Why should I prepare my team for NIS2 / DORA / the Cyber Resilience Act?

Preparation reduces uncertainty, improves the consistency of decisions and helps the organisation demonstrate evidence to auditors, authorities, clients or partners. It also makes it possible to allocate responsibilities before an incident occurs or an urgent request for information is received.

It depends on the objective. Training is a starting point for developing capabilities and creating a common language. When the organisation needs to implement, review or verify controls, training may need to be complemented by advisory services or internal audit.

Which course should I choose?

Choose according to the applicable framework, your role and your level of responsibility. NIS 2 Compliance Lead Manager is intended for professionals who need to lead a NIS 2 compliance framework, from scope and governance to measures, reporting, supervision and evidence. DORA Compliance Lead Manager is intended for professionals who need to operationalise governance, ICT risk, incidents, resilience testing, third parties and evidence in the DORA context. Cyber Resilience Act Foundation is intended for professionals who need to understand the scope and security requirements applicable to products with digital elements throughout their lifecycle. For awareness, foundation-level knowledge or executive governance, consider the other pathways in Digital Compliance and Operational Resilience.

What is the difference between a Business Continuity Plan and a Disaster Recovery Plan?

A Business Continuity Plan guides the continuation and resumption of prioritised activities, products and services. A Disaster Recovery Plan focuses on recovering the infrastructure, data and technology services required by the business. They are complementary components; the need for a standalone DRP and the way the documents are linked depend on the organisation’s scope and reliance on technology.

What is the difference between a BIA and a risk assessment?

A BIA examines how the impacts of a disruption develop over time, identifies prioritised activities and supports the definition of MTPD, RTO, MBCO and, where applicable, RPO. A risk assessment identifies scenarios that could cause disruption, analyses likelihood and consequences, and guides treatment measures. Put simply, the BIA asks what impact a disruption would have and how long it can be tolerated; the risk assessment asks what could cause the disruption and how exposure can be reduced.

What is the difference between ISO 22301 Lead Implementer and Lead Auditor?

Lead Implementer prepares professionals to support the design, implementation, operation and improvement of a BCMS. Lead Auditor develops the capability to plan and conduct first-, second- or third-party audits, according to the professional’s role and competence. Completing the training does not, by itself, confer authority to issue third-party certification.

Does ISO 27001 guarantee automatic compliance with DORA?

No. ISO/IEC 27001 does not replace DORA and does not remove the need to analyse the applicable legal requirements. However, a well implemented Information Security Management System can support ICT risk management, documentation, evidence of controls, incident response and governance in regulated environments.

Which organisations should consider ISO 27001 training in the context of DORA?

Training should be considered by financial entities within the scope of DORA, their ICT service providers and organisations that provide cloud services, software, outsourcing, technology support, consultancy, auditing, data management or other critical services. It is also relevant for organisations that want to improve their Information Security posture and respond to enterprise client requirements.

Is ISO 27001 only for IT teams?

No. Although it includes technical controls, ISO 27001 is a management standard. It involves leadership, compliance, quality, HR, procurement, legal, operations, physical security, communications and all areas that handle relevant information. Security depends on technology, but also on processes, responsibilities and human behaviour.

What is the difference between implementing and certifying ISO 27001?

Implementing means creating and operating an Information Security Management System aligned with the requirements of the standard. Certifying means submitting that system to an audit by an independent certification body. An organisation can start by aligning with the standard and later move towards certification, depending on its objectives, risks and market requirements.

What is Regulation 756/2026?

It is the regulation that implements the Legal Framework for Cybersecurity in Portugal, defining practical rules for entities within scope, minimum measures, communications, notifications, residual risk and compliance levels.

What is the relationship between Regulation 756/2026 and NIS2?

Regulation 756/2026 operationalises obligations under the Legal Framework for Cybersecurity, approved by Decree-Law No. 125/2025, which transposed the NIS2 Directive into Portuguese law.

Who should implement Regulation 756/2026 in the company?

Implementation involves the CISO, the person responsible for cybersecurity, CIO, IT, SOC, GRC, compliance, risk, continuity, audit, legal, procurement, HR, process owners and management bodies.

Why is cybersecurity no longer just an IT responsibility?

Cybersecurity is no longer just an IT responsibility because digital incidents can affect operational continuity, customers, data, suppliers, contracts, reputation, legal obligations and management decisions. Technical teams remain essential, but they need to be aligned with management, risk, compliance, legal, privacy, human resources, communication and operations.

What has changed in cybersecurity in 2026?

In 2026, cybersecurity is more closely linked to governance, risk management, operational resilience and regulatory compliance. In Portugal, the new Cybersecurity Legal Framework, which transposes the NIS2 Directive, entered into force on 3 April 2026. In the financial sector, DORA has applied since 17 January 2025, strengthening requirements relating to digital operational resilience.

What role do NIS2 and DORA play in digital risk management?

NIS2 and DORA reinforce the need to demonstrate that digital risks are known, governed, treated, monitored and documented. NIS2 focuses on cybersecurity and entities covered by the applicable legal framework. DORA focuses on the digital operational resilience of financial entities, including ICT risk, incidents, testing, third parties and recovery capability.

Why is evidence so important in cybersecurity?

Evidence is essential because it is no longer enough to state that policies, controls or procedures exist. The organisation must be able to demonstrate that risks have been assessed, responsibilities assigned, controls implemented and monitored, incidents reported and handled, teams prepared and decisions documented.

Why do people remain a critical risk surface?

People remain a critical risk surface because many incidents begin with simple actions, such as clicking a link, opening an attachment, reusing a password, approving a transfer in haste, accepting an IBAN change without sufficient confirmation or sharing internal information through the wrong channel. Technology reduces exposure, but it does not replace prepared teams.

What training can support cybersecurity and operational resilience readiness?

Training should be adapted to the organisation’s different profiles, including management bodies, middle management, IT, security, risk, compliance, audit, human resources, finance, operations and users. It should support understanding of responsibilities, incident identification and reporting, risk management, evidence, continuity, response and recovery.

Cyber Resilience Act: what changes and how to prepare your organisation

Date: July 20, 2026 Author: Editor

Practical Guide NIS 2_DORA_Cyber Resilience Act

NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

Scope, governance, risk, incidents, third parties, digital products and evidence: a practical structure for preparing your organisation without confusing distinct regulatory frameworks.

⏱️ Estimated reading time: 7–8 minutes

NIS2, DORA and the Cyber Resilience Act are transforming how organisations manage risk, incidents, third parties, products with digital elements and evidence. Although they share some concerns, they apply to different contexts and require different responses.

In Portugal, Decree-Law No. 125/2025 established the new Cybersecurity Legal Framework, transposing NIS2, and entered into force on 3 April 2026. Regulation No. 756/2026, in force since 23 June, set out matters such as the operation of the electronic platform, the National Cybersecurity Reference Framework, the risk matrix, minimum measures and verification criteria.

DORA has applied directly since 17 January 2025. Under the Cyber Resilience Act, reporting obligations start to apply on 11 September 2026, while the Regulation applies generally from 11 December 2027.

ISO 22301: practical guide to business continuity

Date: July 14, 2026 Author: Editor

ISO 22301: practical guide to business continuity

How to prepare your organisation, structure evidence and build capability.

⏱️ Estimated reading time: 8 minutes

This practical guide to ISO 22301 and business continuity explains how to prepare your organisation, define recovery priorities and objectives, test plans and compile audit evidence.

ISO 22301 and business continuity: what is it and who does it apply to?

ISO 22301 specifies the requirements for establishing, implementing, maintaining and improving a Business Continuity Management System (BCMS). It can be applied by organisations of any size or sector that need to ensure the delivery of prioritised products and services during a disruption.

The standard is voluntary as a management system and certification framework. Nevertheless, legal, sector-specific or contractual requirements may require specific continuity, recovery and evidence capabilities. Certification is one way to demonstrate conformity with the standard, but it does not replace obligations applicable to the organisation.

ISO 27001 and DORA: how to align information security, ICT risk and operational resilience

Date: July 9, 2026 Author: Editor

ISO 27001 and DORA: how to align information security, ICT risk and operational resilience

ISO/IEC 27001 does not replace DORA, but it can provide a solid foundation for organising Information Security, ICT risk management, continuity, documented evidence and supplier oversight.

⏱️ Estimated reading time: 5 minutes

Information Security is no longer only a technical responsibility. Today, it is also a priority for management, compliance, business continuity and digital trust.

With DORA, financial entities and many of their service providers face more demanding requirements for ICT risk, incidents, digital operational resilience testing and third-party management. In this context, ISO/IEC 27001 becomes particularly relevant because it offers a recognised framework for organising policies, responsibilities, controls, evidence and continual improvement.

For organisations and professionals, understanding the connection between ISO 27001 and DORA can be a strategic advantage.

Regulation 756/2026: what changes in cybersecurity in Portugal and how to prepare your organisation

Date: June 24, 2026 Author: Editor

Regulation 756/2026: what is changing in cybersecurity in Portugal and how to prepare your company

Regulation No. 756/2026 implements the new Legal Framework for Cybersecurity in Portugal and turns cybersecurity into a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

⏱️ Estimated reading time: 4 minutes

Regulation No. 756/2026, of 22 June, has been published, implementing the new Legal Framework for Cybersecurity in Portugal. This regulation operationalises several obligations provided for in Decree-Law No. 125/2025, the legal instrument that transposed the NIS2 Directive into Portuguese law.

For companies, the message is clear: cybersecurity is no longer only a technical topic. It is becoming a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

Cybersecurity in 2026: why digital risk is no longer just an IT responsibility

Date: June 11, 2026 Author: Editor

Cybersecurity in 2026: why digital risk is no longer just an IT responsibility

Cybersecurity is no longer just a technical issue. In 2026, it is also a matter of governance, risk management, compliance, operational continuity, evidence and team readiness.

That is why discussing cybersecurity in 2026 means discussing digital risk, compliance, operational resilience and the ability to demonstrate evidence.

⏱️ Estimated reading time: 7 minutes

“`For years, cybersecurity was treated as an essentially technical matter. The focus was on firewalls, antivirus, access management, backups, tools, systems and IT teams.

All of this remains essential. But it is no longer enough.

Frameworks vs Regulations: what do you really need to implement?

Date: October 15, 2025 Author: Editor

Frameworks & Regulations • Article

Frameworks vs Regulations: what to implement and why

⏱️ Estimated reading time: 8 minutes

Frameworks vs regulations is one of the most common questions for organisations that need to improve maturity, meet legal obligations and avoid duplicated compliance work.

Frameworks vs regulations: comparison between best practices and legal requirements

In a world saturated with standards, frameworks, directives and regulations, many organisations face the same question:
After all, what should we implement? ISO/IEC 27001? NIST? NIS 2? DORA? Everything?