Which activities are affected?

Map critical suppliers to processes, services and data. Check whether the available alternatives depend on the same infrastructure or access arrangements. An alternative exposed to the same cause of failure may not resolve the disruption.

Who makes the decisions, and what are the priorities?

Clarify who activates the plans, coordinates recovery and communicates with customers and partners. Compare planned recovery times with the length of disruption that priority activities can tolerate.

What evidence shows that the response works?

Look for results from exercises and recovery tests, and evidence that improvement actions have been completed. Planning, realistic scenarios and learning from incidents are central to recovery preparedness.

Should these four disciplines be applied sequentially?

No. Their intensity varies across the lifecycle, but they should operate in parallel. Risk starts with the decision, security accompanies design and implementation, and auditing should be considered from the outset so that the necessary evidence is produced.

Who is responsible for cybersecurity risk?

Each risk must have an owner responsible for monitoring and treating it. Acceptance of residual risk rests with the authority defined in the organisation’s governance model. Cybersecurity, project, cloud and audit teams provide information, but do not replace that responsibility.

Should cloud auditing take place only at the end?

No. Audit criteria and evidence requirements should be considered during planning to reduce gaps and avoid reconstructing documentation after implementation.

Does risk management replace technical security testing?

No. Risk management sets priorities and criteria. Technical tests verify assumptions, vulnerabilities and control effectiveness. The two activities are complementary.

What is NIS2 and who does it apply to in Portugal?

NIS2 is Directive (EU) 2022/2555, transposed into Portuguese law by Decree-Law no. 125/2025 of 4 December, which approved the new Legal Framework for Cybersecurity. It applies to essential and important entities in sectors considered critical or relevant, including energy, transport, healthcare, banking, digital infrastructures, public administration, among others. The framework entered into force on 3 April 2026.

Are ISO/IEC 27001 and NIS2 the same thing?

No. ISO/IEC 27001 is an international standard for information security management systems, whereas NIS2 is a European cybersecurity directive transposed into national law. Although they address related topics — such as risk, controls, incidents and responsibilities — they have different natures, scopes and purposes.

Does ISO/IEC 27001 certification help address NIS2?

Yes, it can help significantly. A well-implemented Information Security Management System — focused on risk management, controls, documentation, internal audit and continual improvement — supports a relevant part of the response to NIS2 and facilitates the demonstration of maturity. Even so, NIS2 includes its own regulatory requirements that require specific analysis, such as legal scope, entity classification, reporting obligations and interaction with the competent authorities.

What should professionals know about NIS2 and ISO/IEC 27001?

Information security, compliance, audit, risk and governance professionals need to understand both dimensions: the normative dimension, structured by ISO/IEC 27001, and the regulatory dimension, introduced by NIS2. Knowing how to articulate an Information Security Management System with the requirements of a cybersecurity legal framework — identifying overlaps, gaps and priorities — is an increasingly valued competence in the market.

What training covers NIS2 and ISO/IEC 27001?

Behaviour develops training in the areas of information security, cybersecurity and regulatory compliance. The learning paths cover both the normative dimension — implementation and auditing of Information Security Management Systems according to ISO/IEC 27001 — and the regulatory dimension, including the European cybersecurity framework and its practical application for different profiles and levels of responsibility.

Articles tagged with: cybersecurity

Training in 2027: new standards, regulation and competences to develop

Date: October 23, 2026 Author: Editor

Training in 2027_ New Standards and Skills

Training in 2027: new standards, regulation and competences to develop

What has changed in quality, auditing, privacy, cybersecurity and artificial intelligence, and how to turn these changes into priorities for training in 2027.

⏱️ Estimated reading time: 9 minutes

Planning training in 2027 starts with a question: what has changed in the organisation’s standards and frameworks, risks and responsibilities?

ISO publications, ENISA’s threat landscape and European and national legislation help identify different needs. It is important to distinguish between published standards and frameworks, whose changes need to be analysed; applicable obligations, which require preparation for the responsibilities involved; and draft standards, which should be monitored without treating their requirements as final.

The aim is not to train everyone in the same topics, but to understand who needs to make decisions, implement, oversee or assess, and which competences they need.

Cybersecurity and business continuity: what if your critical supplier fails?

Date: October 6, 2026 Author: Editor

Cybersecurity and business continuity: what if your critical supplier fails?

Assess dependencies, decision-making and recovery capabilities. Explore Behaviour’s confirmed courses to strengthen your team’s skills.

⏱️ Estimated reading time: 4 minutes

The link between cybersecurity and business continuity becomes clear when a critical supplier fails. Imagine an essential application becoming unavailable, with no estimated recovery time. The IT team is looking for alternatives, operations teams are waiting for instructions and customers are still asking for answers.

Who decides what to do, and what preparation informs those decisions?

During this European Cybersecurity Month, this question belongs on the business agenda: beyond preventing attacks, are we prepared to keep operating when an external service fails?

Who can accept a risk on behalf of the organisation?

Date: September 29, 2026 Author: Editor

Who can accept a risk on behalf of the organisation?

Accepting a risk is a management decision. Learn how authority, criteria, governance and accountability relate to risk acceptance.

⏱️ Estimated reading time: 5–6 minutes

Risk acceptance is a management decision, not simply the outcome of a technical assessment. Identifying, analysing and rating a risk does not bring the risk management process to an end. When an organisation decides to retain a particular exposure, defer treatment or accept the risk that remains after controls have been implemented, that decision must be supported by criteria, authority and evidence.

But who can accept a risk on behalf of the organisation?

The answer depends on the governance model, established responsibilities and authorities, risk criteria and the exposure concerned. Those who identify or assess a risk do not necessarily have the authority to accept it.

How to connect project management, cybersecurity, cloud auditing and risk management?

Date: August 25, 2026 Author: Editor

How to Connect Project Management, Cybersecurity and Risk

How to connect project management, cybersecurity, cloud auditing and risk management?

⏱️ Estimated reading time: 9–10 minutes

A cloud migration, the implementation of a new platform or the modernisation of a digital service may be delivered on time and within budget and still fail.

All it takes is for the change to result in excessive access privileges, unclear responsibilities, unassessed dependencies or controls without evidence. Connecting project management, cybersecurity and risk with cloud auditing requires continuity between the business decision, the technical controls and the evidence produced.

NIS2 and ISO/IEC 27001: the same obligation or two different requirements?

Date: May 28, 2026 Author: Editor

Cybersecurity obligations and requirements

NIS2 and ISO/IEC 27001: the same obligation or two different requirements?

NIS2 and ISO/IEC 27001 share a common vocabulary: risk, controls, incidents, responsibilities. But they do not have the same nature or the same purpose. Treating one as a substitute for the other is one of the most frequent misunderstandings, with practical consequences for organisations and professionals.

⏱️ Estimated reading time: 6 minutes

The entry into force of NIS2 reinforced an idea that many organisations already knew, but did not always treat with the necessary priority: cybersecurity is no longer merely a technical concern and has become a requirement of governance, risk management, operational continuity and management accountability.At the same time, many entities already had, or are preparing, information security management systems based on ISO/IEC 27001. This raises a frequent question:Is complying with ISO/IEC 27001 the same as complying with NIS2?The answer is clear: no. NIS2 and ISO/IEC 27001 are not the same obligation. But they are deeply related.