NIS2 in the Portuguese factory: from diagnosis to technical plan

The CERT.PT recorded 2,758 cybersecurity incidents in Portugal in 2024 — 36% more than in 2023, with 78% occurring in private entities (CNCS, 2024). Most were not detected in time. Not for lack of antivirus: for lack of architecture. In Portuguese factories, the problem is not technological — it is one of sequence. A firewall is bought before knowing what is connected to the network. EDR is installed before revoking the VPN access of the injection-machine technician who left two years ago. Decree-Law no. 65/2025 transposed the NIS2 Directive and made mandatory what many industrial companies still treat as optional. This article does not explain what NIS2 is — it assumes you already know. What follows is the real work: diagnosis, prioritisation and a technical plan for a factory in operation.

The thesis the manuals avoid saying

Most Portuguese industrial companies will fail NIS2 compliance not for lack of budget, but for diagnosing the wrong problem. They invest in firewalls and antivirus — and ignore that the biggest attack vector is the poorly segmented ERP, the shop-floor terminal without authentication, and the remote access of the maintenance supplier that was never revoked.

NIS2 is not an IT project. It is an operational architecture project. Anyone who treats it as a software checklist will spend money and remain vulnerable.

There is one figure that illustrates the scale of the problem: in small and medium-sized enterprises, ransomware was present in 88% of the data breaches analysed in 2025, against 39% in large organisations (Verizon DBIR, 2025). Portuguese industrial SMEs are not secondary targets — they are the preferred target, precisely because they have digitalised production systems and disproportionately weak defences. What follows is how to change that equation, in order of execution.

Phase 1 — Diagnosis: what to audit before buying anything at all

The inventory that no one has complete

The first technical problem is simple and humbling: most factories do not know what they have connected to the network. This is no exaggeration. Production terminals running embedded Windows 7, PLCs with Telnet access, unmanaged switches in the warehouse, printers with 2015 firmware — all of this exists, and none of these assets appears in the official IT inventory. The IT manager knows they exist. They are not documented. And that is exactly where the attacker gets in.

NIS2 diagnosis begins with a complete asset inventory that must include all network devices — including OT: PLCs, SCADA, HMIs, industrial terminals —, all active external APIs and integrations (including those of the MULTI ERP with suppliers, customers and logistics platforms), all remote accesses — VPN, RDP, TeamViewer, AnyDesk — with identification of who uses them, how frequently and whether they are still necessary, all maintenance contracts with access to the internal network, and all authentication systems — including where there is no authentication at all.

This inventory takes between two and four weeks in a medium-sized factory. It cannot be done through interviews alone. It requires active network scanning — tools such as Nmap, Nessus or commercial equivalents — combined with documentary review. Anyone who skips this phase and moves straight to purchasing technology will discover, during implementation, that they have devices no one knew existed and that invalidate half the designed architecture.

Network segmentation as the technical starting point

After the inventory, the critical question is: what is separated from what? In most Portuguese factories, the honest answer is that nothing is separated from anything. The office network, the production network, the CCTV network and the visitor Wi-Fi share the same segment — or worse, the same unmanaged switch bought twelve years ago at a computer shop in Braga.

NIS2 implicitly requires network segmentation between IT and OT environments. It is not a recommendation — it is a risk management requirement (Article 21 of Directive (EU) 2022/2555). The absence of segmentation means that a ransomware attack entering through the purchasing manager's email can, within hours, reach the production controllers. In a garment factory in the Vale do Ave with orders due for delivery on Friday, that is not a theoretical scenario.

Maturity assessment: where the company stands today

Use this table as a quick diagnostic tool. The NIS2 objective is not Level 4 — it is Level 3, consistently, across the highest-risk domains. A typical textile factory with 120 employees will be, in most domains, between Level 1 and Level 2. That is the starting point, not a sentence.

Phase 2 — Prioritisation: what to resolve first

The mistake of treating all risks as equal

The second most common mistake — after the incomplete inventory — is trying to resolve everything at once. That paralyses. NIS2 requires measures "proportionate to the risk" (Article 21(1)). That is explicit permission to prioritise. Prioritisation should cross two axes: probability of exploitation and operational impact. In an industrial environment, operational impact includes production downtime — which has a calculable and immediate hourly cost. Calculate it before presenting the plan to management. A concrete number is worth more than any regulatory argument.

The five most frequent risk vectors in Portuguese factories

Uncontrolled remote access. VPNs without MFA, RDP sessions exposed directly to the internet, supplier credentials that never expired. This is the most common entry vector in industrial ransomware. Fix it first, before anything else.

ERP without access segmentation. Users with access to modules they do not use, without active audit logs, without periodic permission review. The MULTI ERP and QAD Adaptive ERP support granular profile control — but that control has to be configured and actively maintained. The out-of-the-box installation is not the security configuration. They are different things.

OT terminals without patch management. PLCs and HMIs with outdated firmware, often because the machine supplier does not support updates without on-site intervention and charges for the visit. This problem has no quick fix — but it does have mitigation: isolate these devices in VLANs without internet access and formally document them as "accepted risk with mitigation". That documentation is what the competent authority will ask for.

Absence of centralised logs. Without log aggregation, there is no anomaly detection, no post-incident investigation capability, and no evidence for the CNCS in the event of mandatory notification. The logs exist in the individual systems — they are simply not being collected or correlated.

Software suppliers with permanent access. The maintenance technician who has VPN access active 365 days a year, even if they only need to log in twice. Revoke it. Implement just-in-time access with explicit approval and session logging. This is the vector that no audit report mentions and that everyone in the factory knows about.

Decision matrix: technical options by domain

Phase 3 — Technical plan: how to structure the first 90 days

Weeks 1-2: inventory and baseline

Do not buy anything. Do not install anything. First, know what you have. Run the network scan, document the assets, map the critical data flows — especially those linking the ERP to the shop floor, the warehouse and supplier systems. The article on industrial IT infrastructure has a complete map of the components to audit by environment type.

Weeks 3-4: remediation of immediate high risk

With the inventory done, identify the three to five risks with the highest probability and greatest impact. Fix them before proceeding. Typically: revoke unnecessary remote accesses, enable MFA on email and VPN, and isolate in a VLAN the OT devices that cannot be updated. These three actions are executable without significant budget and reduce the attack surface in a measurable way.

Weeks 5-8: security architecture

Define the target architecture — not the perfect architecture, but the architecture the organisation can operate and maintain. A factory with a part-time IT technician is not going to operate an internal SOC. Defining what is realistic is not a concession — it is the only way to build something that lasts. The article on systems engineering and infrastructure alignment describes the architectural decision method for this type of context.

Weeks 9-12: documentation and procedures

NIS2 requires evidence. Having the measures is not enough — they have to be documented. That includes: information security policy, incident management procedure, business continuity plan, and access logs for critical systems. Document Management with approval workflow and eIDAS qualified signature resolves the legal archiving and traceability side of compliance documents — and ensures the documentation does not exist only on the IT manager's computer.

Week 13 onwards: monitoring and continuous improvement

Configure alerts, define security indicators — number of incidents per month, average detection time, percentage of systems with up-to-date patches — and review the plan quarterly. NIS2 compliance is not a state you reach. It is a process you maintain. Without an owner and a schedule, it will not survive the first quarter.

What works in practice: three patterns observed in the Portuguese industrial context

Pattern 1 — The factory that started with the backup

In a footwear factory in Felgueiras with around 80 employees, the entry point to NIS2 compliance was the backup. The company had already suffered data loss from a disk failure and the memory of the incident was recent. Management approved the investment in a 3-2-1 backup system with an offsite copy in less than a week — without needing to hear anything about NIS2. From there, the IT manager used the same argument — "we've already lost data once" — to approve MFA and network segmentation. The sequence matters: start with the risk the organisation has already experienced. The regulatory side comes next, as confirmation, not as motivation.

Pattern 2 — ERP integration as an underestimated risk vector

In industrial companies with integrations between the ERP and customer or supplier platforms — via MULTI Connect or external APIs — the supply chain risk is systematically ignored in the initial diagnoses. NIS2 is explicit: the obligations extend to the digital supply chain (Article 21(2)(d)). Audit all active integrations. Deactivate those that no longer have operational use — and there are always at least two that no one can explain the purpose of. For the rest, check whether the supplier has a documented security policy. If they do not, require it contractually before the next renewal.

Pattern 3 — The IT manager as compliance pivot

In many Portuguese industrial SMEs, the "IT department" is one person. That person knows the factory better than any external consultant — they know that the production server reboots at 3am because otherwise it freezes, and that the cutting-machine technician has been logging in via TeamViewer without prior notice for three years. That knowledge is an irreplaceable diagnostic asset. The classic mistake is to isolate that person from the compliance process and hand everything over to an external consultant who does not know the context and leaves after delivering the report. The model that works: external consultant for the framework and documentation, internal manager for the inventory and prioritisation. Without that division, the plan looks good on paper and does not work in the factory.

The global shortage of cybersecurity professionals reached around 4.76 million people in 2024 — a 19% increase over 2023 (ISC2, 2024). In Portugal, this translates into a direct reality: there are not enough security technicians available for all the factories that need them. NIS2 compliance has to be designed to be operated by those already in the company — not by those who will be hired and never appear.

NIS2 and industrial systems: the specific case of OT

Why OT is different — and harder

Operational technology environments — PLCs, SCADA, production control systems — were designed for availability, not for security. A PLC controlling a sewing line in Guimarães cannot be rebooted to apply a patch without stopping production. A SCADA system on a textile finishing line in the Vale do Ave may be 15 years old and not support modern authentication. This is not negligence — it is the reality of industrial equipment with 20-year life cycles that was never designed to be connected to IP networks.

The correct approach for OT is not the same as for IT. Patches are not applied at the same cadence. EDR is not installed on embedded firmware. What is done is to isolate the OT devices in VLANs without direct internet access, monitor OT traffic passively — without interfering with the protocol — using specialised tools such as Claroty, Dragos or Nozomi, document all devices with outdated firmware as "accepted risk with mitigation" with annual review, and require industrial equipment suppliers to document the security support life cycle of their systems. That last point is new for most Portuguese machine suppliers — and it is going to be a difficult conversation.

IT/OT convergence as a structural risk

KORA Productivity, like any real-time production capture system, creates integration points between the shop floor and the management systems. That integration is the product's value — and it is also an attack-surface point that has to be considered in the security architecture. This is not an argument against digitalisation: it is an argument for doing it with deliberate architecture, not by accumulating ad hoc integrations over five years without review.

Incident notification: what NIS2 requires operationally

The deadlines that admit no improvisation

NIS2, transposed by DL 65/2025, defines mandatory notification deadlines to the competent authority — in Portugal, the CNCS — that are operationally demanding. Within the first 24 hours of detecting a significant incident, an initial alert must be sent. At 72 hours, a notification with an initial impact assessment and indicators of compromise. After one month, a final report with root-cause analysis, measures taken and lessons learned.

Meeting these deadlines without a documented and tested incident management procedure is impossible. Most factories do not have that procedure. Building it is one of the highest-return actions in the NIS2 plan — because it serves both regulatory compliance and the operational response to any incident, regardless of the legal obligation.

What counts as a "significant incident"

The Directive defines a significant incident as one that causes or may cause severe disruption to services, significant financial losses, or damage to other persons. In industrial practice, this includes ransomware that affects production systems, compromise of ERP access credentials, and exfiltration of customer data or intellectual property — technical data sheets, moulds, finishing formulas. It does not include spam, blocked phishing attempts, or hardware failures without a security component. The distinction matters: unnecessary notifications create regulatory noise; missing notifications create legal liability.

In 2024, the global average cost of a data breach reached 4.88 million dollars — a record, 10% more than in 2023 (IBM, 2024). For a Portuguese industrial SME, the question is not whether it can afford that cost. It is whether it can survive it.

ISO 27001 and NIS2: complementary, not redundant

What ISO 27001 resolves that NIS2 does not specify

NIS2 defines the "what" — the categories of mandatory measures. ISO 27001 defines the "how" — the management system that ensures the measures are implemented, maintained and improved systematically. For a company that already has or is considering ISO 27001 certification, NIS2 compliance is largely covered by the scope of the standard. For those who do not have it, ISO 27001 is the most structured path to reaching NIS2 compliance sustainably — with the added benefit of commercial value with international customers who require evidence of security maturity.

They are not the same thing. NIS2 is a legal obligation with sanctions. ISO 27001 is a voluntary certification with market value. But the underlying technical work is largely shared — and doing both in parallel, with the same implementation plan, is more efficient than doing them in sequence.

GDPR as an implicit prerequisite

Many of the NIS2 technical measures — access control, audit logs, incident management, risk assessment — are also obligations under GDPR and Law 58/2019. A company that has already implemented GDPR correctly has 40% to 60% of the NIS2 technical work done. The problem is that most industrial SMEs implemented GDPR as a documentation exercise, without the corresponding technical measures. There is a privacy policy on the website and a record of processing activities in a shared folder. The technical measures the policy describes do not exist in reality. Check whether what is on paper exists on the network.

Financing: how to use PT2030 and RRP for this investment

What is eligible and what is not

The PT2030, RRP and Norte 2030 instruments have digital transformation financing lines that explicitly include cybersecurity as an eligible component. Security diagnoses, SIEM implementation, network segmentation, employee training and ISO 27001 certification are typically eligible. Antivirus licences, routine network hardware replacement and compliance consultancy without a technology implementation component are typically not.

The key to eligibility is to frame the cybersecurity investment as part of a broader digital transformation project — which may include the implementation or modernisation of the ERP, warehouse digitalisation with KORA Inventory Suite, or the adoption of Qlik Sense for operational BI. Cybersecurity as a component of a digital project has significantly higher approval rates than cybersecurity as a standalone project. This is a detail that most applicants discover after the application is rejected — not before.

For a technical assessment of how your project fits, the article on solution architecture for your company describes the decision process.

The technical plan in five ordered steps

First: inventory everything before buying anything at all. Active network scanning, review of remote accesses, mapping of ERP integrations. Without a complete inventory, any investment in security is a shot in the dark — and an expensive shot.

Second: fix the three risks with the highest immediate probability. Typically MFA on remote access, revocation of inactive supplier accesses, and isolation of OT devices without patch support. These three actions reduce the attack surface measurably in less than four weeks, without significant budget.

Third: define the target architecture the organisation can operate. Not the ideal architecture — the real architecture. A factory with a part-time IT technician needs an architecture that person can maintain alone, with occasional external support. The article on industrial IT infrastructure has the

Frequently asked questions

What is the asset inventory and why is it so critical for NIS2?

The asset inventory is the complete record of all devices connected to the network — computers, PLCs, SCADA, HMIs, printers, switches and remote access systems. It is critical because most Portuguese factories do not have it complete. Forgotten devices (such as terminals running Windows 7 or old VPN accesses) become entry points for attacks. Without an inventory, any security plan is incomplete.

How long does it take to carry out a complete NIS2 diagnosis in a factory?

In a medium-sized factory, the diagnosis takes between two and four weeks. It requires active network scanning with tools such as Nmap or Nessus, combined with documentary review. It cannot be done through interviews alone. Anyone who tries to speed up this process runs the risk of discovering, during implementation, that they have undocumented assets that invalidate the designed architecture.

Does NIS2 require network segmentation between IT and OT?

Yes. Article 21 of the NIS2 Directive requires network segmentation between IT and OT environments as a risk management requirement. In most Portuguese factories, everything is on the same segment. Without segmentation, a ransomware attack entering through email can reach the production controllers in a few hours, paralysing production.

What maturity level does a factory need to reach to be NIS2 compliant?

The NIS2 objective is not Level 4 (Optimised), but Level 3 (Managed), consistently, across the highest-risk domains. A typical factory with 120 employees will be, in most domains, between Level 1 and Level 2 at the start. That is the starting point, not a sentence.

Why are industrial SMEs preferred ransomware targets?

Industrial SMEs have digitalised production systems, but disproportionately weak defences. They combine two factors that make them attractive targets: critical dependence on operational continuity and limited cybersecurity resources. This makes ransomware particularly effective as an attack vector.

What is the most common mistake companies make when implementing NIS2?

The most common mistake is diagnosing the wrong problem. Companies invest in firewalls and antivirus, ignoring that the biggest attack vectors are the poorly segmented ERP, shop-floor terminals without authentication and supplier remote accesses that were never revoked. NIS2 is an operational architecture project, not just a software one.

Is a very large budget needed to be NIS2 compliant?

No. Most Portuguese industrial companies will fail NIS2 compliance not for lack of budget, but for diagnosing the wrong problem. Prioritisation should cross probability of exploitation with operational impact, allowing the most critical risks to be resolved first in a proportionate way.

Sources

• Directive (EU) 2022/2555 (NIS2) — Directive on measures for a high common level of cybersecurity across the Union
• Decree-Law no. 65/2025 — Transposition of the NIS2 Directive into the Portuguese legal order
• CNCS (National Cybersecurity Centre) — Report on Cybersecurity Incidents in Portugal 2024
• ENISA (European Union Agency for Cybersecurity) — Guidelines on Cybersecurity Measures for Operators of Essential Services (NIS2 implementation)
• ISO/IEC 27001:2022 — International standard for information security management (technical reference for NIS2 compliance)