Cybersecurity compliance
NIS2 and MyCiber support for companies
Regulation no. 756/2026, the Portuguese Cybersecurity Legal Framework, and the MyCiber platform raise a practical question for many companies: what should we do now? eluis.pt helps organise information, prepare registration, map assets, and turn cybersecurity obligations into clear technical next steps.
First step: understand whether registration applies
The first task is not to install random tools. The practical advice is to start by registering the company on the MyCiber platform and, after receiving the response for that concrete case, understand whether NIS2 obligations apply and what technical preparation makes sense.
- Review the company's concrete situation
- Organise data needed for registration
- Support the legal representative or authorised person
- Review the response received before defining next steps
Deadlines that should not be ignored
According to information published by CNCS, MyCiber availability activates relevant deadlines: 30 or 60 business days for identification and registration depending on when the entity started activity, 20 business days to communicate the cybersecurity responsible person and permanent contact point after final qualification, and 24 hours for initial notification of significant incidents.
From registration to technical preparation
After the response and qualification that applies to the concrete case, the company can prepare asset inventories, publicly accessible asset lists, incident notification processes, evidence, technical measures, and a realistic improvement plan.
- Inventory and list of Internet-exposed assets
- Cybersecurity responsible person and contact point
- Incident notification and logging workflow
- Measures, evidence, and follow-up plan
What eluis.pt can do
This is technical and organisational support. It does not replace legal advice, a decision by the competent authority, or official interpretation. It helps the company approach the process with data, better questions, identified assets, and a clearer execution path.
Frequently asked questions
Is MyCiber registration the first thing to do?
For covered entities, registration is the operational starting point. After the response and qualification that applies to the concrete case, it becomes clearer which technical and organisational obligations should be prepared.
Does eluis.pt provide legal advice?
No. eluis.pt can help organise technical information, assets, processes, and evidence. Legal questions should be validated with a lawyer or the competent authority.
Is this only for large companies?
It should not be treated that way. The practical advice is that any company with doubts should start by registering on MyCiber. After the email response for the company's concrete case, it becomes clearer whether NIS2-related obligations need to be applied.
What data should we prepare?
It usually makes sense to gather entity details, the legal representative or authorised person, permanent contacts, services provided, critical systems, suppliers, Internet-facing assets, and any existing incident or security processes.
Tell us about your project.
Need a homepage, web application, online store, automation, integration, or AI solution? Talk to eluis.pt and explain what you want to create.