Cybersecurity
NIS2: what changes for public bodies and their software suppliers
Portugal's new Legal Framework for Cybersecurity, in force since April 2026, covers most of the public administration. We explain who is covered, the deadlines for reporting incidents, the fines and why software suppliers are now part of every organisation's obligations.
Since April 2026, cybersecurity in the Portuguese public administration is no longer just good practice: it is a legal obligation with deadlines, named people in charge and fines. Decree-Law no. 125/2025 of 4 December, which transposes the European NIS2 Directive, approved the new Legal Framework for Cybersecurity and extended it to most public services, including those of the Autonomous Regions.
In this article we explain, without jargon, who is covered, what changes in the day-to-day running of public bodies and why choosing and managing software suppliers is now part of every organisation's obligations.
What NIS2 is
NIS2 (Directive (EU) 2022/2555) is the second European directive on the security of network and information systems. It replaced the first one, from 2016, which covered few sectors and was applied very unevenly across countries. The new directive widens the sectors and organisations covered, makes the rules more concrete and gives the authorities powers to supervise and to sanction.
In Portugal, the directive was transposed by Decree-Law no. 125/2025, published on 4 December 2025 and in force since April 2026, 120 days later. The National Cybersecurity Centre (CNCS) is the national authority and receives incident notifications.
Who is covered in the public administration
The new framework applies expressly to the public administration: to the services of the direct administration of the State and of the Autonomous Regions, both central and local, to the bodies of the indirect administration of the State and of the Autonomous Regions, to the autonomous administration and to independent administrative bodies, among others.
Public bodies that are not classed as essential or important entities become relevant public entities, split into two groups by size:
Group A: services and bodies with 250 or more staff, independent administrative bodies and larger public corporate entities.
Group B: services and bodies with 75 to 249 staff and medium-sized public corporate entities.
Some bodies, because of the service they provide, such as healthcare providers, may also be classed as essential or important entities, with more demanding obligations. The CNCS carries out the classification, based on the information each organisation records on an online platform provided for that purpose.
What changes day to day
Security measures in proportion to risk
Essential and important entities must adopt measures in areas set out in the law: incident handling, business continuity and backups, supply chain security, security in the acquisition, development and maintenance of systems, vulnerability management, training, access control, cryptography and multi-factor authentication. Relevant public entities follow the measures set by a CNCS regulation, in proportion to the group they belong to.
Management becomes accountable
In essential and important entities, the management, governing and administrative bodies approve the measures, oversee how they are applied and ensure regular training. This responsibility can only be delegated to one of their own members, and managers may be personally liable for breaches committed wilfully or through gross negligence. These entities also appoint a cybersecurity officer, who reports directly to management, and a permanent point of contact for communications with the authority.
Cybersecurity is no longer something the IT department sorts out on its own. It becomes a responsibility of those who run the organisation.
Reporting incidents in hours, not weeks
When an organisation concludes that a significant incident exists, or may arise, it has short deadlines to report it to the competent authority. The rules apply to essential and important entities and to relevant public entities as well.
Meeting these deadlines takes more than goodwill on the day of the incident. Before anything goes wrong, you need to know who decides, who reports, which logs the systems keep and how to reach each supplier outside office hours.
Fines for public bodies too
Failing to apply the security measures or to report incidents is a very serious administrative offence. For relevant public entities, fines range from 16,000 to 4 million euros in Group A and from 8,000 to 350,000 euros in Group B. The law allows organisations to ask, with a reasoned request, to be exempted from these fines during the first 12 months, that is, until April 2027, when they do not yet have an internal adaptation procedure. It is time to prepare, not to postpone.
Software suppliers come into play
One of the biggest changes in NIS2 is its attention to the supply chain. Many recent incidents did not start in the organisation itself, but at a supplier: an application without updates, a poorly protected remote access, a code library with a known flaw.
That is why the law requires security measures to consider the vulnerabilities of each direct supplier and service provider, the cybersecurity quality of their products and their security practices, including their secure development procedures. In practice, every public body now has to ask questions that used to go unasked:
| Question for the supplier | Why it matters |
|---|---|
| How are security fixes applied, and how quickly? | Critical flaws are exploited within hours, as the PHP2Shell case showed. |
| Which third-party components and libraries does the system use? | Without an inventory there is no way to know whether a new flaw affects the service. |
| Who accesses the systems, from where and with what authentication? | Supplier remote access is a frequent way in for attackers. |
| Which activity logs are kept, and for how long? | They are essential to understand an incident and to fill in the notifications. |
| Are there tested backups and a recovery plan? | Keeping a public service running depends on being able to restore its systems. |
| How will you tell us if you detect an incident or a vulnerability? | The 24 and 72-hour deadlines require information to arrive quickly. |
| Where is the data hosted and who can process it? | Location and sub-processors affect the GDPR and risk management. |
These questions belong in tender specifications and contracts, not just in a first meeting. A contract that sets deadlines for fixes, duties to report incidents and a right to audit gives the organisation the means to meet its own obligations.
Where to start
Confirm your classification. Check that your organisation has registered on the CNCS platform and which group or category it has been placed in.
Take stock. List the systems, the data they handle, who maintains them and what they depend on. Without an inventory, there is no risk management.
Name who is responsible. Assign responsibility for cybersecurity at management level and set out the decision path for an incident.
Review your contracts. Include deadlines for fixes, incident reporting, activity logs and backups in supplier contracts.
Test your response. Simulate an incident and time it: how long would it take to gather the information needed for the initial notification?
Train your people. From management to front-line services, regular training is an obligation and one of the most effective measures against phishing.
An information systems matter
NIS2 is about security, but almost everything it requires depends on how information systems are designed, maintained and documented: logs that make it possible to reconstruct what happened, controlled access, up-to-date components, backups that can actually be restored. A well-maintained system makes compliance much simpler. A forgotten system makes it almost impossible.
At Datapoint, we develop, integrate and maintain information systems for public bodies, and our maintenance includes security updates, activity logs and support in responding to incidents. If you are preparing your organisation for the new framework and want to review what depends on your systems, talk to us.
This article is for information only and does not constitute legal advice. It reflects Decree-Law no. 125/2025 as published.
