Poland Creates CSIRT Energia to Defend Its Power Sector

Polish grid operator Polskie Sieci Elektroenergetyczne (PSE) will set up and run CSIRT Energia, a specialised team that will help energy companies respond to cyber threats and coordinate incident handling with the Ministry of Energy. Energy Minister Miłosz Motyka and PSE President Grzegorz Onichimowski signed the agreement. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski attended the ceremony.

CSIRT Energia will be Poland's fifth sector-level incident response team, alongside CSIRT Cyfra (digital infrastructure), CSIRT KNF (banking and finance), CSIRT Infrastruktura (transport and water supply) and CSIRT CeZ (healthcare). Its remit will cover all energy subsectors defined in the national cybersecurity system act, including electricity and electric vehicle charging, as well as nuclear energy investment. The ministry currently supervises close to 1,200 energy entities in this area.

What the team will do

Under the agreement, the Minister of Energy entrusts PSE with creating, maintaining and developing the team, while the ministry, as the competent cybersecurity authority, supervises and verifies the work. PSE must prepare a launch schedule and provide staff, organisational and technical resources, tools, procedures and secure information exchange.

The team's tasks include receiving incident reports and early warnings, responding to attacks with technical measures, supporting incident coordination, cooperating with national and sector CSIRTs, and promoting information sharing, exercises and training. Gawkowski stressed that the team will support the sector rather than replace companies' own responsibility for protecting their systems.

Why it matters

Energy systems increasingly rely on IT and industrial control systems, so an attack can disrupt physical processes, not only data. According to the government cybersecurity commissioner's 2025 report, national CSIRT teams handled nearly 273,000 incidents, 144.4% more than a year earlier. In late December 2025, coordinated destructive attacks hit systems linked to more than 30 wind and solar farms and a combined heat and power plant. They did not interrupt energy supply.

PSE brings experience: it operates its own CERT and SOC units and provides cyber protection services to the European association of transmission system operators, ENTSO-E. Centralising expertise, the ministry says, should help spot recurring threats faster and limit the impact of incidents.