NIS2 explained for SMEs: applies to my company and what to do now

8 min read · DataRoad

NIS2 explained for SMEs It boils down to one question and one task. The question: is my company covered? The task: if it is, prove that it has appropriate cybersecurity measures — and know how to report an incident within 24 hours. This guide answers both of these in management-language, using the numbers confirmed in the text of the law and in the regulation of the National Cybersecurity Center (CNCS).

A note before we begin: DataRoad does not provide legal advice. We implement the technical measures. The qualification of your company must be validated by your legal advisor.

What is the NIS2 and what has changed in Portugal

NIS2 is a European directive that obliges companies and entities in important sectors for society to manage cybersecurity risk in a structured manner. In Portugal, it was transposed by Decree-Law No. 125/2025, published on December 4, 2025, which created the new Cybersecurity Legal Regime. The decree entered into force 120 days after publication, in April 2026.

The CNCS then published Regulation No. 756/2026 of 22 June, which put the scheme into effect and opened the MyCiber platform on June 23, 2026. According to the CNCS, as cited by the Lusa news agency, the new scheme is expected to cover approximately six thousand entities — compared with approximately 450 in the previous regime.

Does it apply to my company? 6 questions

If you answer “yes” to any of the first three, you are likely to be covered — and the decision should be formalized with legal support.

1. Is your sector covered by the laws? These include, among others, energy, transport, banking, health, water, digital infrastructure, management of ICT services, public administration, postal services, waste, chemicals, food, the manufacturing industry and research.
2. Is your company medium or large? According to the European definition, a company with 50 or more employees, or an annual turnover and balance sheet both above 10 million euros, ceases to be a small company.
3. Does it provide any services that are covered regardless of the size? For example, electronic communications, trusted services, DNS services, or being the sole provider of an essential service.
4. Does it belong to a group? In the European definition of SMEs, a company linked to a group may have to add up the employees and the group’s values. A “small” company can therefore be counted as an average.
5. Is it a supplier of an included entity? Even if you are not covered, your customers are required to manage the suppliers' risk. You will receive questionnaires, contractual clauses, and requests for evidence.
6. Have you already completed the self-assessment in MyCiber? The responsibility to identify oneself lies with the company, not with the CNCS. If you are covered and have not yet done so, address the matter immediately with your legal advisor.

The deadlines that count

The minimum measures are organized into three levels, assigned according to the entity’s risk: basic (39 measures), substantial (75) and high (91).

Incidents: the 24-hour clock

It is the obligation that requires the most technical preparation. In the event of an incident with significant impact, the law (articles 42 to 44) defines:

• Up to 24 hours after verification: initial notification.
• Up to 72 hours, When necessary: update with the initial assessment of severity and impact.
• Up to 24 hours after the end of significant impact: notification of end of impact.
• 30 working days after this notification: final report.

Reporting within 24 hours is only possible if someone reports the incident in time. This requires monitoring, kept logs, and a written procedure that states who decides and who reports. An incident detected on Monday morning, after a weekend without surveillance, is already too late. That is why, in covered companies, we recommend the IT Unlimited Premium 365, The only plan with coverage for nights, weekends, and holidays.

Fines and management responsibility

More important than the maximum value: the law places responsibility on the management bodies. They are the ones who approve and oversee cybersecurity measures and promote regular training — and this responsibility cannot be freely delegated. The training covers the holders of the management bodies and the employees. NIS2 has ceased to be a “computer science” issue.

What to do tomorrow: the technical measures

This is where DataRoad comes in. Regardless of the level assigned, there are measures that always appear — and that any company with more than 10 employees should have, whether or not they are covered by GDPR:

1. Inventory of assets: servers, computers, network, cloud services and access. Start with ours IT hardware audit checklist.
2. Access control with MFA in email, cloud and remote access. See how in multi-factor authentication in the company.
3. Off-site and tested backups, With defined recovery times — see backup solutions.
4. Managed firewall and network segmentation.
5. Endpoint protection and update management.
6. Written policies and training with attendance records — we have a starting point in 7 internal cybersecurity policies.
7. Procedure for responding to incidents, With defined responsibilities and simulations.

Every measure must be documented. In NIS2, being safe isn’t enough: you need to be able to prove it. The details of our service are on the page. NIS2 — technical implementation.

A real case: managed security in a park with 350 posts

Ventask has been a client of DataRoad since 2016 and has more than 350 employees at IT Unlimited. DataRoad manages the entire networking area, manages and maintains the corporate firewalls, implements and manages endpoint protection, secure remote work solutions, and the wireless network — with proactive monitoring and alarm management in Premium 365 plan.

These are the technical layers that NIS2 requests — perimeter, endpoints, remote access, and continuous monitoring — in a single contract. Read the Ventask case.

Frequently Asked Questions

Does NIS2 apply to companies with fewer than 50 employees?

As a rule, no, unless the turnover and balance sheet both exceed 10 million euros, if the company belongs to a group that counts it as an average, or if it provides a service that is covered regardless of the size. Even outside the scope, it may be affected as a supplier of entities covered by the scope.

What are the deadlines for reporting an incident?

Initial notification within 24 hours after verification of a significant incident, update within 72 hours when necessary, notification of end of impact within 24 hours after it ends, and final report within 30 working days.

What is the maximum amount of fines?

For essential entities, up to 10 million euros or 2% of the annual worldwide turnover; for important entities, up to 7 million euros or 1.4%, applying the higher value.

Does DataRoad register on MyCiber for my company?

No. Self-identification and registration are actions carried out by the entity itself, and the qualification must be legally validated. DataRoad prepares the necessary technical information and implements the required security measures.

Technical diagnosis NIS2 within 10 working days

We assess your infrastructure against the technical requirements of NIS2 and deliver a written document outlining the gaps, the urgency of each one, and the cost of resolving them. For companies with more than 10 seats · contract of assistance · remote, on-site, and telephone support. Explore our services cyber security for business.

Sources

• Decree-Law No. 125/2025 of December 4 — Official Gazette: diariodarepublica.pt (full text also available in EUR-Lex)
• Regulation No. 756/2026 of 22 June (CNCS) — Official Gazette of the Republic: diariodarepublica.pt
• MyCiber platform (CNCS): myciber.gov.pt
• European Commission — Definition of SME: ec.europa.eu
• ECO/Lusa — Entities have 60 working days to register on MyCiber (June 24, 2026): eco.sapo.pt