NIS2 in Portugal: turn registration and permanent contact into operating evidence

The signal and the facts that change the decision

Decree-Law 125/2025 brought Portugal's new Cybersecurity Legal Regime into force on 3 April 2026. For a potentially covered entity, the immediate risk is not only interpreting its sector: it is being able to prove classification, registration data, the responsible person, and a permanently available contact.

Portugal's transposition covers 17 sectors and distinguishes essential, important, and relevant public-administration entities. Classification should follow the national text applicable to the specific entity; the directive and technical guidance do not replace that analysis.

Permanent contact requires a cover chain, out-of-hours access, and tests of receipt, authentication, and escalation. A generic mailbox without a service rota is not permanent availability. A one-off registration also ages after an acquisition, new service, domain change, critical supplier, or owner change; discrepancies slow urgent notifications.

Decision, limits, and stop condition

Create one dossier per legal entity linking services, sector, size, exceptions, tax identifier, domains, networks, cybersecurity officer, deputy, and permanent contact. The board approves the rationale; operations tests availability and legal validates material changes.

A generic mailbox without a service rota is not permanent availability. A one-off registration also ages after an acquisition, new service, domain change, critical supplier, or owner change; discrepancies slow urgent notifications.

Execution and proof of completion

Execution should start by mapping each legal entity and service to the decree-law criteria while retaining source, decision, author, and review date. Then, establishing an owner, deputy, and 24/7 rota for the contact with least access, strong authentication, and a triage procedure. Closure requires running a quarterly test message and reconciling the dossier against hr, contracts, cmdb, domains, and the service catalogue.

The control closes when the scope rationale is reproducible, registration matches internal sources, an out-of-hours message reaches an authorised person within the objective, and any material change automatically reopens review.

• mapping each legal entity and service to the decree-law criteria while retaining source, decision, author, and review date.
• establishing an owner, deputy, and 24/7 rota for the contact with least access, strong authentication, and a triage procedure.
• running a quarterly test message and reconciling the dossier against HR, contracts, CMDB, domains, and the service catalogue.
• The control closes when the scope rationale is reproducible, registration matches internal sources, an out-of-hours message reaches an authorised person within the objective, and any material change automatically reopens review.