NIS2 DECIDE — Accountability, Risk and Decision for Boards

Course overview

Portugal’s Cybersecurity Legal Framework gives the management body responsibilities it cannot delegate. This programme helps directors separate what they must decide from technical execution, ask their teams for the right information and organise evidence of the decisions taken. It follows Decree-Law 125/2025 and Regulation 756/2026, using practical cases, the NIS2 Executive Dossier and, where useful, the Cybersecure platform.

What you will learn

• Understand how the Cybersecurity Legal Framework affects the organisation’s governance.
• Identify the decisions and approvals that belong to the management body.
• Distinguish executive accountability from technical execution.
• Assess residual risk, exceptions and investment priorities.
• Decide on critical dependencies and suppliers when evidence is insufficient.
• Organise decisions and evidence in the NIS2 Executive Dossier and set 30, 60 and 90-day priorities.

Programme

1. Session 1What being in scope changes
2. Session 2Governance, residual risk and oversight
3. Session 3Dependencies and critical suppliers
4. Session 4Incidents, authorities, oversight and defending decisions