Skip to content
Emergency helpGet started
Compliance & Governance

NIS2 in Portugal: What Decree-Law 125/2025 Requires

Portugal transposed NIS2 with Decree-Law 125/2025, in force since 3 April 2026. Who is covered, CNCS registration, incident deadlines and fines.
By VigilbasePublished
Read the guideMore Topics

Portugal transposed the NIS2 Directive, Directive (EU) 2022/2555, through Decree-Law No. 125/2025 of 4 December, which approves the new Legal Framework for Cybersecurity (Regime Jurídico da Cibersegurança). It entered into force on 3 April 2026 and replaced Law No. 46/2018 and Decree-Law No. 65/2021. According to the National Cybersecurity Centre (CNCS), the national cybersecurity authority, it covers 17 sectors and the Public Administration. This guide explains what the decree-law and the CNCS say, and the NIS2 obligations that apply across the EU.

What is NIS2?

NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. Member States had to adopt and publish their national rules by 17 October 2024 and apply them from 18 October 2024, when the first NIS Directive was repealed. NIS2 applies to medium-sized and larger entities in the sectors listed in its annexes, and to some entities regardless of size.
1.Sectors of high criticality (Annex I): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.
2.Other critical sectors (Annex II): postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
3.Regardless of size: for example, qualified trust service providers, top-level domain name registries and DNS service providers are essential entities.
4.Essential entities are mostly large Annex I entities; other entities in scope are important entities. Both must take cybersecurity risk-management measures (Article 21) and report significant incidents (Article 23).
5.Management bodies approve and oversee the risk-management measures, can be held liable for infringements and must follow training (Article 20).

How Portugal transposed NIS2

Decree-Law No. 125/2025 was published in the Diário da República on 4 December 2025. It approves the Legal Framework for Cybersecurity in its annex and entered into force 120 days after publication, on 3 April 2026. It revoked the Legal Framework for Cyberspace Security, Law No. 46/2018 of 13 August, and its regulation, Decree-Law No. 65/2021 of 30 July. Besides essential and important entities, the Portuguese regime covers relevant public entities, and it excludes public entities working in national security, public security, defence and intelligence, including those with criminal investigation responsibilities.

Who supervises: the CNCS and sector authorities

Article 15 of the regime sets out the institutional framework for cyberspace security.
1.The CNCS is the national cybersecurity authority, the single point of contact for EU and international cooperation, the national cybersecurity certification authority and part of the national incident response team, CERT.PT.
2.ANACOM is the sectoral authority for electronic communications and postal services, and the National Security Office (GNS) for trust services.
3.Banco de Portugal, the Securities Market Commission (CMVM) and the Insurance and Pension Funds Supervisory Authority (ASF) are special cybersecurity authorities for the digital operational resilience of the financial sector, the area covered by DORA.
4.The Secretary-General of the Internal Security System is the national authority for managing large-scale cybersecurity crises and incidents.

Registering with the CNCS

Covered entities identify themselves on the CNCS electronic platform within 30 days of starting activity or, if they were already operating when the regime entered into force, within 60 days of the platform becoming available, and keep that information up to date (Article 8). The registration includes the entity's name, tax number, address and contact details, including email addresses, IP ranges and telephone numbers, its sector and subsector, and the Member States where it provides services (Article 35). CNCS Regulation No. 756/2026, published on 22 June 2026, sets the rules for the platform, the qualification procedure, incident notifications and the National Cybersecurity Reference Framework (QNRCS).

What essential and important entities must do

The regime turns the NIS2 obligations into named duties for essential and important entities.
1.Management bodies approve the cybersecurity risk-management measures, oversee how they are applied and ensure regular cybersecurity training. Their members can answer for acts or omissions committed with intent or gross negligence (Article 25).
2.Designate a cybersecurity officer who sits on the management body or reports directly to it, and communicate the appointment to the competent authority within 20 working days (Article 31).
3.Keep a permanent point of contact, available around the clock during activation periods that the competent authority starts and ends (Article 32).
4.Adopt cybersecurity measures covering incident handling, business continuity and crisis management, supply chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control and asset management, and multi-factor authentication (Article 27).
5.Analyse and manage residual risk, and keep an annual report with quarterly incident statistics. Essential entities send it to the competent authority, normally by the last working day of January of the following year; important entities send it when the CNCS asks (Articles 29 and 30).
6.Timing: under Article 10(2) of the decree-law, the cybersecurity measures, supply chain, residual-risk and annual-report duties take effect 24 months after publication of the implementing regulation. The CNCS published Regulation No. 756/2026 on 22 June 2026.

Incident notification deadlines in Portugal

Essential, important and relevant public entities notify every significant incident to the competent cybersecurity authority through the CNCS electronic platform (Article 40). To decide whether an incident is significant, they consider the users affected, the total users of the service, the duration, the severity of the disruption and the impact on economic and social activities.
1.Initial notification: without undue delay and within 24 hours of concluding that there is, or may be, a significant incident (Article 42).
2.Update: where necessary, within 72 hours, with an initial assessment of severity and impact and, if available, indicators of compromise.
3.End of significant impact: within 24 hours of the impact ending (Article 43). If the incident is resolved within two hours of detection, this is the only notification required.
4.Final report: within 30 working days of the end-of-impact notification. If the incident is still ongoing when the final report is due, the authority can ask for weekly intermediate reports (Article 44).
5.The directive itself sets an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Article 23 of NIS2).

NIS2 fines in Portugal

Very serious infringements include failing to adopt the cybersecurity measures, to designate a cybersecurity officer, to keep a permanent point of contact or to notify incidents. For legal persons, they carry fines of €2,000 to €10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and €1,250 to €7 million or 1.4% of worldwide annual turnover for important entities (Article 61). The directive requires maximum fines of at least those amounts (Article 34 of NIS2), and the CNCS describes the Portuguese sanctions regime as significantly tougher than the previous one.

Where logging, investigations and incident records help

The QNRCS in Regulation No. 756/2026 includes a measure for system logs: they should be collected, stored, protected and reviewed regularly, with the retention period set by risk analysis, and the expected evidence is technical proof of that collection, storage and review. Vigilbase OS helps you produce evidence for this and for incident notifications.
1.Logs: Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Default retention is set per dataset, typically 30 to 90 days, so check it against the retention your risk analysis sets.
2.Incident records: each investigation records the evidence, the actions taken and the verification. Your team can use that record for the initial, end-of-impact and final reports.
3.Authority: you choose whether actions stay off, are proposed for approval, or run when they are low-risk and reversible.
4.Edge protection: Managed Cloudflare runs WAF and DDoS protection for your websites and APIs within an agreed scope, with change control.

Responsibility and legal note

Vigilbase does not make an entity compliant with the Legal Framework for Cybersecurity, does not register you with the CNCS and does not replace your cybersecurity officer. This guide summarizes Decree-Law No. 125/2025, CNCS Regulation No. 756/2026 and CNCS information as available in October 2026. It is not legal advice: the texts published in the Diário da República prevail, and your legal advisers decide how the regime applies to you.

Key Takeaways

✓Portugal transposed NIS2 with Decree-Law No. 125/2025, in force since 3 April 2026.
✓The CNCS is the national cybersecurity authority; Banco de Portugal, the CMVM and the ASF cover the financial sector's digital operational resilience.
✓Covered entities register on the CNCS platform and appoint a cybersecurity officer and a permanent point of contact.
✓Significant incidents need an initial notification within 24 hours, an end-of-impact notification within 24 hours of the impact ending and a final report within 30 working days.
✓The cybersecurity measures, residual-risk and annual-report duties take effect 24 months after the CNCS regulation of 22 June 2026.
✓Fines for essential entities reach €10 million or 2% of worldwide annual turnover, whichever is higher.

Sources

Related Solutions

Vigilbase services related to this guide

Vigilbase in Portugal

Learn more

Vigilbase in Europe

Learn more

Managed SOC

Learn more

Managed Cloudflare packages

Learn more

Vigilbase SLA

Learn more

Frequently Asked Questions

Has Portugal transposed NIS2?

Yes. Decree-Law No. 125/2025 of 4 December transposed the NIS2 Directive and approved the Legal Framework for Cybersecurity, which entered into force on 3 April 2026. The CNCS is the national cybersecurity authority.The regime replaced Law No. 46/2018 and Decree-Law No. 65/2021. The CNCS published the implementing regulation, Regulation No. 756/2026, on 22 June 2026.Regional service and onboarding guidanceDiscuss your scope with Vigilbase

Who must comply with NIS2 in Portugal?

Essential, important and relevant public entities. According to the CNCS, the regime covers 17 sectors and the Public Administration. Most entities qualify by type and size, as medium-sized or larger, while some, such as DNS service providers and qualified trust service providers, are covered regardless of size.Entities identify themselves on the CNCS electronic platform, and the CNCS then qualifies them. Your legal advisers should confirm your classification.Regional service and onboarding guidancePrivacy and data handling

How do we register with the CNCS?

Identify your entity on the CNCS electronic platform within 30 days of starting activity or, if you were already operating when the regime entered into force, within 60 days of the platform becoming available. Keep the information up to date and notify changes within 30 working days.The registration includes your name, tax number, contact details, IP ranges, sector and the Member States where you provide services. CNCS Regulation No. 756/2026 sets the platform rules.Discuss your scope with VigilbasePrivacy and data handling

What are the NIS2 incident reporting deadlines in Portugal?

Send an initial notification within 24 hours of concluding that there is a significant incident, an update within 72 hours where necessary, a notification within 24 hours of the significant impact ending, and a final report within 30 working days of that notification.If the incident is resolved within two hours of detection, only the end-of-impact notification is required. Notifications go through the CNCS electronic platform.Security operations responsibilitiesWhat a SIEM does

What are the NIS2 fines in Portugal?

For very serious infringements by legal persons, essential entities face fines of €2,000 to €10 million or 2% of worldwide annual turnover, whichever is higher, and important entities €1,250 to €7 million or 1.4% of worldwide annual turnover.Members of management bodies can also answer for acts or omissions committed with intent or gross negligence.Privacy and data handlingSecurity documentation in the Trust Center

How does NIS2 relate to DORA for banks in Portugal?

For financial entities, DORA is the sector-specific EU act, and NIS2 provisions do not apply where DORA's requirements are at least equivalent. Decree-Law No. 125/2025 names Banco de Portugal, the CMVM and the ASF as special cybersecurity authorities for the financial sector's digital operational resilience.Choose a package for financial servicesCoverage and incident response commitments

Related Topics

Security Basics

What is SIEM?

Security Basics

What is SOC?

Compliance & Governance

PCI DSS 6.4.3 and 11.6.1

Compliance & Governance

DORA compliance

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning