What is the difference between a Business Continuity Plan and a Disaster Recovery Plan?

A Business Continuity Plan guides the continuation and resumption of prioritised activities, products and services. A Disaster Recovery Plan focuses on recovering the infrastructure, data and technology services required by the business. They are complementary components; the need for a standalone DRP and the way the documents are linked depend on the organisation’s scope and reliance on technology.

What is the difference between a BIA and a risk assessment?

A BIA examines how the impacts of a disruption develop over time, identifies prioritised activities and supports the definition of MTPD, RTO, MBCO and, where applicable, RPO. A risk assessment identifies scenarios that could cause disruption, analyses likelihood and consequences, and guides treatment measures. Put simply, the BIA asks what impact a disruption would have and how long it can be tolerated; the risk assessment asks what could cause the disruption and how exposure can be reduced.

What is the difference between ISO 22301 Lead Implementer and Lead Auditor?

Lead Implementer prepares professionals to support the design, implementation, operation and improvement of a BCMS. Lead Auditor develops the capability to plan and conduct first-, second- or third-party audits, according to the professional’s role and competence. Completing the training does not, by itself, confer authority to issue third-party certification.

What is Regulation 756/2026?

It is the regulation that implements the Legal Framework for Cybersecurity in Portugal, defining practical rules for entities within scope, minimum measures, communications, notifications, residual risk and compliance levels.

What is the relationship between Regulation 756/2026 and NIS2?

Regulation 756/2026 operationalises obligations under the Legal Framework for Cybersecurity, approved by Decree-Law No. 125/2025, which transposed the NIS2 Directive into Portuguese law.

Who should implement Regulation 756/2026 in the company?

Implementation involves the CISO, the person responsible for cybersecurity, CIO, IT, SOC, GRC, compliance, risk, continuity, audit, legal, procurement, HR, process owners and management bodies.

ISO 22301: practical guide to business continuity

Date: July 14, 2026 Author: Editor

ISO 22301: practical guide to business continuity

How to prepare your organisation, structure evidence and build capability.

⏱️ Estimated reading time: 8 minutes

This practical guide to ISO 22301 and business continuity explains how to prepare your organisation, define recovery priorities and objectives, test plans and compile audit evidence.

ISO 22301 and business continuity: what is it and who does it apply to?

ISO 22301 specifies the requirements for establishing, implementing, maintaining and improving a Business Continuity Management System (BCMS). It can be applied by organisations of any size or sector that need to ensure the delivery of prioritised products and services during a disruption.

The standard is voluntary as a management system and certification framework. Nevertheless, legal, sector-specific or contractual requirements may require specific continuity, recovery and evidence capabilities. Certification is one way to demonstrate conformity with the standard, but it does not replace obligations applicable to the organisation.

Regulation 756/2026: what changes in cybersecurity in Portugal and how to prepare your organisation

Date: June 24, 2026 Author: Editor

Regulation 756/2026: what is changing in cybersecurity in Portugal and how to prepare your company

Regulation No. 756/2026 implements the new Legal Framework for Cybersecurity in Portugal and turns cybersecurity into a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

⏱️ Estimated reading time: 4 minutes

Regulation No. 756/2026, of 22 June, has been published, implementing the new Legal Framework for Cybersecurity in Portugal. This regulation operationalises several obligations provided for in Decree-Law No. 125/2025, the legal instrument that transposed the NIS2 Directive into Portuguese law.

For companies, the message is clear: cybersecurity is no longer only a technical topic. It is becoming a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

Change management in information systems: a business continuity risk that cannot be ignored

Date: May 21, 2026 Author: Editor

Change management in information systems: a business continuity risk that cannot be ignored

Change management in information systems is not just a technical issue. When a change may affect critical processes, services, data, suppliers or operational capacity, it must also be analysed as a business continuity risk.

⏱️ Estimated reading time: 6 minutes

Some questions seem technical, but reveal a much broader concern.
One of them is this: “Is there any training course on change management in information systems?” The answer is yes. But the most important part of the answer is not only the name of the training course. It lies in understanding what this question really means.

Frameworks vs Regulations: what do you really need to implement?

Date: October 15, 2025 Author: Editor

Frameworks & Regulations • Article

Frameworks vs Regulations: what to implement and why

⏱️ Estimated reading time: 8 minutes

Frameworks vs regulations is one of the most common questions for organisations that need to improve maturity, meet legal obligations and avoid duplicated compliance work.

Frameworks vs regulations: comparison between best practices and legal requirements

In a world saturated with standards, frameworks, directives and regulations, many organisations face the same question:
After all, what should we implement? ISO/IEC 27001? NIST? NIS 2? DORA? Everything?