Notification Readiness and Coordination

The problem it solves

One incident triggers several deadlines at once and several recipients. Deciding during the incident who notifies whom, and by when, is the usual recipe for missing all of them.

Who it is for

• Entities covered by the Act;
• Legal and communication teams;
• Group cybersecurity functions.

Deliverables

• Matrix of deadlines and recipients;
• Incident communication playbook;
• Templates for early warning, notification and final report;
• Tabletop exercise against real deadlines.

Method

1. 01

   Map

   Deadlines and recipients.

2. 02

   Draft

   Templates by phase.

3. 03

   Rehearse

   Tabletop exercise.

4. 04

   Improve

   Lessons learnt.

Regulatory basis

• Articles 41 to 44 of Decree-Law 125/2025, on the early warning, the notification and the final report;
• Article 40 of the same act, on the criteria for a significant incident and on other notification duties that remain unaffected.

Expected results

• Deadlines known before the incident;
• Consistent communications across recipients;
• Lower exposure to penalties.

Ecosystem links