The impact of legislation and the role of tailored solutions
Legislation has strengthened responsibilities. Effective protection requires decisions, well-managed technology, and prepared people. For Portuguese businesses, including those in the Algarve, the challenge is to turn these requirements into capabilities that work every day.
When a company loses access to bookings, invoicing, or customer documents, its operations are affected. A compromised account, a fraudulent payment instruction, or an unavailable application can be enough to interrupt business. That is why cybersecurity belongs in decisions about continuity, investment, and how work is organized.
At Cyberprotech®, we approach cyber(in)security through this practical reality: understanding what could fail, what the impact would be, and what needs to be done to reduce risk. The response should fit the company, its people, and its ability to keep the measures working.
International concerns help frame the question
IT Insight's October 30 report states that 41% of technology leaders surveyed identify cybersecurity as their greatest concern and that 78% plan to increase investment in this area. These are international findings attributed to Experis' CIO 2026 Outlook, not a measurement of Portuguese businesses. [1]
Experis' public report confirms a relevant tension: 72% of respondents consider their risk strategy aligned with organizational readiness, compared with 77% in 2025. The survey covered 1,930 technology leaders in 12 countries. These indicators describe perceptions and intentions; they are not an audit of control effectiveness. [2]
For a business, the useful question is specific: does its investment already enable it to detect a problem, make a decision, and recover operations within the time the business needs?
Portugal has made progress, but gaps remain
According to INE data published by Pordata, SMEs represented 99.9% of Portuguese businesses in 2024, and microenterprises 96.1%. An approach suited to Portugal must therefore work for small organizations with limited resources and people holding multiple responsibilities. [3]
The CNCS report Cybersecurity in Portugal — Society 2025, published in April 2026, shows progress in the adoption of measures. For example, reported use of authentication with at least two factors increased from 28% in 2022 to 36% in 2024, still below the European Union average of 40%. [4]
This indicator covers incorporated non-financial enterprises with at least 10 employees in the sectors covered by the INE/Eurostat survey. It does not describe all businesses or allow an estimate of the situation of microenterprises. It does show that basic access protection was still far from universal within that survey population. [4]
Our interpretation is that there is room for practical improvements before complex projects: organizing accounts and permissions, protecting email, patching exposed systems, checking backups, and establishing who makes decisions when an incident occurs. Priorities should follow an assessment.
Business continuity matters particularly in the Algarve
INE's 2024 data published by BeAlgarve identify 98,598 businesses in the region, including 95,280 microenterprises. Tourism is also significant: according to Turismo de Portugal, the Algarve recorded 20.8 million overnight stays in 2025, with a seasonality rate of 40.8%, representing the share of July, August, and September in the annual total. [5][6][7]
The operational implication is clear: a failure in booking, reception, or invoicing systems during a busy period can affect service and revenue. This dependence justifies preparing for continuity. These figures do not establish that the Algarve experiences more attacks than other regions.
Businesses that hire seasonal staff should prepare onboarding and offboarding, assign individual access, and provide training before people start work. Accommodation businesses should also assess separation between guest, administration, and equipment networks, along with providers' remote access.
The same reasoning applies to other sectors. A real estate agency needs to validate payment instructions; an accounting practice needs to protect documents and deadlines; a clinic depends on application availability and information confidentiality. These are examples of needs to assess, not findings from an audit of businesses in the region.
What legislation has changed
The obligation to protect information already existed. The GDPR requires technical and organizational measures appropriate to the risk when processing personal data. In 2023, the CNPD provided further security guidance, including organization, access, recovery, and prevention. NIS2 adds a broader cybersecurity framework for entities within its scope. [8][9]
In Portugal, Decree-Law No. 125/2025 of December 4 transposed NIS2 and entered into force on April 3, 2026. The framework broadened the range of regulated entities and strengthens management's role in approving and overseeing measures, regular training, and proportionate risk management. External support does not replace management's own legal responsibilities. [9]
Regulation No. 756/2026 of June 22 detailed procedures for self-identification and qualification, incident reporting, frameworks, and conformity levels. Implementation is phased: certain provisions take effect on June 22, 2028, under Article 10(2) of the decree-law. This does not suspend the entire framework until that date. [9][10]
The initial MyCiber self-identification deadline was September 15, 2026, for entities already operating and subject to that obligation. Each organization should confirm its scope and address any applicable outstanding requirements. Registration is a step in the process; it is not security certification. [11][12]
Applicability depends on the sector, size, services provided, and statutory exceptions. Not all SMEs are directly covered. A hotel or restaurant is not automatically covered simply because it uses technology. [9][12]
Even outside the direct scope, a business may face contractual requirements from customers that need to manage supplier security. This commercial relationship should be distinguished from direct legal obligations. In either case, applicable data protection duties and the business's own continuity needs remain. [8][9]
What still needs to change in practice
The law has changed responsibilities and compliance mechanisms. Data from before it entered into force cannot demonstrate that this change has already made businesses more secure. That assessment requires tracking outcomes over time.
For Cyberprotech®, change should be visible in daily work: unnecessary accounts removed, updates tracked, recovery tested, suspicions reported, and response decisions practiced. An approved policy becomes useful when people know how to apply it and can do so in real working conditions.
Management can start by seeking answers to five questions:
Implementation also needs to be accessible to smaller organizations: clear guidance, proportionate specialist support, and training that fits their schedules and roles. Work should be phased, with defined priorities and owners, while maintaining applicable legal requirements.
- Which services cannot stop, and how long can we operate without them?
- Who has access to systems, and who reviews those permissions?
- When was data recovery tested, and what remains unresolved?
- Who receives, analyzes, and escalates security alerts?
- Who decides and communicates in the event of fraud, unavailability, or information loss?
People continue to make a difference
The human factor includes those who serve customers, authorize payments, administer systems, and decide budgets. Each person's preparation influences the ability to recognize an unusual situation and act in time.
Consider an urgent request to change a supplier's IBAN. Protection should combine email security, appropriate permissions, and a verification procedure using an already known contact. The employee needs to know how to check and be authorized to pause the payment while clarifying the request.
This is the combination we recommend: controls that reduce the likelihood of error, procedures that are easy to follow, and people who feel free to report suspicions. Training should use situations from the business itself and be reinforced when employees join, tools change, or new risks emerge.
Management should practice too. During an interruption, someone will need to decide priorities, activate alternatives, coordinate suppliers, and communicate with customers. An exercise helps reveal uncertainties and dependencies before those decisions are needed in a real situation.
At Academia Cyberprotech®, training is designed around roles, risks, and context. It can be individual or for teams, in person, live online, or hybrid, with exercises and assessment. The aim is to prepare decisions and behaviors that can be applied at work. [13][14]
How Cyberprotech can help
Our work starts with understanding the organization: its activity, essential systems, data, people, suppliers, available resources, and applicable obligations. We then propose a combination of services, technology, training, and ongoing support with defined objectives. [15]
Assessment and guidance for management
We support risk identification, configuration reviews, prioritization, and action planning. Compliance, data protection, and CISO Advisory/vCISO support can help management and internal owners make decisions and maintain evidence within the agreed scope. [15]
Suitable equipment and infrastructure
When the assessment justifies it, the response may include firewalls, Wi-Fi networks separated by use, switches, storage, servers, power protection, or alternative connectivity. Value depends on sizing, configuration, maintenance, and integration with operations. We also assess what can be retained from the existing infrastructure. [16]
Ongoing protection and management
Managed services may cover computers and servers, access management, updates, Microsoft 365, email, and backups. We define the scope and the testing needed to align recovery with business priorities. [15]
Monitoring with defined analysis and response
Availability and performance monitoring helps track operations. Security monitoring collects relevant signals, analyzes them, and escalates situations requiring intervention. Coverage, operating hours, response times, and authorized actions should be clear in the contracted service. [17][18]
An alert needs a recipient, analysis criteria, and a possible action. Human analysis connects technical signals to the company's activity and guides the next decision. The value of ongoing support is also measured by faults corrected, detection quality, and readiness to respond.
Training adapted to people
A reception team, a finance department, and a technical team face different decisions. We adapt language, examples, and exercises to each role, including new employee onboarding and management preparation. Assessment helps identify uncertainties and guide further reinforcement. [13]
What a tailored solution means
A tailored solution should make choices visible: what to protect first, what equipment is needed, what training to deliver, what to monitor, and how to track outcomes. These examples illustrate possible combinations:
The final choice depends on the assessment. One business may start by fixing access and testing recovery; another may need to renew its network and arrange operational support. Progress should respect risk and implementation capacity while preserving applicable minimum requirements.
Progress can be measured through simple indicators: critical accounts protected, access reviewed, patches outstanding, recoveries completed, and training applied. Management can then understand the state of protection and the work still needed.
| Context | Priorities to assess | Outcome to verify |
|---|---|---|
| Services SME or accounting practice | Email, MFA, permissions, updates, backups, and payment verification. | Access reviewed, recovery tested, and procedures understood. |
| Hotel or accommodation business | Bookings, separate networks, seasonal accounts, suppliers, and reception preparation. | Critical service recovery tested and access reviewed when staff join and leave. |
| Clinic or care provider | Role-based access, confidentiality, essential applications, and supplier coordination. | Information available to authorized users and recovery practiced. |
Start with what your business needs to protect
Cyberprotech®, based in Loulé, can help turn security and compliance needs into an actionable plan, with services, equipment, training, and monitoring adapted to the organization. [19]
The first step is to identify what needs to keep working, which data must be protected, and who makes decisions every day. With that context, priorities can be set and improvement tracked.
Talk to us to assess your company's needs and build a tailored response.
cyberprotech.pt/en/contact/ | info@cyberprotech.pt | +351 289 413 001