
- Continuous monitoring and threat detection
- Incident management and response
- Cyber resilience and ransomware impact reduction
- Asset and exposure visibility
- Cyber hygiene and attack surface reduction
- Data confidentiality, encryption and system integrity
- Secure email and electronic communication
- User risk and education support
- Identity and access security
- Supply chain risk
Three terms have to be kept apart, or the map misleads. An area is a group of statutory requirements. A module is a platform function — Risk Management, EDR, Integrity Monitoring. A bundle is what you actually buy: Business Security, Premium, Enterprise, XDR or a separately licensed add-on. A module’s presence in an area does not mean you have it in your bundle — which is why the table further down shows bundles, not modules.
How does GravityZone support risk, vulnerability and patch management?
The first two areas are handled above all by Risk Management: it scans the covered assets periodically, identifies vulnerabilities, misconfigurations and account-related risks, calculates a risk score and sets the order of remediation. That is exactly the kind of data Article 8(1)(3) of the Act requires.
The assessment of technical control effectiveness (area 1) is supported by Compliance Manager, and here lies a detail that matters for the budget. The basic standard is built into Business Security Premium, Business Security Enterprise, GravityZone EDR cloud and the MDR service: it provides best-practice guidelines, insight into the state of controls and an exportable report. Advanced standards — including the NIS2 Directive, DORA and ISO/IEC 27001:2022 — are unlocked only by the Compliance Manager add-on licence. A report labelled “NIS2” therefore requires that add-on.
Area 2 is closed by Patch Management, available as an add-on to the Business Security bundles: it plans and deploys updates, linking the detection of a vulnerability with its removal. In environments with XDR the network sensor adds vulnerabilities visible from traffic, including on devices without an agent.
What do continuous monitoring and incident response deliver?
They deliver detection, event correlation and a first action — but in areas 3 and 4 the difference between bundles is the largest. Business Security Premium detects threats on the endpoint: HyperDetect, Sandbox Analyzer and Fileless Attack Defense catch unknown samples and fileless attacks, and Attack Forensics documents the attack chain mapped to MITRE ATT&CK. Only Business Security Enterprise adds native EDR — cross-endpoint incident correlation and one-click response: isolation, process termination, rollback and evidence collection.
XDR widens the picture with sensors beyond the endpoint: identities, network, cloud and productivity applications, and Incident Advisor assembles events into a single timeline with recommended actions. Security Data Lake adds what documentation requires: it collects, normalises and correlates logs from endpoints, networks, cloud and external sources in a platform that combines SIEM with tiered retention. One licensing caveat: this add-on cannot be purchased for GravityZone EDR Cloud.
The MDR service answers the most common gap in area 4 — no people after hours. Bitdefender analysts work 24/7 in three SOC centres (North America, Romania, Singapore) and can carry out pre-agreed actions, such as isolating a host, before anyone on your team reads the alert. Under Article 8(1)(2)(g) and (4) the tool and the service deliver detection, analysis and a first action; classifying an event as a serious incident and reporting it within the deadlines of Article 11 remain a process the organisation must describe and staff.
How do you limit the impact of ransomware and maintain business continuity?
Area 5 is handled by Ransomware Mitigation, present in all Business Security tiers: it detects file encryption attempts, stops the malicious process, isolates the attacked device and restores files from copies — in Premium and Enterprise from tamper-proof copies. In bundles with EDR and in the MDR service, isolation of the endpoint at incident level comes on top.
Article 21(2)(c) of NIS2, however, speaks of business continuity, backup management and the restoration of normal operations. The module protects files on the endpoint and limits the attack’s impact on the organisation’s work; it is not a business continuity plan and does not replace server backups or a restore test report. The evidence in this area is the measured time to restore the service, and no endpoint module will produce that.
How do you know what to protect — including at your suppliers?
From an inventory that also covers what is visible from the internet — area 6 begins with the question of whether the list of protected assets is complete. Risk Management and the network inventory show managed devices and their state, CSPM+ does the same agentlessly for the cloud — it inventories compute, storage, network and IAM entitlements in AWS, Azure and GCP and detects configuration drift. The external side of the picture comes from EASM: agentless, continuous discovery of internet-facing assets — domains, IP addresses, cloud services, shadow IT. EASM is licensed separately, as an add-on to GravityZone bundles.
The same module is the only assignment in area 12. EASM discovers a supplier’s internet-facing assets, finds vulnerabilities and misconfigurations in them and monitors changes in its exposure — it therefore delivers the technical part of a third-party risk assessment. The rest of the requirement in Article 21(2)(d) — contract clauses, allocation of responsibility, the supplier review process — stays with the organisation and cannot be bought as an add-on.
How do you reduce the attack surface and protect data?
Area 7 is the most densely populated, because it consists of mechanisms already present in the basic bundles: Network Attack Defense blocks brute force, port scanning and lateral movement, Device Control restricts USB and Bluetooth media, web and content control closes channels you do not need, and Patch Management removes known weaknesses. PHASR is a class of its own: instead of one policy for everyone it builds a risk profile for each user–endpoint pair, restricts the tools a given person does not use, and blocks the abuse of living-off-the-land system binaries.
Area 8 combines confidentiality with integrity. Full Disk Encryption, available as an add-on, encrypts data on devices; Device Control and Application Control govern data transfer channels and the applications that run; Ransomware Mitigation protects files from the effects of encryption. Integrity is guarded by Integrity Monitoring — it watches files, registry, applications and configuration in real time against a baseline and maps events to PCI DSS, ISO 27001, HIPAA, GDPR and NIST 800-53.
With Article 21(2)(h) of NIS2 the order matters: the directive requires a policy on the use of cryptography, and the encryption module is its execution — a configuration record proves deployment, but it does not replace the document that says what you encrypt and why.
What about email, users and identities?
Area 9 is handled by Email Security, available as an add-on for Microsoft 365 and Google Workspace: it protects against phishing and BEC, checks message content, attachments and URLs and helps verify the sender. In XDR the productivity applications sensor pulls email events into the same timeline and allows a message to be quarantined as part of the response. Endpoint anti-phishing, present even in Small Business Security, protects the user from credential theft but is not protection of the mail server itself.
Area 10 has the weakest coverage on the map, and that should be said plainly. Risk Management flags risky behaviour and accounts that need attention, so it provides data for targeting training; the training programme itself and the list of participants — the evidence required by Article 21(2)(g) — are produced outside the tool.
Area 11 is served by three modules from three bundles: the XDR identity sensor monitors Active Directory and cloud identity providers, CIEM in CSPM+ maps excessive, unused and dormant entitlements, and Risk Management assesses account risk. All three provide information on identity risk, but none of them replaces an IAM system or entitlement management, and multi-factor authentication under Article 21(2)(j) is a separate deployment.
Which bundle covers which areas?
The answer depends on the bundle, not the platform, which is why the table shows the twelve GravityZone product pages at nFlo and the areas each confirms in its NIS2/KSC Act section. The area numbers are the same as in the map above. The rows from Integrity Monitoring down require a licence outside the Business Security bundles — either as an add-on (Integrity Monitoring, EASM, PHASR, Security Data Lake, the Premium tier of Compliance Manager) or as a service (MDR); the Basic tier of Compliance Manager is built into Premium, Enterprise, EDR cloud and MDR.
| Bundle or module | Map areas | What it specifically contributes |
|---|---|---|
| Small Business Security | 5, 7, 9 | file restoration after ransomware, protection against exploits, endpoint anti-phishing |
| Business Security | 2, 5, 7, 8 | Risk Analytics, Ransomware Prevention, Network Attack Defense, Device Control; Patch Management and encryption as add-ons |
| Business Security Premium | 1, 2, 3, 5, 7 | Risk Management, Compliance Manager (basic standard), HyperDetect, Sandbox Analyzer |
| Business Security Enterprise | 1, 2, 3, 4, 5 | Premium plus native EDR: incident correlation, one-click response |
| XDR | 3, 4, 6, 9, 11 | identity, network, cloud and application sensors, Incident Advisor |
| CSPM+ | 1, 6, 11 | agentless cloud inventory, mapping to compliance frameworks, CIEM |
| Integrity Monitoring | 1, 8 | file and configuration integrity, reports for PCI DSS and ISO 27001 |
| EASM | 6, 12 | external attack surface of the organisation and its suppliers |
| MDR | 3, 4, 5 | 24/7 analysis and response from three SOC centres |
| PHASR | 5, 7 | per-user hardening, blocking of living-off-the-land binaries abused by ransomware |
| Compliance Manager | 1, 7 | cyber hygiene baseline, state of controls and reports for advanced standards, including NIS2 |
| Security Data Lake | 3, 4 | SIEM and data lake: log normalisation, correlation and retention |
The table reads in two directions. From the bundle: Business Security covers four areas, and monitoring and response from areas 3–4 have to be bought as Enterprise, XDR or MDR. From the area: area 12 has a single assignment, so without EASM the technical assessment of suppliers stays empty. Area 10 has no row on purpose — user risk data comes from Risk Management in Premium and Enterprise, and education cannot be bought as a module.
What will GravityZone not do for the organisation?
It will not write the information security management system, will not carry out a formal risk analysis, will not perform an audit and will not lift accountability from the entity’s manager. Each of these elements has its place in the law: the ISMS and effectiveness assessment in Article 8(1) of the KSC Act, the risk analysis policy in Article 21(2)(a) of NIS2, the audit of an essential entity at least once every three years in Article 15(1) of the KSC Act, the manager’s accountability in Article 8c(1). On top of that comes the reporting clock in Article 11 — an early warning within 24 hours and a notification within 72 hours of detecting a serious incident — which is started by a human decision, not by an alert.
A starting point can be the free NIS2 readiness test prepared by Bitdefender: 16 questions, about 5 minutes, a review of six security areas, a point score and a list of recommendations in order of action. The test is informational — it is not a compliance assessment within the meaning of the Act — but it structures the first conversation with the board.
Turning the result into an action plan is the work we do as a Bitdefender partner during GravityZone deployments: we compare the bundles you own with the area table and establish what a module closes and what a document closes. Formally this is done by the NIS2 Readiness Check service, and the preparation of documentation and processes is led by NIS2 and DORA Compliance.
The division of labour in one sentence: the tool delivers controls, data and the first response; the organisation delivers the policy, the decision, the signature and the proof that the effectiveness assessment cycle works. Compliance emerges where the two meet.
Where should you start before 3 October 2026?
By establishing whether you fall under the Act at all — 3 October 2026 is the deadline for submitting the application for entry in the register of essential and important entities, and sector, organisation size and role in the supply chain settle that in three steps, which we set out in the NIS2 and KSC self-identification test. Without that answer the module map is a theoretical exercise.
The second step is an inventory of what you already have: which GravityZone bundle, which add-ons, which sensors are switched on. Laying that list against the table above gives a first version of the gap map. The third step is splitting the gaps into technical ones, closed by a module or a configuration, and organisational ones, closed by a document, a process or an audit — because the two have different owners and different budgets.
The context in which GravityZone is one element rather than the whole is covered by our overview of the key technologies for NIS2, and deadlines, penalties and reporting obligations by the NIS2 knowledge hub. If you would rather start with a conversation about your own environment, get in touch.
Frequently asked questions
Does deploying Bitdefender GravityZone mean compliance with NIS2 and the KSC Act?
No. Article 8(1) of the Polish National Cybersecurity System Act (as amended by the Act of 23 January 2026, Journal of Laws 2026 item 252) requires an information security management system made up of organisational, technical and operational measures. GravityZone delivers technical controls and evidence in twelve areas of that system, but it does not replace an ISMS, formal risk management, audits or the accountability of the entity's manager under Article 8c.
Which GravityZone bundle covers the most areas of Article 8 of the KSC Act?
On nFlo's product pages the broadest mappings belong to Business Security Premium (five areas: risk management, vulnerabilities, monitoring, ransomware, cyber hygiene), Business Security Enterprise (five areas, including incident management thanks to EDR) and XDR (five areas, including visibility, email and identities). The remaining areas are closed by items licensed outside the Business Security bundles: the Integrity Monitoring, EASM, PHASR and Security Data Lake add-ons, the Premium tier of Compliance Manager, and the MDR service. The Basic tier of Compliance Manager is built into Premium, Enterprise, EDR cloud and MDR.
Does Compliance Manager generate a NIS2 compliance report?
The basic standard of Compliance Manager is built into Business Security Premium, Business Security Enterprise, GravityZone EDR cloud and Bitdefender MDR and provides guidelines, insight into the state of controls and an exportable report. Advanced standards, including the NIS2 Directive, DORA and ISO/IEC 27001:2022, are unlocked by the Compliance Manager add-on licence. Keep the two tiers apart when planning the budget.
What does GravityZone provide for the continuous monitoring obligation in Article 8 of the KSC Act?
Article 8(1)(2)(g) of the Act requires the information system to be covered by continuous monitoring. Endpoint Protection, EDR in the Enterprise bundle, XDR sensors and Security Data Lake deliver detection, event correlation and log retention, and the MDR service adds 24/7 analysis from three SOC centres. Classifying an event as an incident and reporting it within the deadlines of Article 11 remain the organisation's process.
