For decision-makers short on time.
NIS2 has become a board-level risk, not just an IT department issue. Decree-Law no. 125/2025, Portugal's transposition of the NIS2 Directive, in force since 3 April 2026, requires entities in scope — including Portuguese subsidiaries of international groups — to register on the MyCiber platform of the CNCS (Portugal's National Cybersecurity Centre), inventory their assets, apply minimum security measures and report incidents within 24 hours. Fines reach €10 million and management bodies are directly liable. DataRoad - IT Services and Consulting, a premium IT partner in Portugal, delivers the technical side of that compliance through managed cybersecurity, with support in English, Spanish and French.
| Date | Obligation |
|---|---|
| 3 April 2026 | Entry into force of the Legal Framework for Cybersecurity (Decree-Law no. 125/2025 of 4 December), implemented by Regulation no. 756/2026 of 22 June. |
| ~15 September 2026 | End of the self-identification and registration period on MyCiber: 60 working days from 23 June; 30 working days for those who started operating later. Missing the deadline is an offence in itself. |
| 20 days after qualification | Notify the cybersecurity officer and the permanent point of contact. |
| 31 January 2027 | Asset inventory (or six months after notification of final qualification, whichever comes first). |
| June 2028 | Minimum measures for the assigned level applied and first annual report submitted. |
The CNCS does not qualify anyone on its own initiative: registration is the organisation's responsibility. Anyone who has not yet carried out the self-assessment should do so now.
We are not lawyers and we do not submit the registration for you: the self-assessment and submission on MyCiber are acts of the entity itself. We prepare the information and carry out, in full, the technical work that follows.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Two weeks. We survey what exists, compare it with the measures for the level that applies to you and deliver a written document with what is missing, what is urgent and what it costs. The document is yours: you can implement it with us or with whoever you prefer.
In 11 years, DataRoad has never suffered a security incident. That is the rigour we apply for our clients. Request a NIS2 diagnosis.
If it is medium-sized or large and operates in a critical sector, probably yes. Sectors in scope include energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, postal services, waste, chemicals, food, manufacturing and research, and some cases apply regardless of size. The official determination is made through the self-assessment on MyCiber, and the burden lies with the organisation.
You will feel NIS2 from the customer side. Entities in scope have to manage supplier risk, with questionnaires, contractual clauses and documentary evidence. Anyone selling to hospitals, banks, energy, public administration or industry will be assessed.
Up to €10 million or 2% of annual worldwide turnover for essential entities, whichever is higher. For important entities, up to €7 million or 1.4%. Management bodies are directly liable.
Within 24 hours for the early warning, 72 hours for the notification with an assessment and 30 days for the final report. Without monitoring and logs, the 24 hours cannot be met.
Between 39 and 91, depending on the level: basic (39), substantial (75) or high (91), according to the risk profile. The methodology is based on the National Cybersecurity Reference Framework, aligned with NIST CSF 2.0.
No. Registration and self-assessment are acts of the entity itself. We prepare the information and do the technical part: inventory, measures, monitoring, logs and incident response within the deadlines.
This page is for information only and does not constitute legal advice. An entity's qualification is determined by the self-assessment on the CNCS MyCiber platform.
Service provided under an IT Unlimited contract; we do not carry out one-off call-outs or sell standalone equipment. Request a no-commitment proposal. More than 10 workstations · support contract · remote, on-site and phone support.
Talk to us about NIS2 · +351 211 459 950* · sales@dataroad.pt
*Call to a Portuguese landline.
Mais de 138 sites e 1321 dispositivos Ubiquiti geridos desde 2015: Wi-Fi, switching, routing e CCTV numa só plataforma, com redundância nos …
Rede e Wi-Fi para dezenas de utilizadores em simultâneo, alunos, docentes e administração separados, e suporte em português e inglês no camp…
Rede nova, certificada e documentada para a produção e os escritórios da Magnelusa — instalada por fases, sem um único dia de paragem na ope…
Como a DataRoad reforçou a rede da Panike: cablagem para ambiente industrial, redes separadas para produção, logística e escritórios, e swit…
Três edifícios, três localidades e 56 pontos de acesso Wi-Fi 7: a infraestrutura de rede que a DataRoad instalou e gere para os SSAP, por co…
Como a DataRoad deu à ReStream, líder global em livestreaming, uma rede de alto desempenho em Cascais: Layer 3 PoE, Wi-Fi 6, firewall e Star…
Parque misto Apple e Dell, rede Cisco Meraki e consultoria técnica: a DataRoad gere o IT do escritório de Lisboa da Reltio by SAP em contrat…
Um hotel novo na Baixa de Lisboa abriu com a infraestrutura de rede completa: Wi-Fi 7 para hóspedes, firewall, CCTV e gestão de IT contínua …
Como a nova unidade da Clínica Lambert em Corroios arrancou com a rede, o Wi-Fi, a firewall e o suporte já geridos pela DataRoad, em contrat…
DataRoad · IT Services and Consulting
Portugal’s premium IT brand for international companies: one partner, one contract and one security standard for every office, in Portugal, Europe and the US.
We do IT right.
We work directly with the end client, under contract, with companies of 10 or more workstations.
More than 10 workstations · support contract · remote, on-site and phone support
