MyCiber registration starts with 60 working days: See here

ANDthis is the first regulation “which stems from the new Cybersecurity Legal Regime (...) and comes to densify a number of aspects that are structuring for implementation by organizations, but also by the competent cybersecurity authorities of this legal regime”, framed Lino Santos.

Establishes the operation of the “communication platform with the entities concerned” – myciber.gov.pt – and this phase”of self-identification, qualification and registration takes place within the next 60 working days”, also starting from “a deadline” of implementation of the set of minimum measures “assigned to them at the time of qualification, for which it has 24 months to adapt and to comply”, explained CNCS coordinator.

At this stage, “the entities are obliged to declare themselves before this platform, before the competent authorities, that they meet a set of requirements to be qualified either as essential entities or as important entities, or as relevant entities of the Public Administration,” Lino Santos said.

These different types of qualification determine a degree of requirement or a set of minimum security measures that have to be implemented within the next 24 months.

“ We expect about 6,000 entities covered by this new legal regime, compared to 450 that we had in the previous one,” he said.

This is “the first step in a path” to comply with the Cybersecurity Legal Regime, which aims to ensure that the essential and critical services that organizations provide “have a high level of cybersecurity”.

Even because “we have a complex framework of threats ranging from state threat agents, cybercrime agents or even cyberspace activists, to challenges that are posed by disruptive technologies,” such as generative artificial intelligence (IA).

The objective is that the set of measures that the different entities have to implement “reduce to the acceptable level the risk to which they are exposed”.

In the meantime, CNCS has prepared a set of instruments to support them in this process.

In addition to this 60-day working-day phase, there is “a set of clarification sessions, of workshops” and also “a set of instruments that we are developing, even within the framework of the RRP, to help organisations for which this process is completely new”, he stressed.

For example, the provision of a free tool for organizations to carry out risk analysis.

“ We are adapting our offer at the cybersecurity academy to this new legal regime for cybersecurity”, as well as working with cybersecurity skills centers, asserted Lino Santos.

“ We are producing guides and ‘templates’ on the minimum measures required, “in a logic of supporting entities during these next 24 months,” he stressed.

The new Regulation contains the functionality of the MyCiber electronic platform and a set of structuring instruments, including the National Cybersecurity Reference Framework (QNRCS).

“One of the novelties that this regime brings is the possibility for entities to obtain a certificate of compliance” with the QNRCS “or with the digital maturity seal on the cybersecurity component,” he said.

This is an “important instrument because it allows the entity’s side and, above all, the person responsible for cybersecurity for the company’s administration to have some comfort that it is fulfilling legal obligations” in this regard.

“ This framework is extremely important because it defines what good cybersecurity practices are” in Portugal.

Another important instrument is “the sets of minimum measures to which entities are required, i.e. a substantial difference from the previous legal regime”.

Previously, the obligation “was for them to carry out a risk analysis and then implement measures that they considered sufficient and appropriate to mitigate the identified risks”, which “was an extremely vague process”, with little predictability.

This model is “more prescriptive”, taking into account “the size of the entity and the level of risk that we set for that sector of economic activity”, so “predicts the success of much of these attacks,” he said.

Lino Santos highlighted that this work was carried out during the last year in a “strong collaboration”, involving the academy, the different sectoral communities.