NIS2 in Portugal: turn the legal framework into an action plan
Decree-Law No. 125/2025 of 4 December transposed the NIS2 Directive into Portuguese law and approved the national cybersecurity legal framework. Assessment should consider the entity’s status, transitional provisions and applicable implementing rules, rather than assuming that every obligation shares a single date. Diário da República — Decreto-Lei n.º 125/2025.
For management, the first step is to document an applicability assessment. The organisation’s activities, size and specific characteristics should be evaluated against the framework, with responsibility assigned for keeping that assessment up to date.
As operational preparation, I recommend mapping critical services, the systems they depend on and the suppliers involved. This map can help the organisation prioritise risks, define actions and establish indicators to monitor implementation.
An incident response exercise is particularly useful: who identifies the problem, who decides, who communicates and what records remain available? Testing these questions as a team can reveal coordination gaps that a written policy may not expose.
A structured approach to information security can support this work. Nevertheless, the organisation should check each applicable legal obligation and its supporting evidence, without assuming that certification replaces that assessment.
Practical next step: Discuss your organisation’s preparation and audit needs. Get in touch.