---
title: "NIS2 in Portugal: what the board must comply with, and by when"
description: "NIS2 in Portugal (Decree-Law 125/2025): fines up to €10M, management liable, asset inventory by January 2027. Technical diagnosis in two weeks, no obligation."
language: en
url: https://www.dataroad-it.com/en/nis2-compliance-portugal/
source: https://www.dataroad-it.com/en/nis2-compliance-portugal/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> NIS2 in Portugal (Decree-Law 125/2025): fines up to €10M, management liable, asset inventory by January 2027. Technical diagnosis in two weeks, no obligation.

# NIS2 in Portugal: what the board must comply with, and by when

At a glance For decision-makers short on time.

- 01 NIS2 in force in Portugal since 3 April 2026, under Decree-Law No. 125/2025.
- 02 Fines up to €10M or 2% of worldwide turnover; the board is directly liable.
- 03 Asset inventory by 31 January 2027; minimum measures and report by June 2028.
- 04 Technical diagnosis in two weeks: what is missing, what is urgent and what it costs.

**A €10 million fine is the worst case; the more likely one is a major client that stops buying because your company cannot prove it is secure. NIS2 in Portugal, transposed by Decree-Law No. 125/2025, has made cybersecurity a personal responsibility of management bodies. DataRoad - IT Services and Consulting, one of Portugal's reference providers of managed cybersecurity, delivers the technical side of compliance: inventory, minimum measures, detection and response, with written evidence. Headquartered in Alfragide, with support across Portugal.**

## How much can ignoring NIS2 cost?

- **Essential entities** Up to €10 million or 2% of worldwide turnover, whichever is higher.
- **Important entities** Up to €7 million or 1.4%.
- **The board** Is directly liable. Blame cannot be delegated to the IT provider.
- **Failing to register** Is an administrative offence in itself.

## Which deadlines apply from now on?

| When | What is required |
| --- | --- |
| 3 April 2026 | Start of the Legal Framework for Cybersecurity. Decree-Law No. 125/2025 is dated 4 December; Regulation No. 756/2026 of 22 June put it into practice. |
| 23 June 2026 | MyCiber, the CNCS platform, opens. 60 working days begin for self-identification and registration, a period that ended around 15 September. Organisations that started trading later have 30 working days. |
| Qualification + 20 days | Appoint the cybersecurity officer and a permanent point of contact. |
| 31 January 2027 | Asset inventory submitted, or six months after final qualification if that date comes first. |
| June 2028 | Minimum measures for the assigned level in place and first annual report. |

The CNCS does not notify anyone. Each organisation must assess and register itself. If you have not done so yet, it is this week's priority.

## What does DataRoad do, and what stays with your company?

Self-assessment and submission on MyCiber are acts of your entity. We do not carry them out on your behalf and we do not give legal advice. We prepare the technical information and take on everything that follows, which is where the real effort lies.

- **Inventory** Every server, workstation, network device, cloud service and access, in a document ready for January 2027. Few companies have one.
- **Minimum measures, proven** Access management, encryption, segmentation, [managed firewall](https://www.dataroad-it.com/en/managed-firewall-services-portugal/), endpoint protection, [backups that actually restore](https://www.dataroad-it.com/en/managed-backup-services-portugal/) and patching, with written evidence.
- **Detection** Monitoring with log retention, on a 24/7 basis on the Premium 365 plan. Without detection, 24-hour notification is impossible.
- **Response** A written incident plan, assigned roles and a simulation before the real day.
- **Recovery** [business continuity](https://www.dataroad-it.com/en/disaster-recovery-services-portugal/) with set recovery times, not the belief that copies exist somewhere.
- **People** Short training and phishing tests for staff and the board, with a record of who took part.

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

## How soon will you know whether you comply?

In two weeks. We carry out the survey, cross-check it against the measures for your level and deliver a report: gaps, urgent items, costs. The report is yours; you can implement it with us or with another partner. [Request a NIS2 diagnosis](https://www.dataroad-it.com/en/contact-dataroad-managed-it-proposal/?assunto=NIS2).

- **11 years** without a single security incident at DataRoad.
- **232 clients** and **Top 5% SME** certification, according to scoring.pt.

## Decision-makers' questions about NIS2

### Does NIS2 apply to my company?

NIS2 generally applies to medium and large organisations in critical sectors: energy, transport, banking, health, water, digital infrastructure, managed ICT services, public administration, postal services, waste, chemicals, food, manufacturing and research, among others. Some cases are covered regardless of size. The entity itself decides, in the MyCiber self-assessment.

### I am not in scope. Can I ignore NIS2?

No, because your in-scope clients must control their supplier risk. Expect security questionnaires, new contract clauses and requests for evidence, especially if you sell to health, banking, energy, government or industry. Having an inventory, controls and logs ready becomes a condition for continuing to sell to these clients.

### What is the maximum fine?

The maximum fine is €10 million or 2% of annual worldwide turnover, whichever is higher, for essential entities. For important entities, the limit is €7 million or 1.4%. On top of the fine, management is directly liable and cannot transfer that responsibility to the IT provider.

### How long do I have to report an incident?

The early warning must go out within 24 hours, the notification with assessment within 72 hours and the final report within 30 days. Without monitoring with log retention, the first deadline is missed because the attack is not even noticed. That is why detection is the first technical measure DataRoad puts in place.

### How many technical measures do I have to apply?

The number of measures depends on the level assigned by the risk profile: 39 at basic, 75 at substantial and 91 at high. The basis is the National Cybersecurity Reference Framework, aligned with NIST CSF 2.0. The two-week diagnosis cross-checks what the company already has against the measures for its level.

### Does DataRoad submit the MyCiber registration?

No, the law reserves that act for the entity itself. DataRoad prepares the technical data and delivers the complete technical component: inventory, controls, monitoring, logs and the ability to respond within the legal deadlines. Ongoing execution is carried out under an IT Unlimited contract, annual and no lock-in.

*Informational content, not legal advice. Qualification results from self-assessment on the [CNCS MyCiber platform](https://www.cncs.gov.pt/pt/myciber/).*

## Further reading

- [Managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/): perimeter, endpoints and email for a fixed monthly fee.
- [NOC and monitoring](https://www.dataroad-it.com/en/noc-it-monitoring-portugal/): 24/7 with logs, on Premium 365.
- [Security checklist for SMEs](https://www.dataroad-it.com/en/managed-cybersecurity-smes-9-defences/): where to start.
- [News and projects](https://www.dataroad-it.com/en/lisbon-msp-managed-networks-it/): what we have already delivered.

## Next step: a no-obligation NIS2 diagnosis

Ongoing execution is carried out under an IT Unlimited contract. We do not provide one-off support or sell standalone equipment. Request a no-obligation proposal. [Talk about NIS2](https://www.dataroad-it.com/en/contact-dataroad-managed-it-proposal/?assunto=NIS2).

**More than 10 workstations · support contract · remote, on-site and telephone support.**

Call **+351 211 459 950 *** or write to sales@dataroad.pt.

**Call to a Portuguese national landline.*

News

## Projects delivered and news from DataRoad.

[See all news →](https://www.dataroad-it.com/en/news/)

[NewsFrance Affiches: three sites, no single point of failureA French group founded in 1984 hands a Portuguese MSP the infrastructure of Antony, Wissous and Vialonga: high-availability firewalls, fibre…25 October 2026 · 4 min read](https://www.dataroad-it.com/en/france-affiches-it-three-sites-paris-lisbon/)[NewsSSAP: a managed business wireless network with 14 access pointsA sixth project for the same public body since 2019: when a tender goes to the same company again, it is the previous network doing the talk…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/ssap-managed-wireless-network-14-access-points/)[NewsManaged cybersecurity: one architecture, no incidents in 11 yearsThe same security architecture for every client, operated rather than merely installed. In 11 years, DataRoad has never suffered a security …12 October 2026 · 8 min read](https://www.dataroad-it.com/en/managed-cybersecurity-single-architecture/)[NewsManaged Ubiquiti UniFi: more than 138 sites and 1321 devicesA network made of different brands and installers fails at the joins. DataRoad has managed more than 138 Ubiquiti UniFi sites on the same te…10 October 2026 · 3 min read](https://www.dataroad-it.com/en/managed-ubiquiti-unifi-networks/)[NewsFrance Affiches: an on-site IT audit in ParisA premium Portuguese MSP at a French group's headquarters: the audit of France Affiches' network and systems was done on site in Paris and d…10 October 2026 · 4 min read](https://www.dataroad-it.com/en/france-affiches-it-audit-paris/)[NewsManaged remote support for companies without a fixed officePaying for a provider's offices speeds nothing up. Immediate remote support, an in-house datacentre and on-site work only when the network c…8 October 2026 · 5 min read](https://www.dataroad-it.com/en/managed-it-remote-companies-europe-usa/)[News24 public IT contracts: the standard of RTP, Técnico and SSAPA public tender gives no second chances. Since 2017, eight public bodies, from RTP to SSAP, have awarded DataRoad 24 IT contracts, all verif…3 October 2026 · 5 min read](https://www.dataroad-it.com/en/public-contracts-it-partner-rtp-tecnico-ssap/)[NewsEmbassies and international groups: why they choose DataRoadEmbassy of Korea, Consulate of Brazil, DCIAP, Reltio by SAP, beQom, Mitrelli Group: organisations that demand written guarantees chose DataR…12 September 2026 · 4 min read](https://www.dataroad-it.com/en/embassies-international-groups-msp-portugal/)[NewsDataRoad in five languages: managed IT for overseas head officesWhoever chooses the IT partner for a subsidiary in Portugal is often in Geneva or New York. DataRoad's website now speaks the language of th…12 September 2026 · 4 min read](https://www.dataroad-it.com/en/managed-it-services-five-languages/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed cybersecurity

## One StepAhead of IT.

The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident.

- **Top 5%** SMEs · scoring.pt
- **11** years in business, since 2015
- **232** companies protected

We do **IT** right.

Contact

## Have your backups ever been put to the test?

Automated, monitored backups stored off site.

Phone +351 211 459 950 * *Call to a Portuguese landline

Sales email sales@dataroad.pt

Headquarters Avenida dos Moinhos 12 B, 2610-119 Alfragide, Portugal

More than 10 workstations · support contract · remote, on-site and phone support

DataRoad works only for companies under an IT Unlimited contract. We do not take subcontracted work or one-off call-outs.

---
Versão HTML desta página: https://www.dataroad-it.com/en/nis2-compliance-portugal/