NIS 2 in Portugal: Is appointing a cybersecurity officer enough?
Portugal’s new Cybersecurity Legal Framework distinguishes between the responsibilities of management bodies, the cybersecurity officer and the permanent point of contact. But how can organisations determine whether these functions are effectively coordinated?
⏱️ Estimated reading time: 4 minutes
For organisations subject to NIS 2 in Portugal, appointing a cybersecurity officer, identifying a permanent point of contact and communicating the required information to the competent authority are important steps towards compliance.
Can it therefore consider its cybersecurity governance arrangements to be adequately established?
Not necessarily. The formal appointment of responsible individuals is only one element of the governance model.
Decree-Law No. 125/2025 of 4 December, which transposes the NIS 2 Directive into Portuguese law, distinguishes between functions that must be coordinated but do not carry equivalent responsibilities.
Who is accountable for NIS 2 compliance?
Under the legal framework implementing NIS 2 in Portugal, Article 25 of the Portuguese Cybersecurity Legal Framework assigns responsibility for approving and overseeing cybersecurity risk-management measures to the management, executive and administrative bodies of essential and important entities.
The legislation also establishes that the responsibility and powers required to fulfil these obligations may only be delegated to a member of those bodies.
Article 31, in turn, provides for the appointment of a cybersecurity officer, who must either be a member of the management, executive or administrative bodies or report directly to them within the organisational structure.
Article 32 establishes the role of the permanent point of contact, whose purpose is to ensure operational and technical coordination with the competent cybersecurity authorities.
Management bodies approve and oversee; the cybersecurity officer performs the management and coordination functions prescribed by law; and the permanent point of contact ensures the communication flows falling within its remit.
These responsibilities should not be confused, even where the legislation permits the same individual to perform multiple functions.
Cybersecurity officer: Why is appointment alone insufficient?
Consider the following illustrative situation.
An organisation has formally appointed a cybersecurity officer. However, there is no defined process for submitting proposed security measures to the management body, decisions are not communicated to the teams responsible for implementation, and no regular monitoring mechanism is in place.
The appointment has been made. But does the governance model enable the organisation to discharge its responsibilities effectively?
The key question is whether there is an effective relationship between authority, decision-making, implementation and oversight.
Legislation establishes responsibilities. Organisations must ensure that the necessary conditions are in place for those responsibilities to be fulfilled, in accordance with the applicable requirements and deadlines.
How can organisations assess whether responsibilities are effectively coordinated?
Behaviour proposes assessing four governance dimensions:
On smaller screens, scroll horizontally to view all four dimensions.
| Dimension | Assessment question |
|---|---|
| Authority | Are decision-making powers and the responsibilities of each function clearly defined? |
| Information | Can the cybersecurity officer provide the management body with the information needed to support informed decisions? |
| Implementation | Are approved decisions translated into specific measures, assigned responsibilities and concrete activities? |
| Oversight | Does the management body have adequate information to monitor the implementation of measures and determine when intervention is required? |
These four dimensions provide an organisational assessment framework, rather than a standalone legal checklist or a substitute for the requirements of the Portuguese Cybersecurity Legal Framework.
Their purpose is to help identify situations where formal appointments have been made but effective operational and coordination mechanisms are lacking.
Who should coordinate NIS 2 implementation?
Compliance with NIS 2 in Portugal frequently involves several organisational functions: cybersecurity, IT, risk management, compliance, legal, operations and business continuity.
Programme coordination should enable the organisation to interpret applicable requirements, organise responsibilities, monitor measures and provide management with appropriate information.
These activities may be distributed across different functions, according to the organisation’s structure and resources, without altering the responsibilities established by law.
The challenge is not to create another position. It is to ensure that legally established responsibilities are translated into a governance model that works in practice.
From formal accountability to management capability
Implementing NIS 2 requires different competencies: those responsible for approval and oversight need to understand their obligations, while those coordinating compliance must be able to interpret requirements, organise measures and monitor their implementation.
This is where specialised training can contribute to more consistent and effective governance.
Behaviour offers two complementary training pathways:
- NIS 2 Executive Governance — designed for management, executive and administrative bodies, focusing on legal accountability, oversight and decision-making.
- NIS 2 Compliance Lead Manager — designed for professionals responsible for structuring, implementing, coordinating and monitoring NIS 2 compliance programmes.
Developing these competencies does not replace compliance with legal obligations. It helps ensure that the individuals involved understand and can effectively fulfil their responsibilities.
Compliance begins with clear responsibilities and the right competencies.
Are you looking to develop these competencies individually or prepare your team?
Contact Behaviour at training@behaviour-group.com to explore our training options and Team Package.
Legal and regulatory references
- Decree-Law No. 125/2025 of 4 December — Portuguese Cybersecurity Legal Framework, particularly Articles 25, 31 and 32.
- Regulation No. 756/2026 of 22 June — Implementing Regulation of the Portuguese Cybersecurity Legal Framework.
Date:
Author: Behaviour Group
Copying or reproduction of this article is not permitted.