Course MyCiber
the first access to conformity in operation.
Prepare the data, formalize the representation, follow the qualification and keep people, communications and evidence constantly up to date.
Overview
MyCiber It's not just a registration form.
It is the channel of identification, qualification, communication and monitoring between the competent entities and the relevant cybersecurity authorities.
- Management
- CNCS
- Account
- One per entity
- Initial access
- Legal representative
- Autoidentification
- Provisional registration
- Audience
- 10 working days
- Result
- Qualification or exclusion
Full tour
Eight stages, with a verifiable result in each.
The route separates internal preparation, acts on the platform and decisions of the competent authority.
-
01
Ready · RJCS, Articles 3 to 9
Confirm possible framework
Map activities, sectors, subsectors, size, establishment and services provided. The simulator helps, but does not bind the Administration or replace the compulsory self-identification.
Result: Frame memory and validated data -
02
Representar · Regulation, Articles 6 and 7
Define who practices the acts
Initial access shall be provided by the legal representative, with high-level electronic identification, or by a representative with legally admissible powers and evidence thereof.
Result: Prepared representative and mandate or delegation -
03
Identify · Regulation, Article 8
Fill and submit self-identification
Fill out the forms, fix marked errors and confirm submission. A single provisional registration shall be established per entity, even if there are several sectors.
Result: Receipt with submission date and time -
04
Acompanhar · Regulation, Article 8(4)
Reply to additional requests
The competent authority may request, for once after the form, additional information or documents to prove a data or data group that it cannot obtain by interoperability.
Result: Additional items submitted and receipt filed -
05
Pronunciar · Regulation, Article 9
Analyze the draft decision
The entity shall be notified on the platform and by email to hold an audience of interested parties. The pronunciation is presented in the proper field within 10 working days.
Result: Reasoned pronunciation or non-pronunciation decision -
06
Consolidar · Regulation, Articles 9 and 10
Receive the final decision
The decision may qualify the entity, indicate the level and measures applicable or conclude that it is outside the scope. Where there is qualification, the provisional registration shall be definitively consolidated.
Result: Decision, classification and registered obligations -
07
Designar · Regulation, Articles 14 and 15
Communicate the Cybersecurity Officer (RCS)
Key and important entities report to the Cybersecurity Officer (RCS) and the team or third party responsible for the Permanent Accountct Point (PCP), with the contacts required.
Result: Cybersecurity Officer (RCS) and Permanent Accountct Point (PCP) formally communicated -
08
Operar · Regulation, Articles 11 to 22 and 32
Maintain communications and evidence
Update data, consult notifications, communicate documents, publicly accessible assets and incidents and preserve receipts and evidence. MyCiber It becomes a continuous process.
Result: Register updated, traceable and verifiable
Before you come in
Prepare the information before you start.
Coherent internal collection reduces errors, additional requests and differences during qualification.
Entity
- Name and NIF
- Updated address and contacts
- Applicable sectors and subsectors
- Type of entity and establishment
Size
- Number of employees
- Annual turnover, where applicable
- Total annual balance sheet, where applicable
- Member States where it provides services, where applicable
Representation
- Legal representative identified
- Citizen Card or Digital Mobile Key
- Professional attribute, when available
- Mandate or act of delegation, where applicable
Operation
- Organization
- Accession to the SPNE if existing
- Candidate for Cybersecurity Officer (RCS)
- Team or third for permanent contact
Responsibility and contact
Three roles that shouldn't be confused.
Legal representative
Creates or represents the entity's account and ensures the transition before termination of functions.
Cybersecurity Officer
Function communicated by essential and important entities, together with the relevant elements and designation act.
Permanent Accountct Point
On-going internal team or third party contactable through core and alternative contacts.
After qualification
The final registration shall commence the continuous operation.
Permanent update
The data submitted shall be the responsibility of the entity and shall remain up to date.
Electronic notifications
The notification shall be deemed to be made in the consultation of the reserved area or, if not consulted, at the end of the third day after receipt.
Documents and annual report
The essential bodies shall report on an annual basis; the relevant bodies shall refer it to them when requested. The mandatory models made available shall apply.
Incidents
The platform associates notifications of the same incident and may issue alerts, but the lack of alert does not rule out compliance with deadlines.
Public assets
The list of assets directly accessible via the Internet shall be drawn up, updated and communicated.
Unavailability
When it is not possible to wait, there are alternative channels; the information is then integrated into the reserved area.
Dossier MyCiber
Keep what was decided, submitted and received.
Receipts and documents allow you to reconstruct the procedure, demonstrate deadlines and maintain account governance.
- 01Internal memory of the frame and sources used
- 02Mandate, delegation or act legitimizing representation
- 03Autoidentification receipt with date and time
- 04Additional requests, replies and receipts
- 05Draft decision, pronunciation and final decision
- 06Acts of designation and communications of the Cybersecurity Officer (RCS) and PCP
- 07History of relevant changes, notifications and accesses
- 08Documents, reports and notifications of submitted incidents
Reference periods
Don't just depend on the platform alerts.
Always confirm the initial date and the arrangements applicable to the specific case.
Entity already active
From the availability of the platform for this purpose, in accordance with Article 8 of the RJCS.
New entity
From the beginning of the activity in accordance with Article 8 of the RJCS.
Hearing of interested parties
from the notification of the draft qualification decision.
Notification not consulted
It shall be deemed to have taken place on the third day following the electronic receipt.
Frequently Asked Questions
Avoid misinterpretation.
The simulator of MyCiber Does it legally confirm the framework?
No. The instrument is informative, does not constitute administrative self-connection and does not dispense with self-identification when required.
Is there an account per sector or an account per entity?
There is an account and a provisional registry per entity, regardless of the number of sectors or subsectors of activity.
Who can represent the entity?
The legal representative may authenticate himself with a high-level electronic identification system. The entity may also be represented by legally admissible means, in particular by duly substantiated mandate.
PCP Does that mean continuity plan?
Not on this route. PCP means permanent contact point: the internal team or third party notified to ensure availability of contact.
Does the entity choose between Essential, Important or Relevant Public?
No. The qualification results from the decision of the competent cybersecurity authority after the self-identification and hearing of the interested parties.
After the final registration, does the case end?
No. The information shall remain up-to-date and the platform shall support communications, documents, notifications, incidents and other duties during the period of registration.
Primary sources
Confirm the act and use only the official portal.
Information and operational guide. It shall not replace the legal analysis of the entity, the instructions of the competent authority or the use of the official portal MyCiber.