Cybersecurity Officer
Regulation
The map of the rules that frame the role.
Regulatory map
Applicable instruments
| Instrument | Subject | Relevant provisions |
|---|---|---|
| Decree-Law 125/2025 | Portuguese Cybersecurity Act | Articles 6 and 7, 25, 27, 31 and 32, 40 to 44 and 61 to 65 |
| Directive (EU) 2022/2555 | NIS 2 | Source of the national regime |
| Regulation (EU) 2024/2847 | Products with digital elements | Article 14, applicable since 11 September 2026 |
| Regulation (EU) 2022/2554 | DORA, financial sector | A cumulative sectoral regime |
| GDPR and Law 58/2019 | Personal data protection | Articles 32 to 34 GDPR, where the incident involves personal data |
Informative summary. Always check the official text in force.
An appointed role is not yet a role performed
Start by checking your organisation scope or ask for a proposal to structure the role.