Training
Cyber hygiene and risk management for technical teams
The practices that stop most incidents, and the evidence the law requires.
Objective
What this training is for
Most incidents that hit SMEs exploit nothing sophisticated. They exploit poorly managed accounts, unpatched systems, backups that were never tested and missing multi-factor authentication. That set of practices is what cyber hygiene means, and it is one of the areas Decree-Law 125/2025 names explicitly among the risk management measures.
This training goes deep into those practices with the people who have to keep them working. And it takes them as far as compliance requires: for each measure, what evidence is expected, and where it is recorded.
The day closes with work on the company's real situation, not on a case study.
What is covered
- Cyber hygiene in practice, and why it fails
- Applied risk management: identify, assess, treat and record
- Identities, access, resilience, detection and response
- How this maps onto the QNRCS controls and the three levels
What you are left with
- A team able to keep cyber hygiene practices running without depending on third parties
- Clarity on what evidence to collect for each measure, and where to record it
- A participation record, which serves as evidence of the training control
Frequently asked questions
About this training
Is prior cybersecurity experience required?
Cybersecurity experience is not required, but comfort with the company's system administration is. The training is aimed at whoever manages, or will manage, accounts, backups, updates and access.
Is it suitable for our external IT provider?
It is, and in many SMEs that is exactly who should be in the room. In practice the provider runs a good share of the controls, while the company remains accountable before the law. It is worth having both attend.
Does the training cover the NIS2PME platform?
It covers the part that serves the objective, which is where the evidence for each measure is recorded. The platform is not the subject of the training, it is the tool where the work is documented.
Seven hours in one day or split?
Usually in one day, with breaks. It can be split into two half sessions when the team cannot stop for a full day, at no change in price.
Want this training for your team?
State how many people you have and you get a fixed written quote, with no commitment.