01
SIM list and IMEI binding
Only an allow-listed SIM joins the APN. Where the operator’s platform can bind it to an IMEI, a SIM moved to another device does not keep the session.
NIS2 / KSC
A private APN reduces device exposure. It does not satisfy the act for you.
For essential and important entities, scattered connectivity is often part of the service: a station, a water intake, a clinic, a fleet, a service point. It can be kept off the public internet and brought back to a network you already control.
02
No public IP
The address is private. The internet cannot address a packet to it. This is not a hidden NAT with a hole on demand.
03
Segmentation
A meter does not have to see a camera. Traffic between SIMs is cut where the APN variant and the firewall allow it.
04
IPsec / VPN tunnel
The path to headquarters is encrypted. Isolation removes the route. The tunnel protects the payload in transit. It is not application encryption.
05
Customer firewall
The rule for which systems at headquarters may see the device stays with you. Internet breakout goes this way, or not at all.
06
Logs
The trace of the session and of the decision sits on the firewall and in the tools you already run. An APN does not replace a SIEM or incident handling.
What the rules say — a summary, not advice
The amendment to the Polish National Cybersecurity System act, implementing the NIS2 directive (EU 2022/2555), has been in force since 3 April 2026. That is the Ministry of Digital Affairs’ statement.
Essential and important entities must apply technical and organisational measures proportionate to risk, assess risk, handle incidents and look after continuity and the supply chain.
The ministry’s timetable for entities already in scope when the amendment took effect includes entry in the register, implementation of duties — including an information security management system — by 3 April 2027, and a first audit for part of the essential entities by 3 April 2028.
Classification depends on sector, size and role. We do not decide that on a connectivity page.
Ministry of Digital Affairs — duties of essential and important entities (opens in a new tab)
Where an APN belongs in a conversation about measures
Segmentation
Field sites and branches in their own addressing, outside the flat office network.
Exposure
No public address on the device and no path from the internet to the controller.
Access
A session is granted to a listed SIM. Logs toward internal systems stay on your firewall.
Continuity
Backup connectivity for sites that must remain on the organisation’s network.
What this does not settle
- We do not state that an organisation is in scope of the act.
- We do not issue an attestation, a certificate of compliance or a legal opinion.
- We do not replace an ISMS, incident reporting, the S46 system or an audit.
- We do not claim that a tunnel by itself fills an annex to the act.
We do not decide whether an organisation is an essential or important entity, and we do not issue an attestation. Classification and audit belong with cybersecurity specialists.
Classifying the entity and auditing it is separate work. Related sites of the group do that:
audytnis.pl — NIS2 / KSC audit (opens in a new tab) 24cyber.pl — cybersecurity support (opens in a new tab) Cybersystemy (opens in a new tab)
Proposal request
Request a proposal
For companies and institutions. No price list on the site — we reply with a layout for your fleet.
Related solutions