Regulatory compliance
NIS2, DORA, CRA and CNPD: Compliance without the complexity
The European Union has raised its requirements for cybersecurity, digital resilience and product security, and Cabo Verde has strengthened its data protection law. There are deadlines, management accountability and fines. We help you understand whether your organization is covered and prepare to comply, in clear, proportionate steps.
Directive (EU) 2022/2555
NIS2: cybersecurity across 18 sectors
Applies to medium-sized and large entities in energy, transport, health, banking, digital infrastructure, manufacturing, ICT services and more. In Portugal, the regime has been in force since April 3, 2026.
- Fines of up to €10M or 2% of worldwide turnover
- Incident notification within 24 hours, 72 hours and 1 month
- The management body is accountable for cybersecurity
Read the NIS2 guide
Regulation (EU) 2022/2554
DORA: digital resilience in the financial sector
Applies since January 17, 2025 to banks, insurers, asset managers, payment and crypto-asset service providers, and the ICT providers that serve them.
- Initial notification of major incidents within 4 hours of classification
- Resilience testing and a register of ICT providers
- Contracts with mandatory clauses
Read the DORA guide
Regulation (EU) 2024/2847
CRA: security of products with digital elements
Applies to manufacturers, importers and distributors of products with digital elements sold in the European Union. Reporting of exploited vulnerabilities and severe incidents has been mandatory since September 11, 2026.
- Early warning within 24 hours and notification within 72 hours
- Security by design and throughout the entire life cycle
- Remaining obligations from December 11, 2027
Read the CRA guide
Law No. 133/V/2001 · CNPD
Data protection: the law of Cabo Verde
Applies to any organization, public or private, that processes personal data. The 2021 reform brought it closer to the GDPR, and the National Data Protection Commission (CNPD) oversees compliance.
- Personal data breach notification to the CNPD within 72 hours
- Prior notification and authorization for certain processing
- Data subject rights and a data protection officer (DPO)
Read the CNPD guide
01
Scoping assessment
We determine whether NIS2, DORA, the CRA, the data protection law or several of them apply, and in what capacity.
02
Gap analysis
We compare what you have in place with what the law requires, measure by measure.
03
Plan and implementation
Policies, processes and controls, with priorities, deadlines and owners.
04
Training and simulation
Training for the management body and exercises in incident and personal data breach notification.