NIS2 for SMEs: what Decree-Law 125/2025 requires, where to start

The ceiling is not the most serious point. The decree-law gives management bodies the task of approving and overseeing cybersecurity measures and promoting regular training, for themselves and for staff. That responsibility cannot be freely delegated. Cybersecurity has become a matter for the board, not for the IT person.

It originates in a European directive. NIS2 imposes structured cybersecurity risk management on sectors that matter to society. Portugal transposed it through DL 125/2025, published on 4 December 2025, which established the Legal Framework for Cybersecurity. It came into force 120 days later, in April 2026.

CNCS Regulation 756/2026 of 22 June put the framework into operation, and the MyCiber platform opened the following day, 23 June 2026. According to Lusa, the CNCS estimates around six thousand entities in scope, compared with around 450 under the previous regime.

There are two categories. Essential: the most critical sectors and larger companies. Important: the others within scope. Both apply measures and notify incidents; they differ in the level of requirement, supervision and maximum fines.

Answer six questions. A "yes" to any of the first three indicates probable inclusion, to be formalised with legal support.

1. Sector: is your activity listed in the annexes? Healthcare, banking, energy, water, transport, digital infrastructure, managed ICT services, public administration, postal services, research, manufacturing, food, chemicals and waste, among others.
2. Size: do you have 50 or more employees? Or do annual turnover and balance sheet each exceed €10 million? Under the European definition, you are no longer a small enterprise.
3. A service in scope regardless of size: electronic communications, trust services, DNS, or sole provider of an essential service.
4. Group: a member of a group may have to aggregate employees and figures, moving from small to medium.
5. Supply chain: if you sell to in-scope entities, they must control supplier risk. Expect questionnaires, clauses and requests for evidence.
6. MyCiber: have you completed the self-assessment? Self-identification is the company's job, not the CNCS's. If you are in scope and have not done it, resolve it now with your lawyer.

• Already passed MyCiber registration for active entities: 60 working days from 23 June 2026; the deadline closed in mid-September 2026.
• New entities 30 working days after starting activity.
• Cybersecurity officer and permanent point of contact Within 20 working days of being notified of the classification.
• Asset inventory Six months after final classification or 31 January 2027, whichever comes first.
• Minimum measures and annual report Two years from the CNCS regulation, i.e. mid-2028.

The minimum requirements are split into three levels, assigned by risk: basic with 39 measures, substantial with 75 and high with 91.

Only if you detect it in time. No other obligation weighs so heavily on the infrastructure. Articles 42, 43 and 44 set the timetable for incidents with significant impact:

1. First notification: 24 hours after it is identified.
2. Update: within 72 hours, if necessary, with severity and impact assessed.
3. End-of-impact notice: 24 hours after the significant impact ends.
4. Final report: within 30 working days of that notice.

Meeting this requires three things: active monitoring, retained logs and a written procedure defining who decides and who speaks to the CNCS. A Saturday attack only spotted on Monday morning is already out of time. That is why we point in-scope companies to IT Unlimited Premium 365: it is the only DataRoad plan that covers nights, public holidays and weekends.

Whatever level is assigned, there is a core that always appears, and that any company above 10 workstations should have, in scope or not. This is where DataRoad works.

• Inventory Servers, workstations, network, cloud and access. Starting point: the IT estate audit checklist.
• MFA On email, cloud services and remote access. A practical guide in MFA in the company.
• Tested external backups With defined restore times; see managed backups for businesses.
• Managed firewalls With network segmentation.
• Endpoints Protection and update management.
• Policies and training Documented, with attendance records. A basis in the 7 cybersecurity policies every company should have.
• Incident response A procedure with named owners and simulations.

Everything must be documented. Under NIS2 it is not enough to be protected; you have to prove it. The full service is at NIS2 technical implementation.

Ventask has been a DataRoad client since 2016, with more than 350 workstations under an IT Unlimited contract. DataRoad handles all networking, administration of the corporate firewalls, deployment and management of endpoint protection, secure remote working and Wi-Fi, with proactive monitoring and alerts on Premium 365.

Continuous oversight, perimeter, endpoints and remote access: the layers NIS2 requires, under a single contract. Explore the Ventask case study in detail.

We compare your infrastructure with the NIS2 technical measures. The result is a report listing every gap, its urgency and the cost of closing it. No commitment. See also our managed cybersecurity for businesses offer.

More than 10 workstations · support contract · remote, on-site and telephone support. +351 211 459 950 * · sales@dataroad.pt

*Call to a Portuguese landline.

• DL 125/2025 in the Diário da República · EUR-Lex version
• CNCS Regulation no. 756/2026
• MyCiber platform
• European Commission: what is an SME
• ECO/Lusa, 24 June 2026: MyCiber registration deadline