NIS2 in Portugal: is your company covered?

What you need to do, and by when

• Already in forceCybersecurity Legal FrameworkDecree-Law No. 125/2025 of 4 December came into force on 4 May 2026. Regulation No. 756/2026 of 22 June sets out how it works in practice.
• ~15 September 2026Self-identification and registration on MyCiber60 working days from 23 June, the date on which the CNCS platform became available. Entities that commenced trading at a later date have 30 working days. Failure to meet this deadline is, in itself, an offence.
• 20 days after classificationCybersecurity officer and point of contactOnce the CNCS has confirmed your organisation’s classification, you must specify who is responsible for cybersecurity and appoint a permanent point of contact.
• 31 January 2027Asset inventoryOr six months after the final classification notice, whichever comes first.
• June 2028Minimum measures and annual reportYou have two years to implement the security measures for your assigned level and to submit the first report.

Fines reach 10 million euros or 2% of global turnover for essential entities, and 7 million or 1.4% for important entities. The framework also holds management bodies directly accountable.

What DataRoad does — and what it does not do

We are not lawyers and we do not carry out registration on your behalf: the self-assessment and the MyCiber submission are carried out by the organisation itself. What we do is everything that comes afterwards, which is where the real work lies.

• Asset inventoryA comprehensive survey of servers, workstations, network equipment, cloud services and access rights — the document required by the framework by January 2027, which almost nobody has prepared.
• Minimum requirements for your levelImplementation and documented evidence: access control, encryption, network segmentation, firewalls, endpoint protection, tested backups and patch management.
• Detection and logging24/7 monitoring with retained logs. Without it, there is no way to meet the 24-hour notification requirement, because you would not even know that an incident had occurred.
• Incident responseA written procedure, named individuals and a rehearsal. When this happens, the 24-hour clock is already ticking.
• Continuity and recoveryBackups that have been tested and defined recovery times — not a promise that copies exist somewhere.
• Training for staff and managementThe framework holds management bodies accountable. Short sessions and phishing simulations, with a record of who took part.

Frequently asked questions about NIS2

This page is for information purposes only and does not constitute legal advice. How your entity is classified is determined by the self-assessment on the CNCS MyCiber platform.