NIS2: security managed by Sevways
For companies in scope of Portugal's Cybersecurity Legal Framework and for the suppliers they ask for assurances. We assess where the company stands, handle the measures in the day-to-day operation of the systems we manage and add, when needed, a 24x7 security operations centre.
- Legal Framework for Cybersecurity, the transposition of NIS2 in Portugal
- DL 125/2025
- monitoring and incident response in a security operations centre
- 24x7
- cybersecurity services we add to operations
- 6
- 01
Assessment first
Where the company stands against the NIS2 measures, before buying tools.
- 02
24x7 SOC
Monitoring, detection and incident response, day and night.
- 03
Evidence ready
Tested backups, reviewed access and logs to show the auditor.
In summary
- What it is
- Support for NIS2 compliance and managed security for the company's systems.
- Who provides it
- Sevways, with the assessment and day-to-day operation; the SOC and penetration testing with a cybersecurity partner.
- Law in Portugal
- Decree-Law 125/2025, supervised by the National Cybersecurity Centre.
- Who it is for
- Covered entities and the suppliers they ask for security assurances.
Who it is for
Covered entities
Companies classified by the CNCS as essential or important, with obligations for risk management and incident notification.
Suppliers to covered entities
Companies receiving security questionnaires and new contract clauses from their clients. There is no NIS2 certification for suppliers: the answer is measures and evidence.
Ports, logistics and industry
Sectors where NIS2 reaches operations: quay systems, warehouses and factories connected to the ERP.
Groups with companies in Africa
NIS2 is a European directive, but the Angolan and Mozambican subsidiaries of covered groups receive the same requests from the parent company.
Cybersecurity services
We propose them when the assessment shows they are needed and add them to day-to-day operations.
360 Security & Compliance
Assessment of security posture and compliance with NIS2 and DORA, definition of controls, a plan and follow-up.
SOC and MDR
24x7 monitoring, detection and incident response, by a specialist team that works as an extension of yours.
Penetration testing, Red and Purple Teaming
Simulated attacks to validate defences, find weaknesses and train the response.
Identity security
Protection of accounts and access, the most common entry point for attacks.
Cyber intelligence and risk
Exposed credentials, internet-facing assets and threats targeting the sector.
DPO and CISO as a service
Data protection and information security officers for those who do not have them on the team.
Where Sevways comes in
NIS2 measures are also met in the day-to-day running of the systems we already operate.
Access and authentication
Multi-factor authentication and periodic review of accounts and access to the ERP and Microsoft 365.
Firewall and VPN
Managed firewall and VPN-only access to the servers.
Tested backups
Daily backups, replication of critical systems and recovery tests with a report.
Answers to clients
We answer security questionnaires about the systems we operate, with the evidence for each measure.
Incidents
When there is an incident on the systems we operate, we gather the information the notification to the CNCS requires.
How it starts
- Scopewhether the company is covered, supplies a company that is, or bothone meeting
- Assessmentexisting measures, gaps and priorities
- Planwhat is handled in day-to-day operations and what needs cybersecurity servicesfixed in the assessment
- Operation and evidencemeasures in place and logs ready for auditongoing
The Sevways cloud runs in data centres of NOS Empresas and Claranet Portugal, part of the NOS group since 2025. The physical infrastructure is certified; the servers, operations, ERP and support are Sevways'. The security operations centre and penetration testing are provided with Claranet Portugal.
Frequently asked questions
How do I know if my company is covered?
The CNCS notifies the entities it classifies, through the MyCiber platform. The company's sector and size are the first criteria.
Is there a NIS2 certification?
Not for suppliers. Covered entities request measures and evidence by contract. ISO 27001 is a recognised way to organise them.
Does NIS2 apply in Angola?
Not directly: it is a European Union directive. Angolan companies in covered European groups still receive the requests from the parent company.
Find out where you stand on NIS2
We start with the scope and the measures already in place.
Got a project? Let us talk.
Answer within 24 working hours.