NIS2 Compliance

NIS2 was incorporated into Portuguese law through Decreto-Lei 125/2025, and it changed two things that matter to you. It widened who is covered, pulling in organisations that were never regulated before. And it made management personally accountable; compliance is no longer something that can be delegated to IT and forgotten.

For most companies, the first question is not how to comply. It is whether they have to.

Start here: are you in scope?

We support whether NIS2 applies to your organisation and, if so, whether you fall under the essential or important entity classification. That determines your obligations, your notification duties and your supervisory regime. It is a short engagement with a clear answer, and it is where every NIS2 project should begin.

Many companies discover they are not directly in scope but are contractually bound anyway, because a covered customer has passed the obligation down the chain. The answer changes what you need to do, but rarely means you can do nothing.

Implementation

We build compliance around active management ownership, not a documentation exercise. The directive expects cybersecurity to sit inside your risk management and your business strategy, and supervisory authorities will look for evidence that it does.

Our approach covers thirteen domains, mapping the directive's requirements against recognised international practice:

Governance and risk: Formal security policies, a defined responsibility model, structured risk management with critical asset identification and treatment plans.

Incident management: Detection, response and recovery processes, with notification built to the deadlines the directive sets: an early warning within 24 hours, a detailed report within 72 hours, and a final report within one month.

Business continuity: Impact analysis, continuity and recovery plans, and the regular testing that makes them real.

Supply chain: Supplier assessment and monitoring, and the contractual security requirements that need to be in your agreements.

Technical controls: Network security, identity and access management with multi-factor authentication and least privilege, encryption for data protection, centralised logging, continuous monitoring and vulnerability management.

Secure development and acquisition: Security-by-design principles applied when you buy or build.

The human factor: Awareness programmes and secure practices across the employee lifecycle, from onboarding to departure.

Measurement and improvement: Indicators, internal audits and compliance monitoring, so conformity is something you can demonstrate rather than assert.

Staying compliant

Implementation has an end date. Compliance does not.

Your organisation changes, your suppliers change, and regulatory interpretation develops as supervisory authorities begin to apply the law. A control that satisfied the requirement last year may not next year, and the gap usually appears quietly.

Our ongoing NIS2 service keeps you aligned. We track regulatory developments and translate them into what they mean for you operationally. We review your compliance status on a regular cycle, identifying drift, testing whether existing controls still work, and adjusting the action plan when something changes internally or externally. And we are the reference point when a question comes up before a decision is made, not after.

What you get

A written opinion on your scope and classification. A complete set of policies and procedures, built for your organisation rather than downloaded. An incident response and notification procedure aligned to the 24-hour, 72-hour and 30-day deadlines. A risk management process with your critical assets identified. Supplier security requirements ready for your contracts. And the evidence file that demonstrates it all.

What it does not include

We do not implement technical controls ourselves. NINE Cybersecurity specifies what must change and coordinates with your IT team or provider, who carry out the execution. We also do not certify compliance; no consultancy can. What we do is put you in a position where, if a supervisory authority or a customer asks, the answer is documented and holds up.