NIS2PME helps your SME comply with NIS2
An open-source gap-analysis platform aligned with the Portuguese National Cybersecurity Reference Framework, plus specialised consulting for teams that want guidance through implementation. Start on your own, for free, or make the journey with a specialist at your side.
14-day evaluation trial · No credit card · On-premises core deployment is free forever
The challenge
NIS2 reached SMEs. Support at their scale did not.
DL 125/2025 extends cybersecurity obligations to thousands of Portuguese small and medium-sized companies. Traditional consulting was designed for large organisations; SMEs need tools and guidance at their own scale.
Complex regulation
A European directive, a decree-law and a national reference framework: understanding what applies to your company is a project in itself.
Real fines
Non-compliance can cost up to millions of euros and hold management bodies directly accountable. Ignoring it is no longer an option.
Limited resources
With no CISO and no dedicated security team, SMEs need a clear path and support sized to their budget, not 200-page reports.
Two paths, one destination
Do it yourself or do it guided
NIS2PME gives you both paths to compliance, and you can combine them at any point.
The platform
A guided 10-question diagnosis, QNRCS controls tailored to your entity's compliance level, evidence, incidents and reports ready to present. The core is open-source and free on-premises; the Premium plan adds asset inventory, risk analysis, suppliers, technical checks and AI analysis.
The consulting
Specialised remote advisory across three services: NIS2 diagnosis (from €2,900), guided implementation of the controls and preparation for CNCS supervision. Always with a written proposal, with a fixed scope and timeline, before any commitment.
The method
Consulting happens inside the platform, and the platform stays with you
No reports that die in a drawer. The diagnosis, action plan, evidence and progress live in the NIS2PME platform, deployed on your company's infrastructure. When the engagement ends, your team keeps working in the same place, with everything documented.
Verifiable work
Every implemented control is recorded with its evidence. Compliance is demonstrated with proof, not slide decks.
Evaluate in the cloud, work on-premises
Try the platform in an evaluation environment, with nothing to install. When you move to real work, the platform runs on your infrastructure and your compliance evidence stays there.
No lock-in
At the end of the service, the tool and the full history are yours. Continue alone, renew the engagement or alternate: the decision is always yours.
Why NIS2PME
Expertise you can verify
NIS2 and QNRCS specialisation
The Portuguese regulatory framework (DL 125/2025 and Regulation 756/2026), studied control by control, not from second-hand summaries.
Open, verifiable code
The entire platform core is published on GitHub under AGPL-3.0. Competence is demonstrated, not claimed.
Audit experience
Audits of processes, documentation and operational readiness in a military context: the same discipline of evidence verification that NIS2 supervision demands.
Frequently asked questions
Questions? Only natural: the regulation is new for everyone
Is my company covered by NIS2?
NIS2 covers entities in 18 sectors, including many medium-sized companies (and some small ones, in specific cases). The guide "Decree-Law 125/2025 explained for SMEs", in the Guides section, helps you understand where your entity stands.
How much does it cost?
The platform core is open-source (AGPL-3.0) and free forever on-premises. The Premium plan, the NIS2 diagnosis and the training courses have published prices on the pricing page; the longer consulting engagements are quoted according to the compliance level and the scope.
How does the consulting work?
Fully remote (video calls and shared work inside the platform), across three services: diagnosis, guided implementation and preparation for supervision. At the end, the platform and the work stay with you.
Does my company data sit in your cloud?
No. The 14-day evaluation trial is there to try the platform out and is meant for demo data: the account is suspended at the end of the period and deleted 5 days later. Compliance work happens on the on-premises deployment, on your company's infrastructure. Only Premium's AI analysis sends anything out, and only the evidence for the controls you send for analysis, to servers in Europe.
What is the QNRCS 2026?
The National Cybersecurity Reference Framework is the Portuguese technical framework that operationalises the requirements of DL 125/2025, organised into 6 objectives and 3 compliance levels. The platform is up to date with Regulation 756/2026, in force, and follows CNCS updates and guidance.
Start your path to compliance today
Try the platform for free or book a 30-minute call about your company's situation.