It's 2:30 pm at a garment factory in the Vale do Ave. The order server goes offline. Half an hour later, there is no stock visibility, delivery deadlines are at risk, and the IT manager is on the phone to the data centre. The NIS2 Directive (Directive EU 2022/2555) comes into force in Portugal on 17 October 2024. If your factory has more than 250 employees, revenue above 50 million euros, or operates in critical sectors (energy, water, transport, health, food), it is an essential entity — and technical controls are no longer optional. This guide presents 12 controls you can audit and implement in 6 weeks, with a checklist ready for tomorrow's meeting with IT.

What you need before you start

  • Access to the systems inventory file (servers, applications, databases, networks).
  • A named contact for the IT or security manager (may be external).
  • Authorisation from management to audit and document findings.
  • A simple logging tool (spreadsheet or paper record).
  • Access to backup, patch and access logs from the last 12 months.
  • Basic knowledge of the critical data flow (orders, invoicing, production).

Step 1: Map the critical data

Before protecting, identify what. Critical data is that whose loss or corruption paralyses operations for more than an hour.

  • Customer orders and sales history.
  • Invoicing files and accounting records.
  • Production plans and technical data sheets.
  • Employee data (payroll, attendance, GDPR).
  • Machine configurations and quality parameters.
  • Credentials and access keys to critical systems.

Step 2: Audit access control

NIS2 requires that only authorised people access critical data. This means: no shared accounts, no passwords on sticky notes, no access after an employee leaves.

  • Make a list of all active user accounts in the ERP, databases and servers.
  • For each account, identify: name, department, creation date, last access, permissions assigned.
  • Flag accounts that have had no access in the last 90 days — they are candidates for deactivation.
  • Check whether there are service accounts with credentials hard-coded in files — they should use tokens or secrets managers.
  • Confirm that departed employees were removed within 5 working days.

Step 3: Verify multi-factor authentication (MFA)

A stolen password is not enough to get in. MFA adds a second layer (SMS code, app, physical key).

  • Enable MFA for all accounts with access to critical data (administrators, IT managers, finance staff).
  • If the ERP does not support native MFA, use an authentication proxy (e.g. Azure AD, Okta) or VPN with MFA.
  • Test: try to log in with the correct password but without the second factor — it should be blocked.
  • Document which MFA method (SMS, app, key) and who is responsible for support.

Step 4: Implement immutable backups

A backup that can be deleted or corrupted is not a backup — it is merely a copy. NIS2 requires at least one copy to be immutable during a retention period (e.g. 30 days).

  • Define a policy: full backup once a week, daily incrementals, minimum retention of 30 days.
  • Store at least one copy in a physically separate location (a different data centre, cloud, or off-site vault).
  • Configure immutability: on cloud platforms (Azure, AWS), use "retention lock" or "WORM" (Write Once Read Many); on local systems, use file permissions or dedicated hardware.
  • Test restoration: every 3 months, restore a full backup in a test environment and validate the data.
  • Document: who performs the backup, when, where to, and how to restore.

Step 5: Audit the encryption of data in transit

Data in transit is data travelling across the network (between the user's computer and the server, between branches, between the ERP and the cloud). Without encryption, it can be intercepted.

  • Verify that access to the ERP uses HTTPS (not HTTP). Test: open the browser, access the system, and check that the padlock is green and the URL begins with "https://".
  • If you use a VPN between branches, confirm it is configured with encryption (IPSec, TLS 1.2 or higher).
  • For integrations with partners (suppliers, customers), use APIs with TLS 1.2+ and valid certificates.
  • If you synchronise data with the cloud, confirm that the contract specifies encryption in transit.

Step 6: Protect data at rest

Data at rest is data stored on disk (server, backup, laptop). Without encryption, a physical theft exposes everything.

  • Enable disk encryption on critical servers (BitLocker on Windows, LUKS on Linux, FileVault on macOS).
  • Encrypt backups: in the cloud, use native encryption; on external disks, use VeraCrypt or similar.
  • Employee laptops with access to critical data must have disk encryption enabled.
  • Databases: enable encryption of sensitive columns (passwords, card numbers, personal data).

Step 7: Configure logging and monitoring

Without logs, you don't know what happened. NIS2 requires critical events to be logged and kept for at least 6 months.

  • Enable logs in: the ERP (accesses, changes to critical data), servers (logins, software installation), firewalls (blocked connection attempts), databases (queries to sensitive data).
  • Centralise logs on a dedicated server or SIEM platform. This prevents a local attacker from erasing their tracks.
  • Configure alerts for suspicious events: multiple failed login attempts, access to critical data outside working hours, disabling of antivirus.
  • Retain logs for a minimum of 6 months; critical audit data, for 1 year.

Step 8: Implement patch management

Patches are security fixes. An unpatched system is an open door for attackers.

  • Define a policy: critical patches applied within 2 weeks, normal patches within 60 days.
  • Test patches in a test environment before applying them in production (a minimum of 1 week of testing).
  • Automate: use tools such as WSUS (Windows), apt (Linux) or the ERP's package managers.
  • Document: record the date, time, previous/new version, and downtime (if any).
  • Production machines (shop floor, PLC, IoT): establish maintenance windows agreed with operations.

Step 9: Audit network security

The network is the road along which data travels. Without control, anyone can get in.

  • Firewall: configure explicit inbound/outbound rules (deny by default, permit only what is necessary).
  • Segmentation: separate the production network (shop floor, ERP) from the office network and the public internet.
  • VPN: if employees access remotely, use a VPN with MFA (not RDP directly on the internet).
  • Wireless: if there is WiFi, configure WPA3 (or WPA2 if WPA3 is not available), a strong password, and an isolated guest network.
  • Test: use tools such as nmap or Qualys to check for unnecessarily open ports.

Step 10: Establish an incident response plan

When (not if) an incident happens, you need a plan. Without a plan, you lose precious time.

  • Define: who to contact (IT manager, CEO, board of directors, authorities), in what order, by what means.
  • Document: how to shut down compromised systems, how to isolate infected machines, how to preserve evidence.
  • Test: simulate an incident (e.g. a server with ransomware) and run the plan — how long does it take?
  • Communicate: all employees should know to whom to report suspicions (phishing, strange behaviour).
  • Retain: after an incident, analyse what went wrong and update the plan.

Step 11: Train employees in cybersecurity

The weakest link is always the person. A well-crafted phishing email deceives users even with warnings.

  • Mandatory annual session: what phishing is, how to recognise it, whom to report it to.
  • Clear policies: no sharing of passwords, no installation of unauthorised software, no connecting of unknown USB drives.
  • Practical test: send simulated phishing emails (with management's consent) — who clicks? Follow up with that person.
  • Access: all employees with access to systems should have training before receiving credentials.

Step 12: Document everything

Documentation is not bureaucracy — it is proof of compliance. In an audit, what is not documented does not exist.

  • Security policy: a 5-10 page document summarising controls, responsibilities and processes.
  • Asset inventory: a list of servers, software, licences, and end-of-support dates.
  • Access matrix: who has access to what, for what reason, and since when.
  • Incident log: date, description, impact, corrective action, outcome.
  • Continuity plan: how to recover after a disaster (fire, flood, attack).

Next steps

Choose one control per week. Start with the simplest (logging, patch management) and then move on to the more complex ones (network segmentation, continuity plan). Each completed checklist is evidence of compliance. Keep everything — in an audit, the documentation is your defence.

Questions about implementation? The INFOS cybersecurity team can audit and guide your NIS2 plan.

Sources

  • Directive (EU) 2022/2555 (NIS2) — Directive on measures for a high common level of cybersecurity across the European Union
  • Decree-Law No. 65/2021 (transposition of NIS1 in Portugal) — National regulation on the security of networks and information systems
  • ENISA — Guidelines on Incident Handling and Response (2022) — Technical recommendations from the European Union Agency for Cybersecurity
  • ISO/IEC 27001:2022 Standard — Information security management systems (technical reference for security controls)
  • CNCS (National Cybersecurity Centre) — NIS2 implementation guidelines for essential entities in Portugal