meta_id 2955261

On 10 March 2026, Portugal's National Cybersecurity Centre (Centro Nacional de Cibersegurança - CNCS), operating under the Office of the Prime Minister's National Security Cabinet, published a draft regulation implementing the Legal Framework for Cybersecurity (Regime Jurídico da Cibersegurança). The regulation transposes European Union Directive 2022/2555 (the Network and Information Security Directive 2) into Portuguese law, as approved by Decree-Law 125/2025 of 4 December 2025. The draft regulation establishes operational rules for essential entities, important entities, and relevant public entities subject to cybersecurity obligations. Key elements include: procedures for entity self-identification and qualification through an electronic platform; mandatory and voluntary incident notification mechanisms; minimum cybersecurity measures organized by compliance levels (basic, substantial, and elevated); the National Cybersecurity Reference Framework (Quadro Nacional de Referência para a Cibersegurança - QNRCS); and a risk matrix determining applicable compliance levels based on sector, entity size, and criticality. The regulation defines governance structures, including roles for cybersecurity officers and permanent contact points, and establishes requirements for supply chain risk management, asset management, vulnerability identification, incident response, and business continuity planning. It incorporates six cybersecurity objectives: manage, identify, protect, detect, respond, and recover. The public consultation period runs for 30 days from publication. Interested parties may submit written comments in Portuguese to cncs@cncs.gov.pt. Following the consultation, the CNCS will publish a report addressing all submissions received and explaining decisions taken. The regulation enters into force on the fifth day following its publication in the Official Journal (Diário da República).