PortugalRegime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance
Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- Articles 25 and 26 apply from ; Article 27(1) and (2), Articles 28 to 30 and 33 and the Article 61(1)(b), (c) and (f) fines take effect 24 months after publication of the regulations that Articles 8, 14, 26, 31, 32 and 83 of the Regime call for (Article 10(2) of the Decree-Law), which Regulamento n.º 756/2026, published on , sets out in one document. This binds an essential or important entity of a type listed in Annex I or Annex II that exceeds the EU medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or that Annex I or II names as essential regardless of size; Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider expressly, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry, so a service in any of those eight lines is reached; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.
- Take appropriate technical, operational and organisational measures to manage the risks to the network and information systems you use in your operations, and to prevent or minimise the impact of an incident on the recipients of your services and on other services, at a level proportionate to your risk exposure, your size and the likelihood and severity of an incident.NIST CSF 2.0ID.RA-06
- Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.NIST CSF 2.0GV.PO-01
- Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Centro Nacional de Cibersegurança (CNCS) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 61 makes non-compliance with the Article 27 to 29 cybersecurity measures a contraordenação muito grave (very serious administrative offence) punished by an administrative fine; the Decreto-Lei creates no criminal offence for the infringement, and a management-body member found to have acted with intent or gross negligence under Article 25(2) may separately face civil liability under generally applicable law.
Penalty structure
Article 61(2)(a) sets the fine for an essential entity's infringement of, among other provisions, Articles 27 to 29, at EUR 2,000 to EUR 10,000,000 or 2 percent of the entity's total worldwide annual turnover in the preceding financial year, whichever is higher, for a legal person (EUR 350 to EUR 200,000 for a natural person). Article 61(2)(b), the mirror provision for an important entity, sets the equivalent range at EUR 1,250 to EUR 7,000,000 or a maximum of not less than 1.4 percent of that turnover, whichever is higher, for a legal person. Both mirror NIS2 Article 34(4) and (5). The Article 61(1)(b) fine for Articles 27 to 29 takes effect only 24 months after publication of the regulations referred to in Articles 8, 14, 26, 31, 32 and 83 (Article 10(2) of the Decree-Law).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança (CNCS), Portugal's national cybersecurity authority and single point of contact for EU and international cooperation, or the sectoral national cybersecurity authority the Decree-Law designates for your sector under Article 15, such as the Gabinete Nacional de Segurança (GNS) for trust services or the Autoridade Nacional de Comunicações (ANACOM) for electronic communications and postal services.
Settledness
- As of
- Guidance link
- https://www.cncs.gov.pt/pt/regime-juridico/
- Guidance body
- Centro Nacional de Cibersegurança (CNCS)
- Open questions
- Article 10(2) of the Decree-Law defers Article 27(1) and (2), Articles 28 to 30, Article 33 and the Article 61(1)(b), (c) and (f) fines until 24 months after publication of the regulations the Regime calls for. Does that period run from the publication of Regulamento n.º 756/2026, which sets out those regulations in one document, or from the publication of any later technical instruction the Regulation leaves to the competent authority?
What this law does
Article 26 requires an essential or important entity to take appropriate technical, operational and organisational measures to manage the risks to the network and information systems it uses in its operations, and to prevent or minimise an incident's impact on the recipients of its services and on other services, at a security level proportionate to the entity's risk exposure, size and the likelihood and severity of an incident, following a risk matrix the Centro Nacional de Cibersegurança (CNCS) defines and may update.
Article 27 lists the areas those measures must cover: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of the entity's risk-management measures; basic cyber-hygiene practices and staff training, including for members of top management bodies; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.
Article 25 requires the entity's management, direction and administration body to approve the Article 27 measures, supervise their application, ensure compliance with the supervision and enforcement measures of Chapter VI, and ensure regular cybersecurity training; a member of that body may be held liable, by act or omission, on a finding of intent (dolo) or gross negligence (culpa grave), for an infringement under this Decree-Law, and that responsibility may not be delegated except to another member of the same body.
Article 10(2) of the Decree-Law defers the effect of Article 27(1) and (2), Articles 28 to 30, Article 33 and the Article 61(1)(b), (c) and (f) fines until 24 months after publication of the regulations referred to in Articles 8, 14, 26, 31, 32 and 83 of the Regime. The Centro Nacional de Cibersegurança published Regulamento n.º 756/2026 in the Diário da República, 2.ª série, n.º 118, on .
The Regulation enters into force the day after publication, without prejudice to Article 10(2) of the Decree-Law. The Regulation sets out in one document the matters the Regime leaves to regulation, including those under Articles 8(7), 14(2) and (5), 26(5), 29(1), 30, 31(3), 32(3), 33(2), 40 to 45, 72(2) and 83(2).
This Decree-Law, Decreto-Lei n.º 125/2025, transposes NIS2 Directive Articles 20 and 21 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .