Which activities are affected?

Map critical suppliers to processes, services and data. Check whether the available alternatives depend on the same infrastructure or access arrangements. An alternative exposed to the same cause of failure may not resolve the disruption.

Who makes the decisions, and what are the priorities?

Clarify who activates the plans, coordinates recovery and communicates with customers and partners. Compare planned recovery times with the length of disruption that priority activities can tolerate.

What evidence shows that the response works?

Look for results from exercises and recovery tests, and evidence that improvement actions have been completed. Planning, realistic scenarios and learning from incidents are central to recovery preparedness.

Why should I prepare my team for NIS2 / DORA / the Cyber Resilience Act?

Preparation reduces uncertainty, improves the consistency of decisions and helps the organisation demonstrate evidence to auditors, authorities, clients or partners. It also makes it possible to allocate responsibilities before an incident occurs or an urgent request for information is received.

It depends on the objective. Training is a starting point for developing capabilities and creating a common language. When the organisation needs to implement, review or verify controls, training may need to be complemented by advisory services or internal audit.

Which course should I choose?

Choose according to the applicable framework, your role and your level of responsibility. NIS 2 Compliance Lead Manager is intended for professionals who need to lead a NIS 2 compliance framework, from scope and governance to measures, reporting, supervision and evidence. DORA Compliance Lead Manager is intended for professionals who need to operationalise governance, ICT risk, incidents, resilience testing, third parties and evidence in the DORA context. Cyber Resilience Act Foundation is intended for professionals who need to understand the scope and security requirements applicable to products with digital elements throughout their lifecycle. For awareness, foundation-level knowledge or executive governance, consider the other pathways in Digital Compliance and Operational Resilience.

Articles tagged with: nis 2

NIS 2 in Portugal: Is appointing a cybersecurity officer enough?

Date: October 12, 2026 Author: Editor

NIS 2 in Portugal_ Cybersecurity Officer_

NIS 2 in Portugal: Is appointing a cybersecurity officer enough?

Portugal’s new Cybersecurity Legal Framework distinguishes between the responsibilities of management bodies, the cybersecurity officer and the permanent point of contact. But how can organisations determine whether these functions are effectively coordinated?

⏱️ Estimated reading time: 4 minutes

For organisations subject to NIS 2 in Portugal, appointing a cybersecurity officer, identifying a permanent point of contact and communicating the required information to the competent authority are important steps towards compliance.

Can it therefore consider its cybersecurity governance arrangements to be adequately established?

Not necessarily. The formal appointment of responsible individuals is only one element of the governance model.

Decree-Law No. 125/2025 of 4 December, which transposes the NIS 2 Directive into Portuguese law, distinguishes between functions that must be coordinated but do not carry equivalent responsibilities.

Cybersecurity and business continuity: what if your critical supplier fails?

Date: October 6, 2026 Author: Editor

Cybersecurity and business continuity: what if your critical supplier fails?

Assess dependencies, decision-making and recovery capabilities. Explore Behaviour’s confirmed courses to strengthen your team’s skills.

⏱️ Estimated reading time: 4 minutes

The link between cybersecurity and business continuity becomes clear when a critical supplier fails. Imagine an essential application becoming unavailable, with no estimated recovery time. The IT team is looking for alternatives, operations teams are waiting for instructions and customers are still asking for answers.

Who decides what to do, and what preparation informs those decisions?

During this European Cybersecurity Month, this question belongs on the business agenda: beyond preventing attacks, are we prepared to keep operating when an external service fails?

Who can accept a risk on behalf of the organisation?

Date: September 29, 2026 Author: Editor

Who can accept a risk on behalf of the organisation?

Accepting a risk is a management decision. Learn how authority, criteria, governance and accountability relate to risk acceptance.

⏱️ Estimated reading time: 5–6 minutes

Risk acceptance is a management decision, not simply the outcome of a technical assessment. Identifying, analysing and rating a risk does not bring the risk management process to an end. When an organisation decides to retain a particular exposure, defer treatment or accept the risk that remains after controls have been implemented, that decision must be supported by criteria, authority and evidence.

But who can accept a risk on behalf of the organisation?

The answer depends on the governance model, established responsibilities and authorities, risk criteria and the exposure concerned. Those who identify or assess a risk do not necessarily have the authority to accept it.

NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

Date: July 20, 2026 Author: Editor

Practical Guide NIS 2_DORA_Cyber Resilience Act

NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

Scope, governance, risk, incidents, third parties, digital products and evidence: a practical structure for preparing your organisation without confusing distinct regulatory frameworks.

⏱️ Estimated reading time: 7–8 minutes

NIS2, DORA and the Cyber Resilience Act are transforming how organisations manage risk, incidents, third parties, products with digital elements and evidence. Although they share some concerns, they apply to different contexts and require different responses.

In Portugal, Decree-Law No. 125/2025 established the new Cybersecurity Legal Framework, transposing NIS2, and entered into force on 3 April 2026. Regulation No. 756/2026, in force since 23 June, set out matters such as the operation of the electronic platform, the National Cybersecurity Reference Framework, the risk matrix, minimum measures and verification criteria.

DORA has applied directly since 17 January 2025. Under the Cyber Resilience Act, reporting obligations start to apply on 11 September 2026, while the Regulation applies generally from 11 December 2027.