Risk matrix · Basic Level
0 ≤ total ≤ 99
Basic Level
The Basic level corresponds to a total between 0 and 99 in the matrix. It is the first mandatory level for essential or important entities to which this level is determined.
Without replacing matrix
How the total is built.
The interval is the final result. These are the factors that help to understand where the points come from.
Scenarios and actors
The matrix considers dominant risk scenarios and types of actors relevant to the sector or subsector.
Probability
Use a scale of 1 to 5 and historical information, CERT.PT and expert contributions in accordance with Annex II.
Impact
It uses a scale of 1 to 5, from limited impact to generalized or catastrophic consequences.
Size
The value is weighted depending on whether the entity is large, medium or small.
Importance of sector
Sectors in Annex I RJCS have weighting 1,5; Annex II sectors have weighting 1.
Total
The calculated values for each scenario and actor are added and the total interval determines the level.
Operational Reading
Where to focus your attention.
- Identify applicable legal and regulatory requirements
- Document critical services and external dependencies
- Setting resilience requirements
- Organize measures, responsibility and evidence
- Evaluate risks remaining after minimum measures
Start without complicating
Four practical steps.
- 01
Confirm decision
record the level communicated by the authority and the scope of the entity to which it applies.
- 02
Extract measures
Create a controlled list of the basic level measures listed in Annex III.
- 03
Associate evidence
To relate each measure with factual, documentary or technical evidence and its responsible.
- 04
Treat gaps
Prioritize unimplemented measures and assess residual risk.
Proof
Key evidence.
- Decision or registration of the applicable level
- Basic Level Measurement Matrix
- Documents and records required by the verification criteria
- Failure treatment plan and residual risk
Warning
Avoid wrong readings.
- Do not interpret Basic as optional or expendable.
- Do not limit implementation to the existence of policies.
- Always confirm the verification criteria for each measure.
Frequently Asked Questions
Two straight answers.
Does the basic level mean low risk?
Not necessarily. It is the level resulting from the total matrix and determines minimum measures; it does not replace the residual risk analysis of the entity.
Can the entity apply higher measures?
Yes. Minimum measures are a mandatory level and do not prevent additional measures appropriate to the risk.
Primary source
Regulation No. 756/2026 of 22 June
Information guide. The level is determined by the official matrix and communicated when applicable in the qualification procedure; it does not result from a self-choice or from this guide.