The regulation implementing the Cybersecurity Legal System, which defines how the diploma is applied in Portugal, was approved by the National Cybersecurity Center (CNCS) and was published today in Diário da República (DRE).
© Shutterstock
22/06/2026
by
Lusa
O regulation no 756/2026 approves the rules on the functioning of the electronic platform, including the self-identification and qualification of entities, and the rules on mandatory notifications of cybersecurity incidents or voluntary notifications of relevant information, reads in the document.
It also includes rules on communications between entities and the competent cybersecurity authority, including the annual report, the cybersecurity officer, the permanent contact point, among other matters such as the National Cybersecurity Reference Framework (CNRCS), which is the national reference instrument for identifying existing standards, standards and good practices in the management of Cybersecurity and Security Information.
The document lays down the rules for the application of the new Cybersecurity Legal Regime, defining how it is implemented in Portugal following the transposition of the European Directive on the security of information networks and systems NIS2 [Network and Information Systems].
Decree-Law No 125/2025 of 4 December approved the Cybersecurity Legal System, transposing Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December to ensure a high common level of cybersecurity throughout the Union, and applicable to relevant key, important and public entities, with the framework and boundaries provided for by the same legal regime.
The regulation published today applies to relevant key, important and public entities, in accordance with and within the limits laid down in the Cybersecurity Legal System.