What is Regulation 756/2026?

It is the regulation that implements the Legal Framework for Cybersecurity in Portugal, defining practical rules for entities within scope, minimum measures, communications, notifications, residual risk and compliance levels.

What is the relationship between Regulation 756/2026 and NIS2?

Regulation 756/2026 operationalises obligations under the Legal Framework for Cybersecurity, approved by Decree-Law No. 125/2025, which transposed the NIS2 Directive into Portuguese law.

Who should implement Regulation 756/2026 in the company?

Implementation involves the CISO, the person responsible for cybersecurity, CIO, IT, SOC, GRC, compliance, risk, continuity, audit, legal, procurement, HR, process owners and management bodies.

What is NIS2 and who does it apply to in Portugal?

NIS2 is Directive (EU) 2022/2555, transposed into Portuguese law by Decree-Law no. 125/2025 of 4 December, which approved the new Legal Framework for Cybersecurity. It applies to essential and important entities in sectors considered critical or relevant, including energy, transport, healthcare, banking, digital infrastructures, public administration, among others. The framework entered into force on 3 April 2026.

Are ISO/IEC 27001 and NIS2 the same thing?

No. ISO/IEC 27001 is an international standard for information security management systems, whereas NIS2 is a European cybersecurity directive transposed into national law. Although they address related topics — such as risk, controls, incidents and responsibilities — they have different natures, scopes and purposes.

Does ISO/IEC 27001 certification help address NIS2?

Yes, it can help significantly. A well-implemented Information Security Management System — focused on risk management, controls, documentation, internal audit and continual improvement — supports a relevant part of the response to NIS2 and facilitates the demonstration of maturity. Even so, NIS2 includes its own regulatory requirements that require specific analysis, such as legal scope, entity classification, reporting obligations and interaction with the competent authorities.

What should professionals know about NIS2 and ISO/IEC 27001?

Information security, compliance, audit, risk and governance professionals need to understand both dimensions: the normative dimension, structured by ISO/IEC 27001, and the regulatory dimension, introduced by NIS2. Knowing how to articulate an Information Security Management System with the requirements of a cybersecurity legal framework — identifying overlaps, gaps and priorities — is an increasingly valued competence in the market.

What training covers NIS2 and ISO/IEC 27001?

Behaviour develops training in the areas of information security, cybersecurity and regulatory compliance. The learning paths cover both the normative dimension — implementation and auditing of Information Security Management Systems according to ISO/IEC 27001 — and the regulatory dimension, including the European cybersecurity framework and its practical application for different profiles and levels of responsibility.

Regulation 756/2026: what changes in cybersecurity in Portugal and how to prepare your organisation

Date: June 24, 2026 Author: Editor

Regulation 756/2026: what is changing in cybersecurity in Portugal and how to prepare your company

Regulation No. 756/2026 implements the new Legal Framework for Cybersecurity in Portugal and turns cybersecurity into a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

⏱️ Estimated reading time: 4 minutes

Regulation No. 756/2026, of 22 June, has been published, implementing the new Legal Framework for Cybersecurity in Portugal. This regulation operationalises several obligations provided for in Decree-Law No. 125/2025, the legal instrument that transposed the NIS2 Directive into Portuguese law.

For companies, the message is clear: cybersecurity is no longer only a technical topic. It is becoming a demonstrable responsibility of governance, risk, evidence, incident response and operational resilience.

NIS2 and ISO/IEC 27001: the same obligation or two different requirements?

Date: May 28, 2026 Author: Editor

Cybersecurity obligations and requirements

NIS2 and ISO/IEC 27001: the same obligation or two different requirements?

NIS2 and ISO/IEC 27001 share a common vocabulary: risk, controls, incidents, responsibilities. But they do not have the same nature or the same purpose. Treating one as a substitute for the other is one of the most frequent misunderstandings, with practical consequences for organisations and professionals.

⏱️ Estimated reading time: 6 minutes

The entry into force of NIS2 reinforced an idea that many organisations already knew, but did not always treat with the necessary priority: cybersecurity is no longer merely a technical concern and has become a requirement of governance, risk management, operational continuity and management accountability.At the same time, many entities already had, or are preparing, information security management systems based on ISO/IEC 27001. This raises a frequent question:Is complying with ISO/IEC 27001 the same as complying with NIS2?The answer is clear: no. NIS2 and ISO/IEC 27001 are not the same obligation. But they are deeply related.

Change management in information systems: a business continuity risk that cannot be ignored

Date: May 21, 2026 Author: Editor

Change management in information systems: a business continuity risk that cannot be ignored

Change management in information systems is not just a technical issue. When a change may affect critical processes, services, data, suppliers or operational capacity, it must also be analysed as a business continuity risk.

⏱️ Estimated reading time: 6 minutes

Some questions seem technical, but reveal a much broader concern.
One of them is this: “Is there any training course on change management in information systems?” The answer is yes. But the most important part of the answer is not only the name of the training course. It lies in understanding what this question really means.

Frameworks vs Regulations: what do you really need to implement?

Date: October 15, 2025 Author: Editor

Frameworks & Regulations • Article

Frameworks vs Regulations: what to implement and why

⏱️ Estimated reading time: 8 minutes

Frameworks vs regulations is one of the most common questions for organisations that need to improve maturity, meet legal obligations and avoid duplicated compliance work.

Frameworks vs regulations: comparison between best practices and legal requirements

In a world saturated with standards, frameworks, directives and regulations, many organisations face the same question:
After all, what should we implement? ISO/IEC 27001? NIST? NIS 2? DORA? Everything?