NIS 2 in Portugal: Is appointing a cybersecurity officer enough?
Portugal’s new Cybersecurity Legal Framework distinguishes between the responsibilities of management bodies, the cybersecurity officer and the permanent point of contact. But how can organisations determine whether these functions are effectively coordinated?
⏱️ Estimated reading time: 4 minutes
For organisations subject to NIS 2 in Portugal, appointing a cybersecurity officer, identifying a permanent point of contact and communicating the required information to the competent authority are important steps towards compliance.
Can it therefore consider its cybersecurity governance arrangements to be adequately established?
Not necessarily. The formal appointment of responsible individuals is only one element of the governance model.
Decree-Law No. 125/2025 of 4 December, which transposes the NIS 2 Directive into Portuguese law, distinguishes between functions that must be coordinated but do not carry equivalent responsibilities.