Portugal · Compliance
NIS2 compliance in Portugal
Achieve NIS2 compliance in Portugal with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for NIS2 in Portugal
Clients include
NIS2 compliance in Portugal at a glance
Decreto-Lei n.º 125/2025, de 4 de dezembro (Regime Jurídico da Cibersegurança) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Portugal ask for evidence that you meet it.
Portugal's NIS2 transposition is no longer pending. Decreto-Lei n.º 125/2025 approved the Regime Jurídico da Cibersegurança, and the Centro Nacional de Cibersegurança followed with Regulamento n.º 756/2026, which fixes how the electronic platform, minimum measures, annual report, cybersecurity officer and incident notices work. ANACOM and the GNS act as sector authorities, while Banco de Portugal, the CMVM and the insurance supervisor cover digital operational resilience in finance. Compliance is a legal question answered by those authorities, though a certificate from a body accredited by IPAC, such as ISO/IEC 27001 with a fully covering scope, can support a presumption of compliance. Sterling's Enschede office runs the scoping, gap assessment, control build and evidence pack, and Effivity and Sterling Academy come with the engagement. Sterling does not certify.
Who needs NIS2 in Portugal, and what happens without it
These are the organisations in Portugal that most often need to show NIS2.
- Essential entities in the sectors the regime listsDecreto-Lei n.º 125/2025 applies the cybersecurity regime to essential entities and gives the CNCS supervisory and certification powers over them.
- Important entities that are not essentialThe regime covers important entities too, with the same registration and measures framework applied proportionately.
- Relevant public entitiesThe law and the CNCS regulation set separate minimum measures for relevant public entities, which may also present certificates to the competent authority.
- Electronic communications and postal operatorsANACOM is named the sector cybersecurity authority for electronic communications and postal services, and the GNS for trust services.
- Financial entities and their ICT suppliersBanco de Portugal, the CMVM and the insurance supervisor are the special authorities for digital operational resilience in finance, so suppliers meet both the cyber regime and DORA expectations.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkNIS2 requirements in Portugal
Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.
In Portugal these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →
How to achieve NIS2 compliance in Portugal
One team from the Enschede office carries the work from scoping to sign-off. Clients in Portugal are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against NIS2 and the Portuguese requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does NIS2 compliance take in Portugal?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Portugal these are the factors that set the timeline.
- Whether the entity is essential, important or a relevant public entity
- Registration on the electronic platform and the designation of a cybersecurity officer and permanent contact point
- Maturity of existing controls against the minimum measures and compliance levels
- Supplier and incident-reporting arrangements already in place
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does NIS2 compliance cost in Portugal?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Portugal these factors move both.
- Number of networks, systems and sites in scope
- Remediation needed to reach the required compliance level
- Optional certification fees if a certificate is used as evidence
- Effort to build incident notification and annual reporting routines
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
NIS2 consultants and assessors in Portugal
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Portugal are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive NIS2 in Portugal (4)
| Instrument | How it treats the standard |
|---|---|
| Decreto-Lei n.º 125/2025, de 4 de dezembro (Regime Jurídico da Cibersegurança) | The instrument itself It transposes Directive (EU) 2022/2555, makes the CNCS the national cybersecurity authority and lets it require essential, important and relevant public entities to obtain certification showing their measures, with an equivalence matrix to existing schemes. |
| CNCS Regulamento n.º 756/2026 (voluntary certification and the national reference framework) | Regulator instrument Essential and important entities may benefit from a presumption of compliance when they give the competent authority a certificate from a duly accredited certification body, and the text lists ISO/IEC 27001 where the scope fully covers the networks and systems behind the regulated services. |
| CNCS Regulamento n.º 756/2026 on the electronic platform, notifications and minimum measures | Regulator instrument It sets the rules for the electronic platform, minimum cybersecurity measures and compliance levels, the annual report, the designated cybersecurity officer, the permanent contact point and mandatory and voluntary incident notifications. |
| Regulation (EU) 2022/2554 (DORA), with Banco de Portugal, the CMVM and the insurance supervisor as national authorities | The regulation itself It applies from 17 January 2025, and Decreto-Lei n.º 125/2025 names Banco de Portugal, the Comissão do Mercado de Valores Mobiliários and the Autoridade de Supervisão de Seguros e Fundos de Pensões as special authorities for the digital operational resilience of the financial sector. |
Accreditation, audit language and remote audits in Portugal
Compliance, not certification: NIS2 is a legal regime supervised by the CNCS and the sector authorities, and no certificate proves that an entity complies. The regulation does let a certificate from a duly accredited certification body (for example ISO/IEC 27001 with a fully covering scope, or the national scheme EC QNRCS) support a presumption of compliance. Sterling prepares the evidence; the authority decides. Edition and transition details: NIS2 hub →
Audit language
Portuguese is the official language and English is widely used in international business. Agree the audit language and the language of controlled documents with the certification body at application, and follow any language requirement in a contract or a regulator's procedure.
Remote and on-site
Gap assessment, risk work and documentation can be remote; the competent authority sets how it supervises, and supervisory contact runs through the electronic platform.
NIS2 in Portugal: questions clients ask
Which authorities supervise NIS2 compliance in Portugal?
The CNCS is the national cybersecurity authority, with ANACOM for electronic communications and postal services and the GNS for trust services. For finance, Banco de Portugal, the CMVM and the insurance supervisor act as special authorities on digital operational resilience. Which of them deals with you depends on your sector, so confirm with the CNCS.
When did the Portuguese cybersecurity regime take effect?
Decreto-Lei n.º 125/2025 was published on 4 December 2025 and it has since entered into force under its own entry-into-force article. Its article on effects holds back the provisions on security measures, supply chain, residual risk and the annual report until a set period after the implementing regulation, which the CNCS published on 22 June 2026. Your counsel or the CNCS can map the dates.
What does the CNCS regulation of 2026 add for covered entities?
It turns principles into procedure: how the electronic platform works, which minimum measures and compliance levels apply, how the annual report is sent, who the cybersecurity officer and permanent contact point are, and how incidents are notified. It reads as an operating manual for entities, so read it with the decree-law itself.
Can a certificate show compliance with the Portuguese regime?
It can give a presumption of compliance. The regulation allows essential and important entities to present a certificate from a duly accredited certification body, naming ISO/IEC 27001 with a fully covering scope and the EC QNRCS scheme, while relevant public entities may also use the DNP TS 4577-1 Selo Digital specification. The authority decides the effect.
More on NIS2 for Portuguese organisations
Other standards Portuguese businesses ask Sterling for
Organisations in Portugal often combine NIS2 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Decreto-Lei n.º 125/2025, de 4 de dezembro (Regime Jurídico da Cibersegurança) — data.dre.pt; eur-lex.europa.eu (accessed 11 Oct 2026)
- CNCS Regulamento n.º 756/2026 (voluntary certification and the national reference framework) — files.diariodarepublica.pt; diariodarepublica.pt (accessed 11 Oct 2026)
- CNCS Regulamento n.º 756/2026 on the electronic platform, notifications and minimum measures — files.diariodarepublica.pt; diariodarepublica.pt (accessed 11 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), with Banco de Portugal, the CMVM and the insurance supervisor as national authorities — eur-lex.europa.eu; data.dre.pt (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice