RJCS · Articles 31 and 32
Cybersecurity Officer (RCS) and contact point
According to the clarification from CNCS to Cyberprotech, the Cybersecurity Officer (RCS) must be part of the entity’s own staff. External CISOaa/vCISO support does not replace this statutory role. Article 31 applies to essential and important entities, subject to the specific arrangements in paragraphs 6 and 7; each entity’s classification must be confirmed. The PCP is a separate role governed by Article 32.
For whom
When this article must enter into the plan.
Essential and important entities subject to the designation and communication provided for in Articles 31 and 32.
Brief tutorial
Four steps to start with method.
Adapt the depth, the responsible and the evidence to the concrete framework of the entity.
- 01
Set Template
Define the internal RCS and distinguish provider support. Assess the PCP arrangements separately; third parties may perform that role under the applicable rules.
- 02
Formalise Cybersecurity Officer (RCS)
Document the appointment of a person within the entity’s own staff who is a member of its management, executive or administrative bodies or reports organically and directly to them, including duties, resources and replacement arrangements.
- 03
Organize contact
Create monitored channels, scales, suplence, screening, scaling and availability tests.
- 04
Communicate and maintain
Make the required communications, preserve evidence and update changes within the applicable time limits.
Proof
Evidence to prepare.
- Act of appointment of the Cybersecurity Officer (RCS)
- Description of functions and reporting
- Accountct point procedure and scale
- Communication and testing receipts
Warning
Errors that weaken implementation.
- Confusing an email box with permanent availability
- Do not provide for replacement or leave
- Appoint without powers, means or access to management
Quick control
Initial checklist.
- Internal RCS formally appointed where required by the confirmed classification
- Report defined
- Permanent channel monitored
- Supple tested
- Filed communication
Frequently Asked Questions
Two key answers.
The Cybersecurity Officer (RCS) and the contact point must be the same person?
The articles deal with different functions. The concrete model must comply with legal requirements and ensure effective coordination and availability.
Can a supplier participate in the model?
According to the clarification from CNCS to Cyberprotech, the Cybersecurity Officer (RCS) must be part of the entity’s own staff. External CISOaa/vCISO support does not replace this statutory role. Third parties may perform the PCP role under Article 32; management retains its duties.
Primary source
Decree-Law No. 125/2025 of 4 December
Information tutorial. Always confirm the official text, the applicable regulations and the specific framework of the organization.