Does the NIS2 Directive Apply to Your SME in Portugal?
Compliance · By Equipa ONEGEST ·
Discover if your business is directly or indirectly covered by the EU NIS2 cybersecurity directive in Portugal and what technical steps you need to take.
The EU NIS2 Directive directly applies to medium and large organizations in Portugal—specifically those with 50 or more employees or over 10 million euros in annual revenue—that operate in key economic sectors. However, smaller companies are frequently affected indirectly because covered entities are legally required to secure their entire supply chain. If your SME acts as a technology supplier, maintenance partner, or service provider to larger corporate or public entities, you must meet strict cybersecurity standards to keep your commercial contracts.
What is the NIS2 Directive and why does it matter in Portugal?
The NIS2 Directive (EU Directive 2022/2555) is the updated legislative framework established by the European Union to raise the standard of cybersecurity across all member states. Replacing the original 2016 NIS regulations, NIS2 expands the list of regulated industries, mandates stricter risk management policies, and introduces direct accountability for corporate management.
In Portugal, national oversight aligns with authorities such as the National Cybersecurity Centre (CNCS). The primary objective is to safeguard critical infrastructure and economic activities against severe disruptions, cyberattacks, and ransomware threats.
Who is directly covered by NIS2 regulations?
To determine if your business falls directly within the legal scope of NIS2, you must evaluate both your company size and your industry sector.
As a baseline rule, organizations are directly covered if they meet the threshold for medium or large enterprises:
- Staff count: 50 or more full-time employees;
- Financial turnover: Annual turnover or total balance sheet exceeding 10 million euros.
Size criteria alone do not tell the whole story. Certain organizations are classified under NIS2 regardless of their size if an operational disruption would cause significant systemic risk. This includes managed service providers (MSPs), electronic communications service providers, and sole suppliers of critical national infrastructure.
What is the difference between Essential and Important entities?
NIS2 divides regulated organizations into two distinct regulatory tiers: Essential Entities and Important Entities. The main distinction lies in how authorities supervise compliance and the maximum scale of administrative fines.
| Evaluation Criterion | Essential Entities | Important Entities |
|---|---|---|
| Sectors Included | Energy, Transport, Banking, Healthcare, Drinking Water, Digital Infrastructure, Public Administration. | Postal Services, Waste Management, Food Production, Chemical Manufacturing, Managed IT Services. |
| Company Size Profile | Large enterprises or key operators in high-criticality sectors. | Medium-sized enterprises operating in regulated sectors. |
| Supervision Model | Ex-ante (proactive and continuous oversight with regular audits and inspections). | Ex-post (reactive oversight triggered by evidence of non-compliance or reported security incidents). |
| Maximum Financial Penalties | Up to 10 million euros or 2% of total worldwide annual turnover. | Up to 7 million euros or 1.4% of total worldwide annual turnover. |
How can your SME be affected through supply chain rules?
Even if your company has fewer than 50 employees and earns under 10 million euros annually, you are not immune to the business impacts of NIS2. A core pillar of the directive requires essential and important entities to assess and guarantee security across their entire supply chain network.
If your SME provides software, managed services, transportation, equipment repair, or consulting to covered entities, those corporate clients will demand formal proof of your security posture. To retain major accounts and bid for public contracts, smaller businesses must implement managed cybersecurity services and structured backup and disaster recovery solutions.
What technical and organizational measures are required?
NIS2 shifts the focus from basic compliance checklists to proactive risk management. Organizations within scope must deploy standard security practices, including:
- Risk analysis and security policies: Regular assessment of vulnerabilities across hardware, cloud networks, and remote endpoints;
- Incident handling and response: Clear procedures to detect, contain, and report cyber security breaches rapidly;
- Business continuity plans: Regularly tested data backups and disaster recovery workflows to maintain operations during an outage;
- Supply chain security: Vetting third-party vendors and enforcing baseline security requirements;
- Access control and encryption: Mandatory multi-factor authentication (MFA) across business systems and data encryption at rest and in transit;
- Cybersecurity awareness training: Continuous education for staff members to spot phishing attempts, social engineering, and unauthorized access.
Maintaining these controls consistently can place a heavy burden on internal resources. Many SMEs rely on dedicated IT support and outsourcing to handle daily monitoring, patch management, and security maintenance on a fixed monthly budget.
How does NIS2 change executive liability?
Under NIS2, executive management boards and company directors can no longer treat cybersecurity purely as an internal IT issue. The directive establishes direct legal responsibility for corporate management.
Business owners and executives are explicitly required to approve all cybersecurity risk-management frameworks, oversee implementation, and attend mandatory security training. In cases of gross negligence following a major breach, regulatory authorities hold the power to impose personal fines or temporarily suspend executives from management roles.
How to prepare your business in 4 practical steps
- Determine your standing: Evaluate your revenue, head count, and supply chain exposure to see if key client contracts require NIS2 compliance.
- Perform an IT gap assessment: Inspect your company’s workstations, servers, email systems, and remote access setups for security flaws.
- Implement core technical safeguards: Deploy Managed Endpoint Detection and Response (EDR), enforce strong MFA, and establish secure offsite cloud backups.
- Document procedures and train staff: Establish formal incident response protocols and educate your team on cyber hygiene.
Frequently asked questions
When does NIS2 compliance take effect in Portugal?
The NIS2 framework is active across the EU. Regulated entities and their key suppliers must adapt their security measures immediately, as major corporate clients are already updating vendor requirements to meet compliance deadlines.
Can a small SME with fewer than 50 employees be legally forced to comply?
While small businesses under the threshold are generally exempt from direct legal oversight, they can be contractually required to comply if they serve as suppliers or vendors to an essential or important entity.
What is the mandatory reporting timeline for a security incident?
The directive requires a phased reporting approach: an initial early warning alert must be submitted to the competent national authority within 24 hours of incident detection, followed by an official notification within 72 hours.
What technical tools help fulfill NIS2 requirements?
Comprehensive Endpoint Detection and Response (EDR), managed cloud backups, network firewalls, encrypted communication, and certified electronic signature platforms help maintain the technical compliance required under European regulations.
Getting your business compliant with EU security regulations does not have to be complex or disruptive. Through our specialized NIS2 & compliance advisory service (available starting at a fixed cost of €1,200), ONEGEST evaluates your technical gaps and deploys the necessary safeguards to protect your operation. Contact our technical team today to schedule a free 20-minute initial diagnostic.