Audit rehearsal
For each point of KSC, KRI, GDPR, DORA or ISO 27001: what the auditor will ask, and whether it is proven, declared, missing or contradicted. PDF with a citation index.
KSC · KRI · GDPR · DORA · ISO 27001 · AI Act
Audit-ready. Every day.
Compliance as a daily state, not a yearly project. Evidence, documents and a readiness score in the organisation's own server room; first result from a spreadsheet, with no systems to connect.
- target: gap map and readiness score
- 7 days
- document templates PL/EN
- 19
- citable legal passages
- 2,008
OneAudit readinessas of today
proven
52%
declared
22%
missing
26%
last 30 days
- KSC74%proven 52% · declared 22%
- KRI81%proven 60% · declared 21%
- GDPR68%proven 45% · declared 23%
- DORA57%proven 33% · declared 24%
- ISO 2700163%proven 41% · declared 22%
TL;DR
What is Bersec One?
Bersec One is software installed in the organisation's own server room that collects evidence, keeps compliance documentation up to date and shows an audit-readiness score for KSC, KRI, GDPR, DORA and ISO 27001. It suits organisations without a GRC team and the partners serving them. It works offline, and the first result needs only a spreadsheet.
Benefits
Less financial risk, less manual work, fewer IT projects.
Concrete figures from the product documentation and the Polish National Cybersecurity System Act (KSC). Estimates and targets are marked.
Finance
up to EUR 10mfines for an essential entity
Or 2% of annual revenue, whichever is higher. Important entity: up to EUR 7m or 1.4% of revenue.
KSC Act, art. 73(3) and (4)
up to 300%of the head of the entity's pay
A fine can be imposed personally on the head of the entity. In a public entity: up to 100% of pay.
KSC Act, art. 73a
Fixed pricea licence instead of consultant days
New regulations and templates come with the licence, with no new engagement. Knowledge stays in the system instead of leaving with the consultant.
Bersec One
Operations
up to 85%less work on documentation
A complete set of ISMS, risk assessment, GDPR and business continuity documentation is ready 50-85% faster than without a tool.
Bersec estimate, measured in pilots
7 daysto the first result
A gap map and a readiness score for the selected regulations, from a spreadsheet alone. A full set of draft documents in 30 days.
Bersec One targets
No weekof collecting evidence before an inspection
An evidence export for the auditor is available at any time. One reading, e.g. MFA, counts for KSC, KRI, GDPR and ISO 27001 at once.
Bersec One
IT
No integrationto start
Bersec One starts from a spreadsheet and a quick self-assessment. Connectors are optional and read-only.
Bersec One
Existing SIEMand domain accounts
Event export to the SIEM already in place (tested: Vector, Wazuh, Graylog, Filebeat) and sign-in with domain accounts, so no new identity silo.
Bersec Gateway and Bersec One
Offlineno cloud, no telemetry
Both products run in the organisation's own server room, also without internet access. Updates are signed and can arrive on removable media.
Bersec Gateway and Bersec One
Fine amounts: articles 73 and 73a of the Polish National Cybersecurity System Act (Journal of Laws 2026 item 252). Fines can be imposed from 3.04.2028.
Start without integration
Four steps to a first result.
Step 01/04
Wizard and spreadsheet
Pick regulations, import an asset spreadsheet, assign owners.
Gap map and readiness score, target: within 7 days
Step 02/04
Quick self-assessment
Answer yes / partly / no for the most important gaps.
Declarations, clearly marked and never posing as evidence
Step 03/04
Document drafts
One click creates a full set of drafts from 19 PL/EN templates.
Policies and procedures with room for evidence
Step 04/04
Approval
A named person reviews and approves after confirming identity.
Versioned document with approval history
What declarations alone don't show
Where declarations and reality diverge, Bersec One shows it before the auditor does.
GRC tools score what is declared. Bersec One compares declarations and approved policies with what the organisation's own systems show, and flags every contradiction for review.
OneDeclarations vs reality2 consistent4 contradictions
DeclarationObserved in systems
- All administrators use MFA3 admin accounts without MFAContradiction to review· Entra ID
- Privileged accounts are personalsudo group: 3 named accountsProven· Linux (SSH)
- Backups run every dayVeeam job failing for 4 daysContradiction to review· Veeam
- Backups are verifiedBackup verification: last success yesterdayProven· Proxmox Backup Server
- SMBv1 disabled across the networkSMBv1 active on 2 serversContradiction to review· Windows
- Unused accounts are removed17 accounts inactive > 90 daysContradiction to review· Active Directory
Differentiators
Audit-ready. Every day.
One proof, many regulations
One MFA reading counts for KSC, ISO 27001, KRI and GDPR at once, so evidence is collected once, not four times.
Readiness on any date
Each day’s readiness is a signed record in the evidence chain, not a reconstruction.
Documents that keep up
Changes in systems propose document updates. A person decides, after fresh two-step verification.
Auditor panel
Read-only access and a tamper-evident evidence export, available at any time, not after a week of collecting.
Fits the security stack
Domain sign-in with group roles, SIEM export, the organisation's own certificate behind its proxy.
Evidence sources
Connect systems when needed, or never.
Sources are read-only. Before a source is saved, the product shows the exact commands, rights and stored fields.
- Linux (SSH)RO
- Active Directory / LDAPRO
- WindowsRO
- VMware vSphereRO
- Microsoft 365 / Entra IDRO
- VeeamRO
- Proxmox Backup ServerRO
- BareosRO
OneWhat is readread-only
command: getent group sudo
rights: read-only
stored fields: name, members, date
Documents
19 templates that know Polish law.
ISMS (SZBI)PL · ENSecurity policyPL · ENRisk analysisPL · ENRisk treatment planPL · ENIncident procedurePL · ENBCP / DRPPL · ENAccess policyPL · ENPassword policyPL · EN
Backup policyPL · ENDORA ICT registerPL · ENRecords of processingPL · ENDPIAPL · ENBreach registerPL · ENStatement of ApplicabilityPL · ENAI systems registerPL · ENInternal audit reportPL · EN
Who it’s for
Same obligation, different starting points.
| Organisation | Situation | Outcome with Bersec One |
|---|---|---|
| KSCWater utility | First audit, ISMS still being built | Gap map from a spreadsheet, full set of document drafts, evidence collected daily |
| KRIMunicipalities via an LCC | The centre serves many municipalities | One Multi: separate instance and score for each municipality in one console |
| GDPRCounty hospital | A new system needs an impact assessment | DPIA draft and records of processing |
| DORACooperative bank | ICT provider register rebuilt yearly in a spreadsheet | Register-of-information data kept all year (working structure) |
| ISO 27001Software house | Customers send security questionnaires | Statement of Applicability and answers citing evidence |
Why now
The amended KSC act is already in force.
For entities covered on the day the amendment took effect (Dz.U. 2026 poz. 252). The deadline for a given organisation depends on its status.
2026
Amended KSC actISMS obligation for essential and important entities.
3.04.2027
Information security management systemISMS implemented and documented.
3.04.2028
First audit of essential entitiesThe auditor won’t ask about policies, only about evidence.
AI optional, off by default.
When enabled, it runs locally without network access and only selects template clauses. It never writes facts or approves documents.
Product
Inside Bersec One.
Onebersec.local · Today
Calculator
How much does Bersec save over three years?
Savings on compliance documentation and inspection preparation, next to the KSC fine exposure. Every value can be changed.
Savings over 3 years
up to PLN 225,000
from PLN 81,000 · documentation + inspection preparation
Compliance documentation
up to PLN 198,000
50-85% less work on the full document set
Inspection preparation
PLN 27,000
evidence ready at any time, over 3 years
Maximum KSC fine per entity
up to PLN 42.5m
or 2% of annual revenue if higher. The head of the entity can also be fined personally: up to 300% of pay (public entity: 100%).
Bersec estimate, measured in pilots: a complete set of ISMS, risk assessment, GDPR and business continuity documentation takes 50-85% less work with Bersec One, and evidence for the auditor is available without collecting it by hand before an inspection. Three years match the KSC audit cycle and the price-guarantee period. Daily rates and the EUR rate (4.25) are examples. Fine caps: KSC Act art. 73 and 73a. The result is not an offer or a guarantee.
Quote
An individual quote, fitted to the organisation.
The price depends on the scale and scope of the deployment. A quote follows a short conversation about the organisation's needs.
- What the price depends onThe number of seats, network throughput, the regulations covered and the number of entities served.
- What the licence includesAn annual licence per organisation includes regulation, rule and template updates and support on working days.
- A pilot first30 days on the organisation's own data. It ends with an export, data deletion and a signed deletion certificate.
FAQ
Questions about Bersec One.
What is the readiness score in Bersec One?
The readiness score shows, for each selected regulation, what is proven, what is only declared and what is missing. Evidence carries a source, a date and a hash; a declaration is always clearly marked and never poses as evidence. Each day’s readiness is a signed record in the evidence chain, not a reconstruction.
Which regulations does Bersec One cover?
Bersec One covers KSC, KRI, GDPR, DORA, ISO 27001 and the AI Act: One Start includes KSC, KRI and GDPR, and One Pro adds DORA, ISO 27001 and the AI Act. One piece of evidence counts for several regulations: an MFA reading counts for KSC, ISO 27001, KRI and GDPR at once.
How long does it take to get a first result from Bersec One?
The target is a gap map and readiness score for each selected regulation within 7 days. Bersec One needs only the wizard, an asset spreadsheet import and a quick yes / partly / no self-assessment, with no systems to connect. Time to first result is measured in every installation.
What documents does Bersec One prepare?
Bersec One drafts documents from 19 PL/EN templates, including the ISMS (SZBI), security policy, risk analysis, BCP/DRP, records of processing, DPIA and Statement of Applicability. Every statement of fact cites evidence or is marked as a declaration. A named person approves each document after confirming their identity; legal content requires qualified review.
Which systems can be connected to Bersec One?
Evidence sources are optional and read-only. Linux (SSH), Active Directory/LDAP, Proxmox Backup Server and Bareos have been verified on real systems; Windows, VMware vSphere, Microsoft 365/Entra ID and Veeam are in preview. Before a source is saved, the product shows the exact commands, rights and stored fields.
How does an auditor use Bersec One?
The auditor gets a read-only panel and a tamper-evident evidence export, available at any time. The audit rehearsal shows, for each point of a regulation, what the auditor will ask and whether it is proven, declared, missing or contradicted, in a PDF report with a citation index. The auditor panel is included in One Pro.
Does Bersec One analyse network traffic?
No. Bersec One is not an NDR or SIEM tool; readings and exports from such tools can be one of its evidence sources. Network traffic is analysed by Bersec Gateway. Integration between the two products is planned; each already works on its own today.
How is Bersec One priced?
Bersec One is quoted individually, based on the regulations covered, the number of seats and the number of entities served. The licence is annual and includes regulation and template updates and support on working days. A 30-day trial on the organisation's own data is available before purchase. A quote follows a short conversation.
Start with a pilot
30 days on the organisation's own data. No risk.
Results on the organisation's own network and documents. At the end: export, data deletion and a signed Data Deletion Certificate.
kontakt@bersec.pl