Frequently asked questions

It depends on your sector and size. NIS2 covers 18 sectors, from energy to digital services and transport to manufacturing of critical products, and applies mostly to medium and large companies, although some small companies are also covered in specific cases. The guide "Decree-Law 125/2025 explained for SMEs", in the Guides section, helps you understand how the law applies to your entity.

The platform core is open-source under the AGPL-3.0 licence and free forever: you can deploy it on your own infrastructure with no licensing costs. The Premium plan (inventory, risk, suppliers, technical checks and AI analysis), the NIS2 diagnosis and the training courses have published prices on the pricing page. The longer consulting engagements are quoted according to scope, always with a written proposal before any commitment.

There is no catch, and the business model is in plain sight: the core is and will always be free; development is funded by the Premium plan and the consulting services. The project was born in an academic context, with the mission of democratising access to NIS2 compliance for Portuguese SMEs. The core's code is public and auditable.

The National Cybersecurity Reference Framework is the Portuguese technical reference that translates legal requirements into concrete controls. It defines 107 controls organised into six objectives (Govern, Identify, Protect, Detect, Respond and Recover) and three compliance levels (Basic, Substantial and High). The platform is up to date with Regulation 756/2026, in force, which establishes the QNRCS and the minimum measures per level, and follows CNCS updates and guidance, preserving your work.

It depends on the compliance level required of your entity: Basic (43 minimum measures), Substantial (75) or High (92). The QNRCS defines 107 controls in total; each level requires a minimum subset, and the remaining ones are available to those who want to go beyond the minimum. The platform does not decide your level: it results from the regulatory classification defined by the CNCS. You indicate your level at registration, and the platform measures compliance only against the measures that apply.

It is 10 questions, each mapped to one of the most common vulnerabilities in SMEs and, in turn, to one or more QNRCS controls. Based on your answers, the platform generates a priority action plan: the controls that should be reviewed and implemented first. You can redo the questionnaire whenever your company's reality changes.

With the on-premises deployment, your data stays on your infrastructure, and that is how real compliance work is done. The only exception is Premium's AI analysis: the evidence for the control you send for analysis is sent encrypted to the NIS2PME AI service, hosted in Europe, which does not keep it. The evaluation trial is the only option NIS2PME hosts, on servers in the European Union from a European provider: it is exclusively for evaluating the platform, it is suspended after 14 days and deleted 5 days later, and it should not be used with sensitive or confidential company data.

The full core and AI analysis for 14 days, with no credit card and no commitment. It is there to evaluate the platform, so use demo data rather than real company data: at the end of the period the account is suspended, and 5 days later it is deleted with all its data. The other Premium modules are shown in a live demo. If you like it, deploy the core on your own infrastructure with Docker, for free. That is where the real work happens.

The GitHub repository includes everything you need for the on-premises deployment with Docker, including step-by-step documentation. If your company has someone capable of managing a server, you can run NIS2PME.

The platform structures, guides and documents the compliance process, which for many SMEs is enough to move forward with confidence. It does not provide legal advice: for legal interpretation questions specific to your situation, seek specialised support. And for those who want guidance through implementation, NIS2PME also provides specialised remote consulting, using the platform itself as the work tool.

No. The platform helps you implement and demonstrate compliance (gap analysis, controls, evidence and reports), but it does not replace formal audits or certifications where required. What it does is make preparing for those moments much simpler.

Both the platform and this website are available in Portuguese and English.

The project is open-source and contributions are welcome: code, translations, content review, bug reports or simply usage feedback. Everything happens on GitHub.