NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

NIS2, DORA and the Cyber Resilience Act are transforming how organisations manage risk, incidents, third parties, products with digital elements and evidence. Although they share some concerns, they apply to different contexts and require different responses.

In Portugal, Decree-Law No. 125/2025 established the new Cybersecurity Legal Framework, transposing NIS2, and entered into force on 3 April 2026. Regulation No. 756/2026, in force since 23 June, set out matters such as the operation of the electronic platform, the National Cybersecurity Reference Framework, the risk matrix, minimum measures and verification criteria.

DORA has applied directly since 17 January 2025. Under the Cyber Resilience Act, reporting obligations start to apply on 11 September 2026, while the Regulation applies generally from 11 December 2027.

How should your organisation prepare for NIS2 / DORA / the Cyber Resilience Act?

Preparation should begin by confirming scope: which entities, activities, services, operations and products fall within each framework. The organisation should then assign responsibilities, assess risks and dependencies, identify gaps and organise the required evidence.

The objective is not to create three completely isolated programmes, but to establish a common foundation for governance, risk, incidents, third parties, testing and evidence, supplemented by the specific requirements of each regime.

What distinguishes NIS2, DORA and the Cyber Resilience Act?

At a glance, the differences concern the organisations in scope, the subject being protected and the first point that needs to be confirmed:

NIS2 and Portugal’s cybersecurity framework

NIS2 focuses on the resilience of the entities within its scope. The new Portuguese framework covers 17 sectors and a significant part of the Public Administration, allowing entities to be classified as essential, important or relevant public entities.

It strengthens the accountability of management bodies, the risk-based approach, supply chain security and incident preparedness. The MyCiber platform supports processes such as self-identification, classification, registration of designated responsible persons and incident notification. Organisations that may be in scope should confirm the applicable procedures and deadlines in the official guidance currently in force.

DORA

DORA applies to the financial sector and seeks to ensure that entities can maintain or recover their critical functions when faced with technological disruption.

The Regulation covers ICT risk management, incident management and reporting, digital operational resilience testing and the control of risks associated with third-party ICT service providers.

Cyber Resilience Act

The Cyber Resilience Act is primarily directed at manufacturers of products with digital elements, including hardware and software, although it also assigns responsibilities to importers and distributors.

Its focus is product security throughout the lifecycle: risk assessment, security by design, vulnerability management, technical documentation, updates and conformity assessment. From 11 September 2026, the Regulation provides for an initial warning within 24 hours and a full notification within 72 hours for actively exploited vulnerabilities and severe incidents affecting product security.

The same organisation may be affected by more than one framework. A financial entity, for example, may be subject to DORA while also developing or distributing products covered by the Cyber Resilience Act.

The analysis should be conducted by legal entity, activity, service, product and role in the value chain — not merely by the group’s commercial name.

Five priorities for starting your preparation

1. Confirm the scope

Identify the entities, activities, services, products and geographies that may be in scope. Requirements imposed by clients, partners, contracts or sectoral authorities should also be considered. Without this analysis, the organisation may apply controls to the wrong context or leave relevant responsibilities uncovered.

2. Establish governance and responsibilities

Clarify who approves the plan, who coordinates implementation, who maintains external contacts and who makes decisions during an incident. Responsibility should not be concentrated solely within the cybersecurity team: management, IT, risk, compliance, operations, procurement, product and internal audit may have different but complementary roles.

3. Assess risks and dependencies

Map assets, critical services, third-party providers, software components and single points of failure. The assessment should show which dependencies could interrupt a service, affect a product or prevent the organisation from meeting a reporting obligation.

4. Prepare for incidents, vulnerabilities and continuity

Procedures should establish criteria for classification, escalation, decision-making, information gathering and reporting. They should also be tested: a procedure that has never been exercised may reveal weaknesses precisely when the organisation needs it most.

5. Organise capabilities and evidence

The organisation should be able to demonstrate what it decided, who was assigned responsibility, what was implemented and how effectiveness was verified. Regulation No. 756/2026 defines verification criteria as factual, documentary or technical evidence that cybersecurity measures have been applied. Having a policy is not enough: the organisation must prove that it was implemented, monitored and reviewed.

A practical phased plan

The five priorities show what should be assessed. The following three phases show how to sequence the work, adapting the order to the organisation’s size, maturity and exposure.

Some activities may take place in parallel, provided that priorities, accountable owners and completion criteria are clearly defined.

Phase 1 — Confirm scope and establish governance

During this phase, the organisation should:

• map the entities, activities, services and products that may be in scope;
• define accountable owners, points of contact and decision-making channels;
• establish management oversight and a central evidence repository.

Phase 2 — Assess gaps and set priorities

The organisation should compare applicable requirements with existing practices and evidence, identify dependencies and gaps, and prioritise work according to risk, criticality and the potential impact on clients and operations.

Phase 3 — Implement, test and demonstrate

The third phase turns decisions into verifiable practices. The organisation should implement or strengthen priority controls, update policies and contracts, test incident, vulnerability and continuity procedures, and monitor corrective actions.

Evidence should be reviewed to confirm that it demonstrates not only the existence of controls, but also their implementation and effectiveness.

This model does not, by itself, represent full compliance. It provides a structure for organising capability development, implementation, advisory support or internal audit.

What capabilities should be developed?

Preparation should be adapted to the functions performed. Management bodies need to understand risk, approve priorities and monitor deviations. Security, IT and operations teams should implement controls and carry out response procedures.

Procurement and supplier management need to assess dependencies and contracts. Product and engineering teams should integrate security into development and manage components, updates and vulnerabilities. Internal audit, risk and compliance should be able to assess controls and link conclusions to verifiable criteria and evidence.

The organisation should therefore identify not only who needs awareness, but also who requires decision-making, implementation, reporting, testing and verification capabilities.

How Behaviour can support you

Behaviour can support you through framework-specific training, advisory services and internal audit/readiness assessment.

Framework-specific training

View all Digital Compliance and Operational Resilience pathways

The pathway should be selected according to the applicable framework, participant roles and the objective: awareness, foundations, governance, implementation, management or verification.

Frequently asked questions about NIS2, DORA and the Cyber Resilience Act

Conclusion

NIS2, DORA and the Cyber Resilience Act may share a common foundation of governance, risk, incidents, third parties, testing, capabilities and evidence. However, the scope, addressees, reporting processes and specific obligations of each regime remain distinct and should be managed accordingly.

Knowing each framework is no longer enough. Organisations need to demonstrate — through prepared people and verifiable evidence — their ability to decide, implement, respond and improve.

Note: this article and the checklist are for information purposes only and do not replace a legal, regulatory or technical assessment of the specific circumstances. Confirmation of scope and applicable obligations should take account of the organisation’s activities and the official sources currently in force.

Date: 20 July 2026
Author: Behaviour
Copying or reproduction of this article is not authorised.