NIS2 and the supply chain
The Legal Framework for Cybersecurity, explained and applied.
Since April 2026, Decree-Law no. 125/2025, which transposes the NIS2 Directive, has covered most of the Portuguese public administration, including that of the Autonomous Regions. We explain what changes and help put into practice what depends on your information systems and your suppliers.
- Free session for public bodies
- Reporting within 24 hours
- Supply chain
Who is covered
Three levels, depending on sector and size.
The framework applies to the services of the direct and indirect administration of the State and of the Autonomous Regions, to the autonomous administration and to independent administrative bodies, among others. The National Cybersecurity Centre (CNCS) classifies each organisation based on its registration.
-
Essential and important entities
Classed by the sector they work in and by size, such as some healthcare providers.
- Security measures set out in the law
- A cybersecurity officer and a permanent point of contact
- Accountability of management bodies
-
Relevant public entities, Group A
Public services and bodies with 250 or more staff, and independent administrative bodies.
- Measures set by a CNCS regulation
- Reporting of significant incidents
- Fines from 16,000 to 4 million euros
-
Relevant public entities, Group B
Public services and bodies with 75 to 249 staff.
- Measures in proportion to size
- Reporting of significant incidents
- Fines from 8,000 to 350,000 euros
What changes
The obligations that take the most work.
An informative summary of Decree-Law no. 125/2025. It does not replace reading the decree or legal advice.
| Obligation | What it involves | Where it is in the law |
|---|---|---|
| Registration | Record the organisation on the CNCS platform within 60 days of it becoming available, and keep the information up to date. | Article 8 |
| Security measures | Incident handling, continuity and backups, supply chain, vulnerability management, access control, cryptography, multi-factor authentication and training. | Articles 27 and 33 |
| Supply chain | Assess the vulnerabilities and security practices of each direct supplier and service provider, including secure development. | Article 28 |
| Management and officers | In essential and important entities, management approves and oversees the measures and appoints a cybersecurity officer. | Articles 25 and 31 |
| Incident reporting | Report significant incidents to the CNCS within hours, followed by a final report. | Articles 42 to 44 |
| Fines | Very serious offences for failing to adopt the measures or to report; an exemption may be requested until April 2027. | Articles 61 and 65 |
Significant incidents
The deadlines for reporting to the CNCS.
The deadlines run from the moment the organisation becomes aware of the incident, not from when it is resolved. They also apply to relevant public entities.
-
Initial notification
Contacts, date and time, a description and an estimate of the incident's impact.
-
Update
When needed, with an initial assessment of severity and impact.
-
End of impact
The measures taken and the situation when the impact stopped being significant.
-
Final report
Cause, impact, mitigation measures and the remaining situation.
How we help
From the inventory to the report, what depends on your systems.
Much of what the framework requires depends on how information systems are designed, maintained and documented. That is where we come in.
-
System inventory
A list of the systems, the data they handle, who maintains them and what each depends on.
- Systems and components
- Suppliers and access
- Personal and critical data
-
Risk analysis
Threats, vulnerabilities and impact, to decide which measures to apply first.
- Risk matrix
- Priorities by impact
- Plan of measures
-
Technical measures
Backups, multi-factor authentication, activity logs, updates and access control.
- In the systems we maintain
- Or with your team
- Documented for audit
-
Supplier clauses
Security requirements for tender specifications and for software and maintenance contracts.
- Deadlines for fixes
- Incident reporting
- Right to audit
-
Response and reporting
An incident response procedure and help preparing the notifications to the CNCS.
- Decision path
- Notification templates
- 24/7 availability under contract
-
Code audits
To assess your own software or a supplier's, as supply chain risk management requires.
- Confirmed findings
- Proposed fixes
- Retest included
-
Penetration testing
To confirm what an attacker could exploit in your applications and infrastructure.
- Written authorisation
- Agreed windows
- Retest included
-
Training
Regular training for managers, technical staff and users, also required by the framework.
- Managers and technical staff
- Cyber hygiene
- Phishing and good practice
Supply chain
The questions to ask every software supplier.
Many incidents start at a supplier: an application without updates, poorly protected remote access, a library with a known flaw. The framework requires these practices to be assessed, and the answers belong in the contracts.
- Fixes: how are security fixes applied, and how quickly?
- Components: which third-party libraries and components does the system use?
- Access: who accesses the systems, from where and with what authentication?
- Logs: which activity logs are kept, and for how long?
- Recovery: are there tested backups and a recovery plan?
- Incidents: how, and how quickly, will we be told of an incident or a vulnerability?
- Hosting: where is the data and who can process it?
24 and 72 hours
The reporting deadlines require the supplier's information to arrive quickly.
In the contract
Deadlines and duties written down, not just promised.
Verifiable
Audits and tests confirm what the supplier declares.
Proportionate
More demanding for the most critical systems.
For those who hire us
The same questions, answered for the systems we maintain.
We are also a software supplier to public bodies. So we give those who hire us the answers the framework asks for.
- Security updates always included in the maintenance of the systems we develop.
- Written answers to the supply chain questions, for the organisation's own records.
- Deadlines for fixes and incident reporting agreed in the contract.
- History and audit included in every system we develop, to reconstruct what happened.
Maintenance
Security fixes included.
Documentation
Answers ready for the NIS2 file.
Logs
Activity recorded to reconstruct incidents.
Deadlines
Fixes and notices with deadlines in the contract.
Free NIS2 session
A first session to understand what changes.
For senior staff and technicians of public bodies. It is generic and does not include an analysis of the body's systems, like our AI literacy session.
- The new framework in plain language: who is covered, which obligations apply and which deadlines count.
- Incidents: what a significant incident is and how to prepare the notifications.
- Supply chain: what to ask suppliers and what to put in contracts.
- Where to start: the first steps, from registration to the inventory.
- No commitment: the session does not oblige you to hire any service.
Frequently asked questions
About NIS2 and the Legal Framework for Cybersecurity.
Is my organisation covered?
Very probably, if it is a public administration service or body with 75 or more staff, or if it works in a sector considered essential or important. The final classification is made by the CNCS, based on the organisation's registration on the platform it provides for that purpose.
How long is there to comply without fines?
The law allows a reasoned request for exemption from fines during the first 12 months, that is, until April 2027, when there is not yet an internal adaptation procedure. It is time to prepare, not to postpone.
Are software suppliers also bound by it?
It depends on whether each supplier is classified. But the organisation must always assess the security of its direct suppliers and service providers, so it should require answers and commitments from them in the contract.
Does the free session come with any commitment?
No. It is a generic session for senior staff and technicians that does not include an analysis of the body's systems and does not oblige you to hire any service.
Does this page replace legal advice?
No. It is for information only and summarises Decree-Law no. 125/2025 as published. Each organisation's specific obligations should be confirmed in the decree, in the CNCS regulations and, where needed, with legal advice.
Want to get your organisation ready for the new framework?
Start with a free NIS2 session or talk to us about the inventory, the measures and your suppliers.