In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first steps01What it is
NIS2 raises the cybersecurity baseline for entities in sectors the Union regards as essential or important, and — unlike its predecessor — attaches duties to the management body personally.
Two features change how organisations have to respond: the 24-hour early warning, which is shorter than the GDPR's 72 hours and starts on a different trigger; and the supply-chain obligations, which reach suppliers that are not themselves in scope.
02Who it applies to
Entities in the sectors listed in Annex I (energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space) and Annex II (postal, waste, chemicals, food, manufacturing, digital providers, research), above the size thresholds — with exceptions that bring smaller entities into scope regardless.
Scope is wider than most organisations assume, and the Portuguese transposition adds registration and reporting detail.
03Core obligations
04Timeline
05Where it meets the other regimes
NIS2 ↔ GDPR — two clocks, one incident
NIS2 counts 24 hours from awareness of a significant incident. The GDPR counts 72 hours from awareness of a personal data breach. An incident can be significant under NIS2 without involving personal data, and can be a personal data breach without being significant under NIS2. The assessment has to be made against both, in the first hours, on incomplete facts.
NIS2 ↔ CRA
The CRA adds a third reporting duty on the same 24-hour rhythm, for actively exploited vulnerabilities and severe incidents in products with digital elements. An entity that both operates in a NIS2 sector and manufactures products may face both duties for the same event, with different recipients.
NIS2 ↔ DORA
DORA is lex specialis for financial entities. Where DORA applies, it displaces the equivalent NIS2 requirements — but the boundary is not always obvious, particularly for ICT providers serving both financial and non-financial customers.
06What we are instructed on
NIS2 scope analysis, governance and board duties, risk management measures, supply-chain obligations, incident notification, and engagement with the CNCS.
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.