Quick summary
What NIS2 is
NIS2 (Network and Information Security, second version) is the European directive that sets a common, more demanding level of cybersecurity across the European Union. It replaced the first NIS Directive (2016), which applied to only a few operators. NIS2 extends the scope to many more sectors and organizations, imposes minimum risk-management measures, requires incidents to be reported within short deadlines, and gives authorities real powers of inspection and sanction.
Because it is a directive, each Member State had to transpose it into national law. In Portugal, this was done by Decree-Law No. 125/2025, published on December 4, 2025, which creates the new Cybersecurity Legal Framework, and it was put into practice by CNCS Regulation No. 756/2026, which defines the platform, the reference framework and the minimum measures.
Two ideas change how cybersecurity has to be thought about in a covered organization: responsibility moves to top management (the management body approves and oversees the measures and is accountable for them), and the supply chain now counts (you must manage the risk posed by suppliers and service providers).
Timeline and deadlines
From the European directive to enforcement in Portugal, these are the dates that matter:
- Jan. 16, 2023NIS2 Directive enters into force. The transposition period for Member States begins.
- Oct. 17, 2024Transposition deadline ends. The original directive (NIS1) is repealed on October 18, 2024. Portugal had not yet completed transposition by this date.
- Dec. 4, 2025Decree-Law No. 125/2025 published (Cybersecurity Legal Framework).
- Jan. 20, 2026The European Commission proposes targeted amendments to NIS2 to simplify compliance. The proposal is following the EU legislative process; it is worth keeping track of it.
- Apr. 3, 2026Decree-Law No. 125/2025 enters into force (120 days after publication).
- June 22–23, 2026Regulation No. 756/2026 published and MyCiber platform in operation. Entity registration and self-identification begin.
- Sept. 15, 2026MyCiber registration deadline ends (60 business days after the platform launch).
- +20 business daysSecurity officer and permanent point of contact. The deadline runs from the date CNCS notifies the entity of its qualification.
- Up to 24 monthsTransitional period for the minimum cybersecurity measures set out in the Regulation. Confirm with CNCS the exact date that applies to your entity.
- Oct. 17, 2027First review of the directive by the European Commission.
CNCS estimate: around 6,000 covered entities in Portugal, compared with around 450 under the previous regime.
Covered companies
1. The size criterion
As a rule, it applies to medium-sized and large organizations operating in the sectors below, that is, with at least 50 employees or with annual turnover and annual balance sheet above €10 million. There are exceptions: certain entities are covered regardless of size, such as DNS service providers, top-level domain name registries, trust service providers and providers of public electronic communications networks or services, as well as entities that are the sole provider of an essential service in a country.
2. The sectors
| Sectors of high criticality (Annex I) | Other critical sectors (Annex II) |
|---|---|
| Energy (electricity, oil, gas, hydrogen, district heating and cooling) | Postal and courier services |
| Transport (air, rail, water, road) | Waste management |
| Banking | Chemicals (manufacture, production and distribution) |
| Financial market infrastructures | Food (production, processing and distribution) |
| Health (including manufacture of pharmaceutical products) | Manufacturing (medical devices, electronics, machinery, vehicles, other transport equipment) |
| Drinking water and wastewater | Digital providers (online marketplaces, search engines, social networks) |
| Digital infrastructure (IXPs, DNS, TLDs, cloud, data centers, communications networks and services) | Research |
| ICT service management, business-to-business (managed services, managed security services) | |
| Public administration and space |
3. Essential entities and important entities
Essential entities
As a rule, large entities in the Annex I sectors, qualified trust service providers, top-level domain registries and DNS providers. They are subject to ex ante and ex post supervision: they can be audited and inspected even without an incident.
Important entities
The remaining medium-sized entities in Annex I and the medium-sized and large entities in Annex II. Supervision is ex post only, that is, after evidence of non-compliance. The security and reporting obligations are the same.
In Portugal, the regime also includes relevant public entities (Groups A and B, depending on size), which have their own, lower penalty regime.
4. What if you are not directly covered?
Even a company outside the scope can feel NIS2 through the supply chain: covered entities must assess and control the risk of their suppliers, and they pass those requirements on in their contracts. If you provide ICT, cloud, security or development services to European customers, you are likely to be asked for security evidence, incident-reporting clauses and audits.
Requirements and measures
Governance (Article 20)
Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and be held accountable for infringements. They must also complete cybersecurity training and promote regular training for employees. In Portugal, these responsibilities cannot be delegated outside the management body, and its members can be sanctioned.
The ten minimum measures (Article 21)
The measures must be proportionate to the organization's risk, size and impact, and follow an all-hazards approach. At a minimum, the directive requires:
- Risk analysis and security policies for information systems.
- Incident handling: detection, response and recovery.
- Business continuity: backups, disaster recovery and crisis management.
- Supply chain security, including the relationship with each direct supplier and service provider.
- Security in the acquisition, development and maintenance of systems, with vulnerability handling and disclosure.
- Assessment of the effectiveness of risk-management measures.
- Basic cyber hygiene and cybersecurity training.
- Cryptography and, where appropriate, encryption.
- Human resources security, access control and asset management.
- Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications.
Practical obligations in Portugal
- Registration and self-identification on MyCiber, with the entity's details always kept up to date.
- Security officer, at management level and not outsourceable, and a permanent point of contact (who can be external), designated after the qualification notice.
- Risk analysis applied to the CNCS reference framework, repeated at least once a year or when CNCS warns of new threats.
- Minimum measures of Regulation No. 756/2026, with compliance levels, within the transitional period.
- Incident reporting through the platform, within the directive's deadlines.
- Review of contracts with critical suppliers and service providers.
Incident reporting
An incident is significant if it causes severe operational disruption or financial loss for the entity, or if it affects other people by causing considerable material or non-material damage. In that case, reporting follows three stages:
The deadlines run from the moment the entity becomes aware of the incident. If the incident is still ongoing after one month, a progress report is submitted, and the final report is due within one month of handling the incident. In Portugal, reporting is done through the CNCS platform.
Supervision and fines
The directive sets minimum ceilings for fines, which each country transposes. The European maximum amounts are:
| Type of entity | Fine ceiling (whichever is higher) |
|---|---|
| Essential entities | €10,000,000 or 2% of worldwide annual turnover |
| Important entities | €7,000,000 or 1.4% of worldwide annual turnover |
In Portugal (Decree-Law No. 125/2025)
| Severity | Essential entities | Important entities |
|---|---|---|
| Very serious (for example, failing to comply with security measures or reporting duties) | up to €10M or 2% | up to €7M or 1.4% |
| Serious (for example, failures in qualification or registration) | up to €5M or 1% | up to €3.5M or 0.7% |
| Minor | up to €45,000 for entities | |
Maximum amounts. The higher of the fixed amount and the percentage applies. Relevant public entities have their own, lower limits. Confirm the amounts in the legislation itself.
- Personal liability. Members of the management body can be sanctioned in cases of intent or gross negligence, and there are separate individual fines.
- Ancillary penalties. In addition to fines, the authorities can order corrective measures and, for essential entities, temporarily suspend management functions.
- Supervision. CNCS is the national authority; sector authorities, such as ANACOM and those in the financial sector, collaborate in enforcement.
How we do it
We help your organization move from “are we covered?” to a concrete, executable plan, in six steps.
- Scoping. We check whether the organization is an essential entity, an important entity or only part of the supply chain, and whether MyCiber registration is done.
- Gap analysis. We compare your current situation with the ten Article 21 measures and with the CNCS reference framework.
- Implementation plan. We prioritize by risk and impact, with owners, deadlines and budget.
- Policies, processes and controls. We draft and implement policies, incident management, continuity and supplier management.
- Training and simulation. Training for management and for teams, and incident-reporting exercises against the 24-hour and 72-hour deadlines.
- Ongoing verification. Technical testing, annual review of the risk analysis and tracking of legal changes.
Frequently asked questions
Is my SME covered?
It depends on the sector and size. As a rule, only medium-sized or large entities in the Annex I and II sectors, but there are exceptions by type of service. Small and micro enterprises can be covered if they provide, for example, electronic communications, trust services or domain registration. We do this scoping in the initial assessment.
I am a supplier to a covered company. Do I have to comply?
Not directly, but your customers are required to manage supply chain risk. In practice, they will ask you for security evidence, contractual clauses and, sometimes, audits. Being prepared helps you keep and win contracts.
The registration deadline has passed. What now?
In Portugal, the MyCiber registration deadline ended on September 15, 2026. Register immediately: failing to register is an infringement in itself, and registration is what triggers the remaining deadlines, such as those for the security officer and the minimum measures.
Is ISO/IEC 27001 enough to comply with NIS2?
It helps a great deal, because it covers much of risk management, but it does not replace compliance. NIS2 has its own requirements, such as incident reporting within 24 and 72 hours, management accountability, and the measures and registration defined in Portugal by CNCS.
Does NIS2 apply to companies outside the European Union?
It applies to entities established in the EU and, for certain digital services and infrastructure, also to those who offer them in the EU without an establishment there (with a designated representative). For other companies outside the EU, the effect is mainly contractual, through the requirements of European customers.
What is the difference between NIS2 and DORA?
DORA is a regulation specific to the financial sector, directly applicable since January 17, 2025. Covered financial entities apply DORA for ICT risk management and incident reporting. NIS2 covers the other critical sectors. See the DORA page.
Sources and legal notice
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- European Commission, NIS2 policy page
- European Commission, NIS2 Directive FAQs
- CNCS, Regime Jurídico da Cibersegurança (Cybersecurity Legal Framework)
- Regulamento n.º 756/2026, Diário da República (Regulation No. 756/2026, Portuguese Official Gazette)