On 4 December, Decree-Law 125/2025 was published, establishing
the new legal framework for cybersecurity (the "Cybersecurity
Legal Framework" or "CLF"), following its approval
by the Council of Ministers and subsequent promulgation by the
President of the Republic.
The decree transposes Directive (EU) 2022/2555 of the European
Parliament and of the Council of 14 December 2022 on measures to
ensure a high common level of cybersecurity across the Union
("NIS 2 Directive"), thereby strengthening the national
capacity to prevent and respond to cyber threats.
The long-awaited Cybersecurity Legal Framework clarifies the
obligations of each covered entity. It also defines the processes
for implementing and improving information security management
systems, which can now be implemented in compliance with the
obligations arising from the transposition.
