--- title: "NIS2 for SMEs: what Decree-Law 125/2025 requires, where to start" description: "Fines up to €10 million and 24-hour reporting: what NIS2 (Decree-Law 125/2025) requires of an SME and which measures to take now. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/nis2-smes-managed-cybersecurity-guide/ source: https://www.dataroad-it.com/en/nis2-smes-managed-cybersecurity-guide/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Fines up to €10 million and 24-hour reporting: what NIS2 (Decree-Law 125/2025) requires of an SME and which measures to take now. No-obligation proposal. # NIS2 for SMEs: what Decree-Law 125/2025 requires, where to start At a glance For decision-makers short on time. - 01 NIS2 has applied in Portugal through Decree-Law no. 125/2025 since April 2026. - 02 Maximum fine: €10m or 2% of worldwide turnover for essential entities. - 03 Significant incident: first notification within 24 hours, final report within 30 working days. - 04 Mandatory technical measures by mid-2028; top management is accountable for them. ### In this article NIS2 can cost an in-scope company 2% of global turnover or €10 million, whichever is higher, and it makes the board personally answerable for cybersecurity. For an SME, the question is settled in two steps: confirm whether it falls within the scope of DL 125/2025 and, if it does, be able to demonstrate technical measures and raise the alert on an incident within 24 hours. This managed cybersecurity guide covers both, with figures from the decree-law and the CNCS regulation. **Note:** DataRoad does not give legal opinions. We deliver the technical side. Your company's legal position should be confirmed by your lawyer. ## What is at stake for my company? | Category | Maximum fine for a very serious offence | | --- | --- | | Essential entity | 2% of worldwide annual turnover or €10 million, whichever is higher | | Important entity | 1.4% of worldwide annual turnover or €7 million, whichever is higher | The ceiling is not the most serious point. The decree-law gives management bodies the task of approving and overseeing cybersecurity measures and promoting regular training, for themselves and for staff. That responsibility cannot be freely delegated. Cybersecurity has become a matter for the board, not for the IT person. ## Where does the obligation come from and how many companies does it cover? It originates in a European directive. NIS2 imposes structured cybersecurity risk management on sectors that matter to society. Portugal transposed it through DL 125/2025, published on 4 December 2025, which established the Legal Framework for Cybersecurity. It came into force 120 days later, in April 2026. CNCS Regulation 756/2026 of 22 June put the framework into operation, and the MyCiber platform opened the following day, 23 June 2026. According to Lusa, the CNCS estimates around six thousand entities in scope, compared with around 450 under the previous regime. There are two categories. **Essential**: the most critical sectors and larger companies. **Important**: the others within scope. Both apply measures and notify incidents; they differ in the level of requirement, supervision and maximum fines. ## How do I know whether I am in scope? Answer six questions. A "yes" to any of the first three indicates probable inclusion, to be formalised with legal support. - **Sector**: is your activity listed in the annexes? Healthcare, banking, energy, water, transport, digital infrastructure, managed ICT services, public administration, postal services, research, manufacturing, food, chemicals and waste, among others. - **Size**: do you have 50 or more employees? Or do annual turnover and balance sheet each exceed €10 million? Under the European definition, you are no longer a small enterprise. - **A service in scope regardless of size**: electronic communications, trust services, DNS, or sole provider of an essential service. - **Group**: a member of a group may have to aggregate employees and figures, moving from small to medium. - **Supply chain**: if you sell to in-scope entities, they must control supplier risk. Expect questionnaires, clauses and requests for evidence. - **MyCiber**: have you completed the self-assessment? Self-identification is the company's job, not the CNCS's. If you are in scope and have not done it, resolve it now with your lawyer. ## Which dates do I have to meet? - **Already passed** MyCiber registration for active entities: 60 working days from 23 June 2026; the deadline closed in mid-September 2026. - **New entities** 30 working days after starting activity. - **Cybersecurity officer and permanent point of contact** Within 20 working days of being notified of the classification. - **Asset inventory** Six months after final classification or 31 January 2027, whichever comes first. - **Minimum measures and annual report** Two years from the CNCS regulation, i.e. mid-2028. The minimum requirements are split into three levels, assigned by risk: basic with 39 measures, substantial with 75 and high with 91. ## Can I notify an incident within 24 hours? Only if you detect it in time. No other obligation weighs so heavily on the infrastructure. Articles 42, 43 and 44 set the timetable for incidents with significant impact: - **First notification**: 24 hours after it is identified. - **Update**: within 72 hours, if necessary, with severity and impact assessed. - **End-of-impact notice**: 24 hours after the significant impact ends. - **Final report**: within 30 working days of that notice. Meeting this requires three things: active monitoring, retained logs and a written procedure defining who decides and who speaks to the CNCS. A Saturday attack only spotted on Monday morning is already out of time. That is why we point in-scope companies to [IT Unlimited Premium 365](https://www.dataroad-it.com/en/premium-365-24-7-managed-it/): it is the only DataRoad plan that covers nights, public holidays and weekends. ## Which technical measures should I implement first? Whatever level is assigned, there is a core that always appears, and that any company above 10 workstations should have, in scope or not. This is where DataRoad works. - **Inventory** Servers, workstations, network, cloud and access. Starting point: the [IT estate audit checklist](https://www.dataroad-it.com/en/it-estate-audit-checklist-8-blocks/). - **MFA** On email, cloud services and remote access. A practical guide in [MFA in the company](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). - **Tested external backups** With defined restore times; see [managed backups for businesses](https://www.dataroad-it.com/en/managed-backup-services-portugal/). - **Managed firewalls** With network segmentation. - **Endpoints** Protection and update management. - **Policies and training** Documented, with attendance records. A basis in [the 7 cybersecurity policies every company should have](https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/). - **Incident response** A procedure with named owners and simulations. Everything must be documented. Under NIS2 it is not enough to be protected; you have to prove it. The full service is at [NIS2 technical implementation](https://www.dataroad-it.com/en/nis2-compliance-portugal/). ## What does this look like at a real client? Ventask has been a DataRoad client since 2016, with more than 350 workstations under an IT Unlimited contract. DataRoad handles all networking, administration of the corporate firewalls, deployment and management of endpoint protection, secure remote working and Wi-Fi, with proactive monitoring and alerts on Premium 365. Continuous oversight, perimeter, endpoints and remote access: the layers NIS2 requires, under a single contract. Explore the [Ventask case study in detail](https://www.dataroad-it.com/en/ventask-managed-firewalls-350-workstations/). ## Frequently asked questions ### Does a company with fewer than 50 employees escape NIS2? As a rule, yes. The exceptions: turnover and balance sheet each above €10 million, membership of a group that makes it medium-sized, or a service in scope regardless of size. Even out of scope, it may still be required to comply as a supplier. ### How long is there to notify a significant incident? 24 hours for the first notification. Then comes an update within 72 hours, if necessary, an end-of-impact notice within 24 hours and, within 30 working days, the final report. ### How high can NIS2 fines go? For essential entities, 2% of worldwide turnover or €10 million; for important entities, 1.4% or €7 million. The higher figure always applies. ### Does DataRoad register my company on MyCiber? No. Registration and self-identification are acts of the entity itself, with legal validation. We gather the technical information and implement the required measures. ## Want to know where you are exposed, in writing, within 10 working days? We compare your infrastructure with the NIS2 technical measures. The result is a report listing every gap, its urgency and the cost of closing it. No commitment. See also our [managed cybersecurity for businesses](https://www.dataroad-it.com/en/managed-cybersecurity-services/) offer. **More than 10 workstations · support contract · remote, on-site and telephone support.** +351 211 459 950 * · sales@dataroad.pt **Call to a Portuguese landline.* ## Sources - [DL 125/2025 in the Diário da República](https://diariodarepublica.pt/dr/detalhe/decreto-lei/125-2025-962603401) · [EUR-Lex version](https://eur-lex.europa.eu/legal-content/PT/TXT/PDF/?uri=NIM:202506649) - [CNCS Regulation no. 756/2026](https://diariodarepublica.pt/dr/detalhe/regulamento/756-2026-1134399056) - [MyCiber platform](https://myciber.gov.pt) - [European Commission: what is an SME](https://single-market-economy.ec.europa.eu/smes/sme-fundamentals/sme-definition_en) - [ECO/Lusa, 24 June 2026: MyCiber registration deadline](https://eco.sapo.pt/2026/06/24/entidades-tem-60-dias-uteis-para-se-registarem-na-plataforma-myciber-no-ambito-da-ciberseguranca/) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **MFA** on every managed account - **0** DataRoad security incidents in 11 years - **5 ★** on Google · 52 reviews We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/nis2-smes-managed-cybersecurity-guide/