NIS2 in Portugal (Decree-Law 125/2025): fines up to €10M, management liable, asset inventory by January 2027. Technical diagnosis in two weeks, no obligation.
More than 10 workstations · support contract · remote, on-site and phone support
For decision-makers short on time.
A €10 million fine is the worst case; the more likely one is a major client that stops buying because your company cannot prove it is secure. NIS2 in Portugal, transposed by Decree-Law No. 125/2025, has made cybersecurity a personal responsibility of management bodies. DataRoad - IT Services and Consulting, one of Portugal's reference providers of managed cybersecurity, delivers the technical side of compliance: inventory, minimum measures, detection and response, with written evidence. Headquartered in Alfragide, with support across Portugal.
| When | What is required |
|---|---|
| 3 April 2026 | Start of the Legal Framework for Cybersecurity. Decree-Law No. 125/2025 is dated 4 December; Regulation No. 756/2026 of 22 June put it into practice. |
| 23 June 2026 | MyCiber, the CNCS platform, opens. 60 working days begin for self-identification and registration, a period that ended around 15 September. Organisations that started trading later have 30 working days. |
| Qualification + 20 days | Appoint the cybersecurity officer and a permanent point of contact. |
| 31 January 2027 | Asset inventory submitted, or six months after final qualification if that date comes first. |
| June 2028 | Minimum measures for the assigned level in place and first annual report. |
The CNCS does not notify anyone. Each organisation must assess and register itself. If you have not done so yet, it is this week's priority.
Self-assessment and submission on MyCiber are acts of your entity. We do not carry them out on your behalf and we do not give legal advice. We prepare the technical information and take on everything that follows, which is where the real effort lies.
Chosen by respected and international companies
![MUN[it]](/assets/img/logos-c/munit.webp "MUN[it]"){kind=small}
★★★★★ 5,0 · 52 Google reviewsIn two weeks. We carry out the survey, cross-check it against the measures for your level and deliver a report: gaps, urgent items, costs. The report is yours; you can implement it with us or with another partner. Request a NIS2 diagnosis.
NIS2 generally applies to medium and large organisations in critical sectors: energy, transport, banking, health, water, digital infrastructure, managed ICT services, public administration, postal services, waste, chemicals, food, manufacturing and research, among others. Some cases are covered regardless of size. The entity itself decides, in the MyCiber self-assessment.
No, because your in-scope clients must control their supplier risk. Expect security questionnaires, new contract clauses and requests for evidence, especially if you sell to health, banking, energy, government or industry. Having an inventory, controls and logs ready becomes a condition for continuing to sell to these clients.
The maximum fine is €10 million or 2% of annual worldwide turnover, whichever is higher, for essential entities. For important entities, the limit is €7 million or 1.4%. On top of the fine, management is directly liable and cannot transfer that responsibility to the IT provider.
The early warning must go out within 24 hours, the notification with assessment within 72 hours and the final report within 30 days. Without monitoring with log retention, the first deadline is missed because the attack is not even noticed. That is why detection is the first technical measure DataRoad puts in place.
The number of measures depends on the level assigned by the risk profile: 39 at basic, 75 at substantial and 91 at high. The basis is the National Cybersecurity Reference Framework, aligned with NIST CSF 2.0. The two-week diagnosis cross-checks what the company already has against the measures for its level.
No, the law reserves that act for the entity itself. DataRoad prepares the technical data and delivers the complete technical component: inventory, controls, monitoring, logs and the ability to respond within the legal deadlines. Ongoing execution is carried out under an IT Unlimited contract, annual and no lock-in.
Informational content, not legal advice. Qualification results from self-assessment on the CNCS MyCiber platform.
Ongoing execution is carried out under an IT Unlimited contract. We do not provide one-off support or sell standalone equipment. Request a no-obligation proposal. Talk about NIS2.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950 * or write to sales@dataroad.pt.
*Call to a Portuguese national landline.
A French group founded in 1984 hands a Portuguese MSP the infrastructure of Antony, Wissous and Vialonga: high-availability firewalls, fibre…
· 4 min read
A sixth project for the same public body since 2019: when a tender goes to the same company again, it is the previous network doing the talk…
· 6 min read
The same security architecture for every client, operated rather than merely installed. In 11 years, DataRoad has never suffered a security …
· 8 min read
A network made of different brands and installers fails at the joins. DataRoad has managed more than 138 Ubiquiti UniFi sites on the same te…
· 3 min readA premium Portuguese MSP at a French group's headquarters: the audit of France Affiches' network and systems was done on site in Paris and d…
· 4 min read
Paying for a provider's offices speeds nothing up. Immediate remote support, an in-house datacentre and on-site work only when the network c…
· 5 min read
A public tender gives no second chances. Since 2017, eight public bodies, from RTP to SSAP, have awarded DataRoad 24 IT contracts, all verif…
· 5 min read
Embassy of Korea, Consulate of Brazil, DCIAP, Reltio by SAP, beQom, Mitrelli Group: organisations that demand written guarantees chose DataR…
· 4 min read
Whoever chooses the IT partner for a subsidiary in Portugal is often in Geneva or New York. DataRoad's website now speaks the language of th…
· 4 min readNumbers you can verify
Partners and certifications
DataRoad · Managed cybersecurity
The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident.
We do IT right.
Automated, monitored backups stored off site.
More than 10 workstations · support contract · remote, on-site and phone support
DataRoad works only for companies under an IT Unlimited contract. We do not take subcontracted work or one-off call-outs.
