What is Regulation 756/2026?

It is the regulation that implements the Legal Framework for Cybersecurity in Portugal, defining practical rules for entities within scope, minimum measures, communications, notifications, residual risk and compliance levels.

What is the relationship between Regulation 756/2026 and NIS2?

Regulation 756/2026 operationalises obligations under the Legal Framework for Cybersecurity, approved by Decree-Law No. 125/2025, which transposed the NIS2 Directive into Portuguese law.

Who should implement Regulation 756/2026 in the company?

Implementation involves the CISO, the person responsible for cybersecurity, CIO, IT, SOC, GRC, compliance, risk, continuity, audit, legal, procurement, HR, process owners and management bodies.

Why is cybersecurity no longer just an IT responsibility?

Cybersecurity is no longer just an IT responsibility because digital incidents can affect operational continuity, customers, data, suppliers, contracts, reputation, legal obligations and management decisions. Technical teams remain essential, but they need to be aligned with management, risk, compliance, legal, privacy, human resources, communication and operations.

What has changed in cybersecurity in 2026?

In 2026, cybersecurity is more closely linked to governance, risk management, operational resilience and regulatory compliance. In Portugal, the new Cybersecurity Legal Framework, which transposes the NIS2 Directive, entered into force on 3 April 2026. In the financial sector, DORA has applied since 17 January 2025, strengthening requirements relating to digital operational resilience.

What role do NIS2 and DORA play in digital risk management?

NIS2 and DORA reinforce the need to demonstrate that digital risks are known, governed, treated, monitored and documented. NIS2 focuses on cybersecurity and entities covered by the applicable legal framework. DORA focuses on the digital operational resilience of financial entities, including ICT risk, incidents, testing, third parties and recovery capability.

Why is evidence so important in cybersecurity?

Evidence is essential because it is no longer enough to state that policies, controls or procedures exist. The organisation must be able to demonstrate that risks have been assessed, responsibilities assigned, controls implemented and monitored, incidents reported and handled, teams prepared and decisions documented.

Why do people remain a critical risk surface?

People remain a critical risk surface because many incidents begin with simple actions, such as clicking a link, opening an attachment, reusing a password, approving a transfer in haste, accepting an IBAN change without sufficient confirmation or sharing internal information through the wrong channel. Technology reduces exposure, but it does not replace prepared teams.

What training can support cybersecurity and operational resilience readiness?

Training should be adapted to the organisation’s different profiles, including management bodies, middle management, IT, security, risk, compliance, audit, human resources, finance, operations and users. It should support understanding of responsibilities, incident identification and reporting, risk management, evidence, continuity, response and recovery.

Regulation 756/2026: what changes in cybersecurity in Portugal and how to prepare your organisation

Date: June 24, 2026 Author: Editor

Regulation 756/2026: what is changing in cybersecurity in Portugal and how to prepare your company

Regulation No. 756/2026 implements the new Legal Framework for Cybersecurity in Portugal and turns cybersecurity into a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

⏱️ Estimated reading time: 4 minutes

Regulation No. 756/2026, of 22 June, has been published, implementing the new Legal Framework for Cybersecurity in Portugal. This regulation operationalises several obligations provided for in Decree-Law No. 125/2025, the legal instrument that transposed the NIS2 Directive into Portuguese law.

For companies, the message is clear: cybersecurity is no longer only a technical topic. It is becoming a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

Cybersecurity in 2026: why digital risk is no longer just an IT responsibility

Date: June 11, 2026 Author: Editor

Cybersecurity in 2026: why digital risk is no longer just an IT responsibility

Cybersecurity is no longer just a technical issue. In 2026, it is also a matter of governance, risk management, compliance, operational continuity, evidence and team readiness.

That is why discussing cybersecurity in 2026 means discussing digital risk, compliance, operational resilience and the ability to demonstrate evidence.

⏱️ Estimated reading time: 7 minutes

“`For years, cybersecurity was treated as an essentially technical matter. The focus was on firewalls, antivirus, access management, backups, tools, systems and IT teams.

All of this remains essential. But it is no longer enough.

Frameworks vs Regulations: what do you really need to implement?

Date: October 15, 2025 Author: Editor

Frameworks & Regulations • Article

Frameworks vs Regulations: what to implement and why

⏱️ Estimated reading time: 8 minutes

Frameworks vs regulations is one of the most common questions for organisations that need to improve maturity, meet legal obligations and avoid duplicated compliance work.

Frameworks vs regulations: comparison between best practices and legal requirements

In a world saturated with standards, frameworks, directives and regulations, many organisations face the same question:
After all, what should we implement? ISO/IEC 27001? NIST? NIS 2? DORA? Everything?