NIS2 for SMEs: the managed cybersecurity guide to complying with Decree-Law 125/2025

• Legislation Decree-Law no. 125/2025 of 4 December, which establishes the Legal Framework for Cybersecurity; it came into force 120 days after publication.
• Regulation CNCS Regulation no. 756/2026 of 22 June, which opened the MyCiber platform on 23 June 2026.
• Scope Around six thousand entities, according to the CNCS as quoted by Lusa, compared with around 450 under the previous regime.
• Incidents Initial notification within 24 hours, update within 72 hours, final report within 30 working days.
• Fines Up to €10 million or 2% of worldwide turnover (essential entities); up to €7 million or 1.4% (important entities).
• Technical measures To be implemented by mid-2028.

NIS2 is a European directive transposed into each Member State’s law. The Portuguese law divides the entities covered into essential entities, from the most critical sectors and of larger size, and important entities, which are the rest.

Both must apply security measures and notify incidents. What varies is the level of requirements, the intensity of supervision and the ceiling on fines. The minimum measures are split into three levels assigned according to risk: basic with 39 measures, substantial with 75 and high with 91.

A “yes” to the first three questions is enough to make it likely that you are within scope. Always formalise the conclusion with legal support.

1. Sector — is it listed in the law’s annexes? Energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, postal services, waste, chemicals, food, manufacturing and research, among others.
2. Size — do you have 50 or more employees, or annual turnover and balance sheet both above €10 million? Under the European definition, you are no longer a small company.
3. Service covered regardless of size — do you provide electronic communications, trust services, DNS, or are you the sole provider of an essential service?
4. Group — are you part of a group? You may have to add up employees and figures, and a “small” company then counts as medium-sized.
5. Supply chain — do you supply an entity that is covered? Even if you are outside the scope, you will receive questionnaires, clauses and requests for evidence, because your clients have to manage supplier risk.
6. MyCiber — have you completed the self-assessment? Identifying itself is the company’s responsibility, not the CNCS’s. If you are covered and have not yet done so, deal with it immediately with your legal adviser.

Articles 42 to 44 set out the sequence for an incident with significant impact:

1. 24 hours after it is detected — initial notification.
2. 72 hours, if necessary — update with an initial assessment of severity and impact.
3. 24 hours after the significant impact ends — end-of-impact notification.
4. 30 working days later — final report.

Nobody can notify within 24 hours an incident they have not yet seen. Meeting this deadline requires active monitoring, retained logs and a written procedure stating who decides and who communicates. An attack that starts on Friday night and is only discovered on Monday morning is already out of time.

That is why, for companies within scope, we recommend the IT Unlimited Premium 365 plan: it is the only one covering nights, weekends and public holidays, including 24/7 monitoring.

The size of the fines draws attention, but the fundamental change lies elsewhere. Management bodies approve and oversee cybersecurity measures, promote regular training and cannot freely delegate that responsibility. Training covers both directors and employees. Cybersecurity has become a board-level matter.

Whatever level is assigned, some measures always appear. They are, in fact, good practices that any company with more than 10 workstations should have, whether covered or not:

1. Asset inventory — servers, computers, network, cloud and access. Starting point: the checklist for auditing your IT estate.
2. MFA — on email, cloud and remote access; see the guide to multi-factor authentication in business.
3. Off-site, tested backups — with defined recovery times; more in data backup and recovery.
4. Managed firewall and segmented network — a controlled perimeter and a VLAN per function.
5. Endpoint protection and updates — EDR and patch management with records.
6. Documented policies and training — with attendance records; use the 7 internal cybersecurity policies as a basis.
7. Incident response plan — named owners and periodic simulations.

Under NIS2 it is not enough to be protected: you must be able to prove it, so every measure is documented. Our service is described in technical implementation of NIS2.

Ventask has been a DataRoad client since 2016 and has more than 350 workstations under IT Unlimited. We manage all its networking, corporate firewalls, endpoint protection, secure remote working and wireless network, with proactive monitoring and alerting on the Premium 365 plan.

Perimeter, endpoints, remote access and continuous monitoring — the layers NIS2 requires — in a single contract. Read the Ventask case study in detail.

We compare your infrastructure with the NIS2 technical measures and deliver a written report setting out each gap, its urgency and the cost of closing it. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.

See also our managed cybersecurity for business offering.

• Decree-Law no. 125/2025 of 4 December — Diário da República; full text also on EUR-Lex.
• Regulation no. 756/2026 of 22 June (CNCS) — Diário da República.
• MyCiber platform (CNCS) — myciber.gov.pt.
• European Commission, SME definition — ec.europa.eu.
• ECO/Lusa, 24 June 2026 — Entities have 60 working days to register on MyCiber.