// NIS2 · DL 125/2025
NIS2 in Portugal: what Decree-Law 125/2025 means for your OT network.
Portugal transposed the NIS2 directive through Decree-Law 125/2025, which sets out the new Cybersecurity Legal Regime. For anyone running a plant, the practical question is: can you show what is on your industrial network, how it is separated and who has access to it?
The essentials
- Decree-Law 125/2025 was published on 4 December 2025 and has been in force since April 2026.
- CNCS Regulation 756/2026, published on 22 June 2026, sets out how it applies: the registration platform, incident notification and cybersecurity measures.
- Registration of in-scope entities, appointing a cybersecurity officer, a permanent point of contact and incident notification already apply.
- The technical risk-management measures take effect on 22 June 2028. That is the deadline to have things in order.
Who is in scope in industry
The regime applies to essential and important entities in sectors such as energy, transport, water and wastewater, waste management, chemicals, food production and distribution, and several manufacturing sectors. Classification depends on sector, activity and company size.
Many companies outside the direct scope will still feel it through their customers: in-scope entities must manage supply-chain risk and will ask their suppliers for evidence.
What it means for the OT network
The law does not mention PLCs or VLANs, but the risk-management measures translate into very concrete questions on the plant floor:
- Is there an up-to-date inventory of OT assets and communication flows?
- Is the industrial network separated from the corporate network, with controlled traffic between zones?
- Is vendor remote access done with identity, approval and logging?
- Can you detect changes and incidents on the industrial network in time to report them?
- Is there a prioritised action plan and evidence management can present?
Responsibility sits with management. What management needs is a clear answer to these questions and a realistic plan to 2028.
Where to start
- 1. Confirm how your entity is classified (essential, important or out of scope) with appropriate legal support.
- 2. Build an accurate picture of the OT network: inventory, flows and risks. That is what the OT network assessment delivers.
- 3. Address vendor remote access and IT/OT separation first, as they are usually the most direct risks.
- 4. Make sure there is enough visibility to detect and report incidents.
- 5. Turn it all into a phased plan with evidence for management and for CNCS.
What we do not do
We do not give legal advice or formally determine your entity's classification. We handle the technical side of the IT/OT network, working alongside your legal advisers, cybersecurity officer and integrator.
Frequently asked questions
Does NIS2 already apply in Portugal?
Yes. Decree-Law 125/2025, which transposes NIS2, has been in force since April 2026. Some obligations already apply, such as registration and incident notification, and the technical risk-management measures take effect on 22 June 2028.
Is my plant in scope?
It depends on sector, activity and size. Manufacturing, chemicals and food are among the sectors covered. Formal classification should be confirmed with legal support and through the CNCS platform.
We supply an in-scope entity. Does this affect us?
Probably, indirectly. In-scope entities must manage supplier risk and tend to ask for evidence on remote access, segmentation and incident handling.
Where do we start on the OT network?
With an inventory and risk analysis of the industrial network, followed by control of vendor remote access and IT/OT separation. Those steps have the most effect and are the easiest to demonstrate.
Sources
General information, not legal advice.
Last updated: November 2026.