For years, the answer was simple: passwords should be changed regularly.

Many companies have implemented mandatory change policies every 30, 60, or 90 days, believing that this was the best way to reduce the risk of unauthorized access.

Later, new recommendations emerged that questioned this practice. The explanation was simple: when people are forced to change their passwords frequently, they end up creating small variations of the previous one, making them more predictable and, consequently, less secure.

So, in the end, what is the correct answer?

The truth is that the way we manage words is again evolving.

Today, the question is no longer just “How often should your password change?”, But yes “who is managing their credentials?”

The problem was never changing the pass words. For a long time, the biggest challenge has always been the human factor. When an employee needs to memorize dozens of words to be able to use them in different applications, it’s natural for them to look for simple solutions:

• Reusing the same password across multiple services.
• Create small changes to the previous password.
• Use combinations that are easy to remember.
• Store passwords in spreadsheets, documents, or even notes next to the computer.

None of these practices contributes to a safer company.

In reality, the problem was never the change in the passwords themselves. The problem was requiring that people create them, memorize them, and remember them.

Technology has changed the rules

Today there are solutions capable of automatically generating extremely long, random and unique passphrases for each application or service.

Instead of simple or easy-to-memorize words, it is possible to use credentials composed of dozens of characters, practically impossible to guess or decode through automated attacks.

More importantly, these passwords no longer depend on the user's memory.

They are securely stored in an encrypted digital safe, accessible only to authorized users.

Thus, the need to resort to simple passwords disappears simply because they are easier to remember.

So it makes sense to change them again?

When the password is generated automatically, it is unique to each system and is protected by a digital vault; its periodic renewal no longer represents an inconvenience for employees.

On the contrary, it becomes another layer of protection.

In this model, companies can implement credential renewal policies without relying on the creativity or memory of users.

The process becomes automatic, secure and practically transparent for those who work daily.

Each access must have a different password

One of the biggest risks remains the reuse of passwords.

Imagine that a collaborator uses the same credentials in email, ERP, billing platform, and an external service.

If just one of these services suffers a data breach, all the other accounts are potentially compromised.

By using unique passphrases for each platform, this risk is significantly reduced.

Even if a credential is exposed, the impact is limited to that service.

Multi-factor authentication remains indispensable

Regardless of the quality of the passwords used, multifactor authentication (MFA) remains one of the most effective measures for protecting access.

By requiring a second authentication factor, such as a mobile application or a security key, the company adds an additional barrier that significantly hinders access by unauthorized users.

The best strategy is to combine robust passphrases, centralized credential management, and multi-factor authentication.

Security policies are also evolving

As with any technology, good cybersecurity practices also evolve over time.

What made sense ten years ago is certainly not the most effective approach today.

Organizations that follow this evolution do not limit themselves to creating more complex passwords. They rely on smarter processes, reduce human intervention, and use tools that allow them to manage credentials in a centralized and secure way.

Rather than forcing employees to memorize difficult passwords, the goal is to create a system where security no longer depends on people's memory.

The future of credential management has already begun

The words pass continue to be one of the main gateways to business systems.

Therefore, the question no longer just remained “when should the word ”passe’ be changed?”

The most important question is: Does your company still manage passcodes the same way it did ten years ago or has it already adopted a safer and smarter approach?

Because in cybersecurity, protecting access doesn’t just depend on the strength of a password; it also depends on how the entire organization manages its credentials.

Quer perceber se a gestão de palavras-passe da sua empresa acompanha as melhores práticas atuais? Agende uma conversa com o João Mota através do: https://calendly.com/joaomotaquantinfor/30min and discover how to strengthen access security without increasing complexity for employees.

October is the European Cybersecurity Month, This initiative, which is held every year, seeks to raise awareness among companies and citizens about the importance of safer behaviors and systems.

It is a good opportunity to talk about cybersecurity. But also to pose a simple question:

Is your company really prepared to handle a security incident?

Because security should not be a concern only in October. And a company's protection cannot depend on a single action.

Cybersecurity is often perceived as a technical issue, when in reality it is not that different from the security measures that we take for granted in our daily lives.

Think about the entrance door of your company.

You don't close it because you know that someone will try to enter. You close it because recognizes that this possibility exists and takes, in advance, a measure to reduce the risk.

The same thing happens when we service our car; we have a fire extinguisher or keep copies of important documents.

We don't do these things because we expect something to go wrong. We do them because we know that Prevention is much simpler than solving a problem after it has occurred..

In cybersecurity, the logic is exactly the same.

Today, protecting a company goes far beyond installing a security solution or a firewall. Threats can arise through a compromised account, a phishing email, an outdated device, or a human error.

Therefore, security must be combined technology, processes and people.

Preventing it before it's too late

No one expects the car to be parked on the road to realize that they should have had it serviced.

Maintenance exists precisely to identify problems before they turn into a malfunction.

In companies, the principle should be similar.

Reviewing access, updating systems, checking equipment, testing backups, or training employees are ways to identify and reduce problems. before these have an impact on the business.

An effective strategy should allow for:

• Prevention, by reducing the vulnerable points of the infrastructure;
• Detecting, identifying suspicious behaviors or access;
• Reply, acting quickly in the face of an incident;
• Recover, ensuring that the activity and the data can be restored.

The European Cybersecurity Month could be the right time to do a simple review.

Accesses

We wouldn't give the key to our company to anyone.

Are there any old accounts or permissions that are no longer needed? Is multi-factor authentication implemented?

Equipment and systems

Performing maintenance on a device before it malfunctions is a normal practice.

In the digital environment, updating and protecting equipment should follow the same logic.

Backups

Imagine that you have important documents at home and decide to photograph them or keep a copy elsewhere.

If the originals disappear, this copy can make all the difference.

A backup works in a similar way: It doesn't prevent a problem from happening, but it can prevent it from having such an impact.

Monitoring

When a situation seems strange in everyday life, we usually try to understand what is happening before the problem escalates.

In the digital world, the logic is no different.

Is there the capacity to identify a suspicious activity before it causes a significant impact?

The sooner an abnormal behavior is identified, the greater the response capacity can be.

People

We all recognize some signs of a possible scam: an overly urgent call, a strange request, or someone pressuring us to make a decision quickly.

In the digital world, there are also signs.

Do employees know how to recognize a phishing attempt and how to act in a suspicious situation?

Training does not eliminate risk, but it can turn a person into an additional element of protection for the company.

Having a fire extinguisher doesn’t mean waiting for a fire; it means being prepared in case it happens.

In cybersecurity, the same thing happens exactly.

No company can completely eliminate the risk of an incident. Therefore, the question should not be just:

“Are we protected?”

But also:

“If something happens tomorrow, can we detect it, respond to it, and recover?”

It is this ability to continue functioning in the face of an incident that is at the heart of digital resilience.

October could be the starting point

The European Cybersecurity Month is a good opportunity to put the topic on the agenda.

Reviewing access, testing backups, updating systems, training employees, and monitoring infrastructure are measures that should be part of an organization’s routine.

Cybersecurity is not a one-time event; it is a continuous practice.

This October, instead of just talking about cybersecurity, take the opportunity to assess the security of your company.

Contact us through info@quantinfor.com e and discover how you can strengthen the protection and resilience of your business.

Entre em contacto connosco através de info@quantinfor.com and discover how you can strengthen the protection and resilience of your business.

When talking about the NIS2 Directive, the first question usually is: “Is my company covered?”

It is a relevant question, but perhaps it is no longer the most important one for your company.

In the coming years, many small and medium-sized businesses will feel the impact of NIS2 without ever receiving a notification from a regulatory body. The reason is simple: their customers will start demanding more cybersecurity guarantees from all the suppliers they work with.

That is, even if your company does not have direct obligations under the Directive, you may have to demonstrate that you adequately protect the information, systems, and processes to continue to be part of the supply chain.

Trust has become part of the business

NIS2 came to reinforce the responsibility of organizations considered essential and important in risk management. However, this responsibility does not end within their premises.

Companies are also required to assess the risks associated with the partners, suppliers, and service providers with whom they work daily. After all, it is enough for one link in the chain to be vulnerable for the entire organization to become exposed.

This reality is changing the way many companies choose their suppliers. In addition to quality, price or responsiveness, a new factor is starting to gain importance: the maturity of the company in terms of cybersecurity.

That is why requests for information about security policies, backup systems, multi-factor authentication, infrastructure monitoring, or incident response plans are starting to emerge. Not because all of these companies are required to comply with NIS2, but because their customers need to reduce the risk associated with their supply chain.

The impact could reach any sector

It is easy to think that this topic only concerns large organizations, but the reality is quite different.

An agricultural company that supplies an food industry, a manufacturer that works for a multinational company, a transport company, a service provider or a technology consultant may, at any time, be called upon to demonstrate that they adopt good cybersecurity practices.

In most cases, no one will ask them whether they comply with NIS2. What will be evaluated is whether they represent a risk to the customer’s business or not.

And that difference is important.

Increasingly, cybersecurity is no longer seen solely as a technical obligation but has become a factor of business trust. A prepared company conveys greater credibility, responds more quickly to customer requests, and positions itself more competitively when participating in new projects or tenders.

Waiting for the first order may be too late

Many organizations only start to become concerned about these issues when they receive a questionnaire from a customer or an unexpected requirement in a hiring process.

At that time, time is reduced and the necessary adjustments may prove more complex than expected. Defining policies, reviewing processes, implementing protective measures, or fixing vulnerabilities are tasks that require planning and cannot be solved overnight.

Preparing the company in advance allows it to respond more confidently to market demands and to transform cybersecurity into a differentiating factor, rather than a hasty response to a new obligation.

As has happened with quality, data protection or sustainability, information security is becoming a criterion of trust among companies.

The question, therefore, may no longer be “Is my company required to comply with NIS2?”

The real issue is quite different:

“If a customer asks me for evidence of my cybersecurity practices today, will I be prepared to answer?”

It is this response that could make the difference between continuing to be part of the supply chain or seeing a business opportunity pass to another supplier.

Quer perceber se a sua empresa está preparada para responder às exigências dos clientes e da cadeia de abastecimento? Agende uma conversa com o João Mota através do https://calendly.com/joaomotaquantinfor/30min and discover how Quantinfor can help you strengthen your cybersecurity posture.

September marks the return to routine. Teams are heading back to work, resuming projects, answering piled-up emails and looking to get back into the swing of things after the holidays.

But there is one aspect that many companies continue to put on the back burner: cybersecurity.

The truth is that the post-holiday period is one of the most favourable times to review processes, correct flaws and implement best practices. After all, if we take advantage of the return to work to set objectives, reorganise teams and plan the coming months, why not do the same with IT security?

At Quantinfor, we regularly carry out cybersecurity audits and assessments for SMEs across different sectors of activity. Despite the differences between companies, there are mistakes that crop up time and time again.

1. Updates delayed for too long

It is common to find computers, servers and network equipment with pending updates for weeks or even months.

In many cases, these updates have been postponed to avoid work interruptions. The problem is that every delayed update can represent a known vulnerability exploited by cybercriminals.

The back-to-work period is an excellent time to confirm that all systems are up to date and protected.

2. User accounts that should no longer exist

Employees who have changed roles, left the company or no longer require certain access rights often continue to maintain active accounts.

These accounts represent an unnecessary risk and could be exploited if credentials are compromised.

September is a good time to review permissions and ensure that each user has only the essential access rights.

3. Weak or reused passwords

Despite all the existing awareness, it remains common to find simple passwords or ones used across multiple platforms.

A single compromised credential can open the door to multiple company systems.

Whenever possible, implement strong passwords and enable multi-factor authentication (MFA).

4. Backups that exist… but have never been tested

“We have backups.”

This is probably one of the phrases we hear the most.

The next question usually is: “When was the last time you tested the recovery of these backups?”

The silence that follows speaks volumes.

A backup only truly protects a company when the information can be recovered quickly and with complete integrity.

5. Network-connected equipment without any monitoring

Old computers, printers, NAS drives, Wi-Fi access points or other devices remain switched on for years without any monitoring.

Every forgotten piece of equipment is a potential gateway for an attack.

Having visibility over everything connected to the infrastructure is one of the first steps to reduce risks.

6. Lack of staff training

Technology evolves, but so do attacks.

Currently, many cyberattacks begin with a simple phishing email or a seemingly legitimate message.

Without continuous training, any employee can inadvertently become the organisation's most vulnerable link.

Investing in staff awareness continues to be one of the measures with the highest return in the area of cybersecurity.

Cybersecurity is like maintaining a tractor

In the agricultural sector there is a simple rule: nobody waits for a tractor to break down in the middle of the harvest to decide to do the maintenance.

Servicing is carried out in advance because an unexpected stoppage could compromise the entire production.

The exact same thing happens with IT infrastructure.

Waiting for an incident to happen in order to discover flaws is always more expensive, more time-consuming, and much more damaging to a company's business.

Prevention remains the best investment.

What should you do upon this return to work?

Make the most of the start of September to carry out a security review for your business.

Some actions can make all the difference:

• Confirm that all equipment is up to date.
• Review user access and permissions.
• Verify the operation of the backups.
• Check if multi-factor authentication is active.
• Update the incident response plan.
• Promote awareness-raising actions among employees.
• Assess the need for continuous infrastructure monitoring.

Minor improvements implemented today can prevent major problems in the coming months.

Start the new cycle with a better protected company

Just as we do a financial review or set new goals after the summer, cybersecurity also deserves a periodic review.

The companies that manage to prevent incidents are not necessarily the ones that invest most in technology. They are often the ones that maintain consistent processes, fix small flaws before they become major problems, and continuously monitor the state of their infrastructure.

Returning from holiday is the ideal opportunity to take that step.

Want to know your company's security level? Schedule a chat with the João Mota and discover how an assessment can help identify risks before they impact your business.

https://calendly.com/joaomotaquantinfor/30min

Cybersecurity is no longer exclusively an issue for large organisations. With the rise in cyber attacks and the increasing digitalisation of businesses, Small and Medium-sized Enterprises (SMEs) are also facing new challenges and responsibilities today.

In this context, the MyCiber, the platform made available by National Cybersecurity Centre, plays an important role in the implementation of the NIS2 Directive in Portugal, enabling organisations to communicate essential information about their activity and legal framework.

But what is MyCiber after all? Who is covered? And what deadlines must companies meet?

What is MyCiber?

O MyCiber it is the online platform created by National Cybersecurity Centre which allows Portuguese organisations to interact with the national cybersecurity authority.

Through this platform, organisations can:

• Registering as entities covered by the legislation;
• Update organisation details;
• Report cybersecurity incidents, where applicable;
• Manage the obligations set out in the new legal framework of the NIS2 Directive.

In practice, MyCiber will be the main communication channel between the covered companies and the CNCS.

Why was this platform created?

The creation of MyCiber is directly related to the entry into force of the NIS2 Directive, which has significantly reinforced cybersecurity requirements across the European Union.

Automated out-of-office replies make communication with clients and partners easier, but they must be set up with some care.

Compared to the previous NIS Directive, NIS2:

• It covers a much larger number of companies;
• It introduces new risk management obligations;
• Reinforces the responsibilities of top management;
• Demand more rigorous incident reporting processes;
• It provides for higher penalties in the event of non-compliance.

In Portugal, the CNCS will be the entity responsible for monitoring the implementation of these obligations, with MyCiber being one of the fundamental tools for this purpose.

Which companies may be covered?

One of the biggest doubts companies have relates precisely to this issue.

Many SMEs mistakenly assume that NIS2 only applies to large companies or critical infrastructure. However, this reality has changed.

The Directive may cover companies of different sizes, depending on factors such as: number of employees, turnover, sector of activity and importance of the services provided.

Even companies that are not directly covered may be called upon by their clients to demonstrate adequate levels of cybersecurity, particularly when they are part of the supply chain.

Find out via the button below all the companies that are covered. In doubtful cases, it is always advisable to register on the platform.

What happens if the company is covered?

Should the organisation be deemed an entity covered by NIS2, it will have to comply with several obligations, among which:

• Implement cybersecurity risk management measures;
• Develop internal security policies;
• Define incident response procedures;
• Assess risks associated with suppliers;
• Promote employee training and awareness;
• Report significant incidents within the legal deadlines;
• Keep data up to date on the MyCiber platform.

In other words, making a registration is not enough. There is a set of ongoing responsibilities that should form part of the company's strategy.

What are the deadlines that companies need to know about?

This is one of the issues that most concerns managers.

Following the entry into operation of the MyCiber platform, entities that fall within the scope of the NIS2 Directive must proceed with their registration within the deadline defined by the CNCS.

In addition, whenever relevant changes occur within the organisation, such as changes to contact details, persons in charge or other mandatory information, these details must be updated on the platform.

Another critical point relates to the cybersecurity incident report.

The NIS2 Directive establishes very demanding deadlines for reporting significant incidents, providing for an initial notification within a short space of time after their detection, followed by supplementary reports as the investigation evolves.

For this reason, it is essential that companies have internal processes for incident detection, response and communication defined in advance.

Important: National regulation of the NIS2 Directive is still evolving. For this reason, companies must follow the guidance issued by the CNCS, as new requirements or updates to registration procedures may arise.

Is MyCiber just a registration platform?

No. Although many companies associate MyCiber only with mandatory registration, its purpose goes far beyond that function.

The platform has been designed to support the entire relationship between the covered entities and the CNCS, acting as a central point for:

• Corporate communications;
• Management of legal obligations;
• Incident report;
• Organisation information update.

Therefore, their role will become increasingly relevant as the implementation of NIS2 progresses in Portugal.

How can SMEs prepare?

Regardless of whether or not they are already covered, this is a good time for SMEs to assess their level of cybersecurity maturity.

Some priority measures include:

• Identify whether the company falls within the scope of NIS2;
• Assess existing technological risks;
• Review internal policies and procedures;
• Implement protection and monitoring solutions;
• Ensure backups are carried out;
• Regularly raise awareness among employees;
• Create an incident response plan.

The earlier these measures are implemented, the lower the effort required to adapt to the new legal requirements.

The role of cybersecurity consultancy

For many SMEs, interpreting legislation and understanding which obligations apply can be a complex process.

An expert consultancy makes it possible to determine whether the organisation falls within the scope, assess the level of compliance and define an implementation plan tailored to the company's reality. Rather than merely complying with legal requirements, it is about reducing operational risks, protecting business continuity and strengthening the trust of clients and partners.

Conclusion

The MyCiber platform represents an important step in the implementation of the NIS2 Directive in Portugal and will be a central element in the relationship between the companies covered and the National Cybersecurity Centre.

Even though many SMEs are still not sure whether they are covered, ignoring this issue could lead to future difficulties, whether through legal imposition or the demands of clients and business partners.

No Quantinfor, we closely monitor the evolution of cybersecurity legislation and help companies identify whether they fall within the scope of NIS2, implement the necessary measures and prepare to comply with the new legal obligations.

We also provide a Permanent Point of Contact service, one of the obligations provided for the covered entities, ensuring technical monitoring and continuous support in the relationship with the CNCS and in compliance with NIS2 requirements.

If you would like to understand how these obligations apply to your company or need support in adapting to NIS2, you can schedule a chat with the João Mota, CTO of Quantinfor:

https://calendly.com/joaomotaquantinfor/30min

Frequently Asked Questions (FAQ)

• What is the deadline for registering existing entities?

The entities already existing before the publication of the Regulation No. 756/2026 you must register on the platform MyCiber within 60 working days.

• What is the deadline for entities established after the publication of the Regulation?

Entities established after the publication of the Regulation must register on the platform MyCiber within 30 working days from the start of their activity.

• When must the Cybersecurity Officer and the Permanent Contact Point be notified?

Following the definitive qualification of the entity, the CNCS must be notified of the Cyber Security Manager and Permanent Point of Contact, within the period of 20 working days.

A Quantinfor do you provide the service of Permanent Point of Contact, supporting organisations in fulfilling this obligation and ensuring the necessary technical monitoring.

• By when must the minimum cybersecurity measures be implemented?

The covered entities have 24 months, counted from the publication of the Regulation No. 756/2026, to implement the minimum cybersecurity measures provided for.

• My company has doubts as to whether it is covered by NIS2. What should I do?

Should there be any doubts regarding the scope of application of the legislation, the CNCS recommends that the entity register on the platform MyCiber and await the formal decision on your grading.

• Where can I obtain clarification on the legal framework?

For clarifications related to the legal regime of NIS2 and the platform MyCiber, the CNCS provides the email address:

maisciber@cncs.gov.pt

With the arrival of summer and holiday periods, many companies naturally enter a different rhythm. Teams reorganise tasks, distribute responsibilities and activate the usual automatic email absence replies, known as Out of Office.

This is a simple, useful and perfectly recommendable practice. Informing clients, partners and suppliers that a particular employee is absent demonstrates organisation and professionalism. However, there is one aspect that does not always receive the attention it deserves: when they are not accompanied by the appropriate security measures, team absences can create opportunities for cyberattacks.

The problem is not with holidays; on the contrary, staff rest is essential for any organisation. The real risk arises when operational planning is not accompanied by technological planning that ensures the continuity and protection of systems.

A prepared company is one that allows people to switch off from work without security depending on the presence of each employee.

Preparing for a holiday is like closing down a shop

Imagine a shop that closes for a few days. Before locking the doors, it is natural to make sure everything is protected: check that the doors and windows are locked, activate the alarm, and ensure that the most important equipment and assets remain safe.

In the digital environment, the principle is exactly the same. The difference is that many of the entry “doors” are not visible and, therefore, easily go unnoticed.

These vulnerabilities can take various forms, such as email accounts without multi-factor authentication, poorly protected remote access, excessively assigned permissions, devices without the latest updates or accounts that remain active despite no longer being required.

During periods when there is a lower staff presence, small flaws like these can turn into opportunities for an attacker.

Your Out of Office might reveal more information than you think

Automated out-of-office replies make communication with clients and partners easier, but they must be set up with some care.

Often, these messages indicate the exact period of the employee's absence, identify who is replacing them, reveal internal contacts and end up exposing part of the company's organisational structure.

A message like:

“I am away until the 15th. For urgent matters, please contact my colleague João via joao@empresa.pt.”

It seems perfectly harmless. However, for an attacker, this information can serve as a basis for crafting a fraudulent email, impersonating an employee or exploiting relationships of trust within the organisation.

This does not mean that automated responses should stop being used. It simply means that they should convey only the strictly necessary information, avoiding the exposure of internal details that could be used maliciously.

Remote access requires extra vigilance

Holidays also mean greater mobility. Many employees continue to access company systems from home, hotels, airports or public Wi-Fi networks, sometimes using personal devices.

This flexibility represents an advantage for modern businesses, but requires additional protection measures. Remote access without proper safeguards can be compared to handing over a company key without knowing exactly who might be able to use it.

To reduce this risk, it is advisable to use multi-factor authentication, use a VPN whenever necessary, keep equipment updated, set up automatic device locking and define clear policies for remote access to business systems.

The accounts of absent employees continue to be a target

When an employee is on holiday, their respective account remains active and is often no longer monitored with the same attention. Attackers know this reality and seek to exploit it.

A compromised account can pave the way for access to emails, documents, internal applications, financial information or customer data, making it an entry point for broader attacks.

For this reason, it is essential to regularly review the permissions assigned to each user, ensure that mechanisms are in place to detect suspicious activity, adjust privileges to the roles performed and delete old accounts or those that are no longer needed.

The principle should be simple: each employee must have only the access essential to perform their duties.

Social engineering becomes even more effective during the holidays

Periods of absence also favour social engineering attacks, especially those that exploit urgency and trust among colleagues.

It is common for messages that appear to have been sent by a company manager to appear with urgent requests, such as making a bank transfer or immediately sending important documentation.

When fewer people are available to confirm these requests and the pressure to resolve matters quickly increases, it becomes easier for an employee to be misled.

Although technology plays an essential role in protecting organisations, staff awareness continues to be one of the most effective ways to prevent this type of attack.

Before the holidays: five essential checks

A simple preparation can significantly reduce risks during periods of absence. Before the holidays begin, it is worth confirming a few key aspects:

1. Review access and permissions, ensuring that only the necessary users retain access to the systems.
2. Update equipment and applications, ensuring that all security patches are installed.
3. Validate the backups, confirming not only that they exist, but also that they can be successfully retrieved.
4. Raise awareness among the teams, remembering good practice regarding suspicious emails, remote access and the use of devices.
5. Keep monitoring active, ensuring that mechanisms are in place to identify anomalous behaviour even when part of the organisation is absent.

Security must not take a holiday

Rest periods are essential for people and contribute to more productive and balanced organisations. However, in order for employees to disconnect with peace of mind, it is important that the technological infrastructure remains prepared to respond to potential incidents.

The issue is not about avoiding the use of Out of Office, but by ensuring that the absence of people does not represent an opportunity for those looking to exploit vulnerabilities.

In a scenario where cyberattacks happen every day, security must remain active regardless of the time of year. After all, a resilient business is one that prepares in advance and ensures that, even when the physical doors are closed, the digital doors remain equally protected.

At Quantinfor, we help companies to strengthen their cybersecurity posture by implementing solutions that protect users, systems and information all year round.

If you want to ensure that your infrastructure remains secure while your team enjoys a period of rest, talk to us via info@quantinfor.com.

A backup system only has true value when it guarantees the rapid recovery of information and ensures business continuity.

For many years, most companies asked a simple question about their IT infrastructure: “Do we have backups?” Today, this question in itself is no longer sufficient.

In a context where ransomware attacks, hardware failures, human error and operational disruptions are part of organisations' reality, the existence of an enterprise backup system does not automatically guarantee that a company can quickly resume its operations.

It is the answer to this question that determines an organisation's recovery capability. And it is precisely at this point that many companies discover they have confused the existence of backups with a true business continuity strategy.

A backup can exist and the company can still lose days of work

Imagine your company performs a backup every night. At first glance, this is an excellent practice. However, if an incident occurs at 5 pm, all information produced since the last backup could be lost. This includes invoicing, orders, ERP changes, documents, emails and all the work carried out by employees throughout the day.

In practice, performing daily backups means accepting the possibility of losing up to a whole day's worth of information. Therefore, the most important question is no longer “How often do we take backups?” and becomes “How much work are we really willing to lose?”

Making backups is simple. Recovery is the real challenge.

Another frequent mistake is to assume that, because a backup exists, recovery will be immediate. In reality, restoring systems can take several hours or even several days, depending on the infrastructure, the volume of information and the recovery strategy implemented.

During this period, the company continues to bear costs while seeing its business compromised. Employees are no longer able to work, invoicing may be interrupted, the ERP becomes unavailable and clients or suppliers stop getting a response. In many cases, the financial impact caused by the downtime far exceeds the cost of the incident that caused it.

More than asking “Can we recover the data?”, it is important to know “How long will we be down until we are back to normal operations?”

An untested backup is merely an assumption

Many organisations run backups daily for years, but few regularly verify whether they can successfully restore the information. This is one of the biggest vulnerabilities in data protection strategies.

A file might be corrupted, a server might not recover properly, an application might stop working after restoration or the procedure itself might depend on a member of staff who is no longer with the company. These problems are rarely identified during the backup process; they are usually only discovered when the organisation is already in a crisis situation.

A disaster recovery strategy can only be considered reliable when it is regularly tested and validated under conditions similar to a real incident.

The backup can also be compromised

Cyber attacks have evolved significantly in recent years. Nowadays, many ransomware attacks first seek to locate and eliminate backup systems before encrypting the remaining servers.

When backups remain permanently connected to the infrastructure, use the same credentials or lack adequate protection mechanisms, they can be compromised along with the rest of the systems. When this happens, the company realises too late that, despite having backups, it no longer has an effective way to recover the information.

The objective is not to protect files. It is to protect the business.

There is a fundamental difference between protecting data and protecting business continuity. Whilst backups aim to preserve information, a business continuity strategy seeks to ensure that the company can continue to operate with the least possible impact.

For this, it is important to answer questions such as:

• How long can the company remain closed without compromising its business activity?
• Which systems take priority in the recovery process?
• When was the last restoration test carried out?
• Are the recovery procedures documented and up to date?
• Are the backups protected against attacks?
• Is there a clear plan to recover all the IT infrastructure?

Answering these questions is just as important as implementing the backup system itself, as it is this preparation that determines the capacity to respond when an incident occurs.

Conclusion

The existence of backups continues to be an essential requirement for any organisation. However, a backup only truly fulfils its purpose when it allows the right information to be recovered, within the necessary timeframe and with the least possible impact on the company's business activity.

The maturity of a protection strategy is not measured by the number of backups performed, but by the ability to ensure business continuity in the event of an incident.

If you have never evaluated how long it would take to recover your systems, how much work you could lose or whether your backups have actually been tested, you may be relying on a false sense of security that has not yet been validated.

At Quantinfor, we help companies implement backup and recovery solutions that go far beyond simple data copying, ensuring greater availability, resilience and business continuity.

If you want to assess the robustness of your backup strategy and find out if you are truly prepared to respond to an incident, contact us via info@quantinfor.com.

Cybersecurity is no longer just a technical concern, having become a strategic and regulatory issue. With the full entry into force of the NIS 2 Directive, 2026 marks a turning point for many Portuguese companies, both due to the legal requirement and the opportunity to strengthen their digital resilience.

More than just fulfilling an obligation, NIS 2 challenges organisations to rethink how they protect information, manage risk and ensure business continuity in an increasingly complex digital context.

The NIS 2 Directive (Network and Information Security) is the evolution of the original European directive on the security of network and information systems. Its main objective is to raise the common level of cybersecurity in the European Union by harmonising rules, responsibilities and supervisory mechanisms.

In Portugal, the NIS 2 Directive has a significant impact, since:

• It broadens the number of sectors and companies covered;
• Enter stricter requirements of risk and incident management;
• Strengthens accountability from top management;
• Increase monitoring requirements, report and audit.

The directive applies not only to entities considered “essential”, but also to “important” entities, including many medium-sized companies, digital service providers and critical supply chain vendors.

As from 2026, companies covered by NIS 2, as well as their suppliers in Portugal, will have to demonstrate, in a clearer and more structured way, that they adopt appropriate information security measures. Among the main changes are the following:

It is no longer enough to have formal policies. Organisations must implement active processes of:

• Risk identification and assessment;
• Protection of critical systems and data;
• Incident detection;
• Response and recovery.

The directive imposes short deadlines for reporting relevant incidents, typically between 24 and 72 hours, forcing systems to be prepared to quickly detect and report risk situations.

NIS 2 introduces an increased level of accountability for top management, who must approve, monitor and ensure the implementation of cybersecurity measures.

Companies are now also required to assess the risks associated with technology suppliers and partners, reinforcing control over access, integrations and external services.

Although many organisations view cybersecurity regulation as a bureaucratic challenge, NIS 2 should be seen as an opportunity to strengthen digital resilience.

• Reduce the likelihood of severe incidents;
• Minimise the impact of technical failures or attacks;
• Increase system availability;
• Protect the reputation and trust of clients and partners.

Digital resilience is not built with one-off solutions, but rather through a structured, continuous approach that is aligned with the business.

The complexity of the NIS 2 Directive makes it difficult to implement without specialist support. An IT consultancy plays a key role in translating legal requirements into concrete technical actions, tailored to the reality of each company.

Among the areas where IT consultancy adds value, the following stand out:

• Evaluation of maturity level in cybersecurity;
• Definition and implementation of technical measures and organisational;
• Continuous monitoring of systems and infrastructure;
• Support in incident response plan creation;
• Regular monitoring to ensure compliance and continuous improvement.

Rather than reacting to problems, the focus shifts to prevention, planning and operational stability.

In 2026, NIS 2 in Portugal represents much more than a legal obligation. It is a decisive step towards raising the level of information security, reinforcing the digital resilience of organisations and promoting a culture of prevention.

Companies that view the directive merely as compliance risk being limited to the minimum required. Whereas those that adopt a strategic approach, supported by specialised IT consultancy, transforms NIS 2 into a true driver of trust, continuity and competitiveness.

To find out more about the topic, you can book a meeting with João Mota, CTO of Quantinfor, and get all your questions answered:  https://calendly.com/joaomotaquantinfor/30min

As 2026 approaches, cybersecurity has become a strategic and mandatory element for organisations across all sectors. The exponential growth of digital threats, accelerated digital transformation and new European legislation — namely the NIS2 Directive — demand a rigorous and integrated approach to protect critical infrastructure, data and business operations.

This article serves as a practical guide for companies and entities intending not only to comply with the current legal framework, but also to strengthen their digital resilience in a proactive and sustainable manner.

A Directive (EU) 2022/2555, known for NIS2, aims to establish a high and common level of cybersecurity across the European Union, replacing the previous NIS1 and significantly expanding the scope and requirements for organisations. NIS2 Portugal + 1

In Portugal, this directive was transposed into the national framework through the Decree-Law No. 125/2025, published in December 2025, and will enter into force on second quarter of 2026, with practical effects and compliance deadlines that will come into force throughout 2026 and 2027. IT Security

NIS2 broadens the range of sectors considered critical or important, including energy, transport, health, digital infrastructure and essential services, imposing mandatory risk management and incident reporting measures on them. NIS2 Portugal

O Article 21 of NIS2 define ten minimum risk management measures that the entities covered must implement, which include incident management, business continuity, vulnerability management, multi-factor authentication and continuous staff training. NIS2 Portugal

Failure to comply with these measures may result in significant financial penalties of up to €10 million or 21 per cent of total annual turnover for essential entities, and proportionate levels for entities considered important. NIS2 Portugal

In view of the rise in sophisticated threats, companies and entities need to align their internal policies with legal requirements and good international practices. These are the strategic priorities for 2026:

The implementation of a robust cybersecurity culture starts with top management and involves:

• Continuous risk assessment and security policy updates;
• Awareness-raising and training programmes for staff at all levels;
• Governance that integrates digital risks into strategic decisions.

Companies should invest in:

• Tools of continuous monitoring and threat detection;
• Incident response plans with clear procedures;
• Regular recovery tests and simulation exercises.

These practices meet the requirements of NIS2 and market expectations in terms of operational resilience. NIS2 Portugal

Risks arising from external suppliers are gaining greater relevance. The following are required:

• Third-party risk assessment;
• Safety clauses in contracts;
• Continuous monitoring of critical suppliers.

The Portuguese Government approved, in December 2025, the Resolution of the Council of Ministers No. 214/2025, which defines the National Digital Strategy Action Plan for 2026-2027 with a focus on technological modernisation, skills enhancement and digital security. Official Gazette

This plan integrates priority activities such as:

• The modernisation of Public Administration IT infrastructures with a focus on security;
• Adoption of policies and technologies that reinforce the IT resilience of public systems;
• Digital upskilling of professionals and the public in areas such as cybersecurity and AI. Government of Portugal

In 2025 was approved the National Cybersecurity Legal Framework, which transposes NIS2 and reinforces the regulatory framework in Portugal, extending obligations regarding the prevention, management and reporting of incidents to public and private entities deemed essential and important. digital.gov.pt

These initiatives constitute institutional and legal support aimed not only at ensuring compliance, but also at promoting a safer and more resilient digital environment in Portugal throughout the digital decade.

Within the European and global context, it is expected that by 2026:

• Cybersecurity is increasingly understood as a strategic business factor, not merely a technical requirement;
• The use of artificial intelligence help with anomaly detection and response automation;
• Collaboration between businesses, the public sector and regulatory bodies should intensify to anticipate and mitigate threats.

Dedicated events and cross-cutting initiatives will continue to reinforce these trends, sharing best practices and advocacy strategies. AVNetwork

The year 2026 will mark a turning point in the cybersecurity landscape in Portugal and the European Union. The transposition of NIS2 into national legislation, combined with the measures defined in the National Digital Strategy Action Plan, creates a robust framework that demands from organisations not only legal compliance, but a resilient and strategic posture in the face of digital threats.

Companies that proactively align their risk management structure, technology and training with best practices and regulatory requirements will achieve not only security — but a sustainable competitive advantage in this new digital ecosystem.

To find out more about the topic, you can book a meeting with João Mota, CTO of Quantinfor, and get all your questions answered: https://calendly.com/joaomotaquantinfor/30min