Practicing decisions for everyday work
An urgent payment request. An IBAN change apparently sent by a supplier. An authentication notification nobody requested. An outage that leaves the team unable to access work documents. Cybersecurity takes shape in these moments, through the decisions of those who receive, verify, report, and act.
Preparing for those decisions requires practice connected to the organization's reality. That is the focus of Academia Cyberprotech®: helping each person understand their responsibility and apply it at work, with content adapted to their role, sector, and risks.
Training is part of management's responsibilities
In Portugal, the Cybersecurity Legal Framework (RJCS), approved by Decree-Law No. 125/2025 of December 4, transposed the NIS2 Directive. For essential and important entities, Article 25 assigns management, executive, and administrative bodies responsibility for approving and overseeing risk management measures and ensuring regular training. Article 27(1)(f) includes cyber hygiene and training for managers and employees among the areas covered by cybersecurity measures. [1]
Regulation No. 756/2026 of June 22 develops this framework. The national cybersecurity reference framework (QNRCS) distinguishes general awareness from training suited to specialized and management roles. Applicable measures and verification criteria include participation records and, depending on scope, plans and effectiveness assessments. Implementation should reflect the entity's qualification and applicable level or group. [2]
For management, the practical consequence is to integrate training into organizational planning: define who needs to learn, which decisions they should be able to make, and how progress will be tracked. Leaders also need preparation to assess priorities, resources, continuity, and incident response.
Each role needs appropriate preparation
An effective program starts by identifying the skills each team needs. ENISA's European Cybersecurity Skills Framework links professional roles to responsibilities, knowledge, and skills, supporting training design. In Portugal, the CNCS courses announced by NAU in October 2026 likewise distinguish preparation for executives and holders of the Portuguese Cybersecurity Officer role (Responsável de Cibersegurança, RCS). [3][4]
This distinction can be applied in practical terms within an organization:
Management and executive teams. Understand the impact of risks, approve priorities, oversee measures, and practice decisions during a business interruption.
Administrative and operational teams. Recognize fraud attempts, verify sensitive requests, protect access, share information securely, and report suspicious situations through internal channels.
Cybersecurity Officers and technical teams. Work on risk management, response procedures, recovery, supplier coordination, and the records that demonstrate implementation of measures.
A local authority, a social welfare organization, an industrial company, and a professional services office have different routines and dependencies. Examples, exercises, and priorities should reflect that reality, including when training is adopted voluntarily or as a contractual requirement.
Tailored training with Academia Cyberprotech®
At Academia Cyberprotech®, tailored training starts with each organization's context. We define participants, objectives, depth of content, and schedule, aligning learning with the team's needs. Programs can include practical cases, tabletop exercises, technical sessions, and assessment. [5][7]
This approach allows different participation and delivery formats to be combined:
One-to-One. Individual training with close support and a pace adapted to the participant. Suitable for exploring responsibilities, clarifying specific questions, or addressing an executive's or professional's needs.
One-to-All. Training for a group or team to establish shared knowledge and align procedures. Class size and activities are defined according to the objectives, preserving room for interaction.
Live. Online sessions in real time, with a trainer, active participation, questions, and discussion of scenarios relevant to the organization.
In person. Sessions with direct contact between the trainer and participants, suited to collaborative work, procedure discussions, and practical exercises.
Hybrid. A combination of in-person and online sessions, which may include independent preparation or reinforcement activities, depending on the agreed program.
One-to-One and One-to-All define support and participation; Live and in-person delivery define how sessions take place. They can be combined in one learning pathway, with duration and frequency adapted to the needs identified.
From awareness to implementation and ongoing review
The Academy catalog includes the NIS2 and RJCS — From Introduction to Implementation, Evidence, and Monitoring pathway. The pathway comprises four independent and combinable levels: context, implementation, evidence, and monitoring and improvement. Format and schedule can be adapted to the organization. [6]
The catalog also includes NIS2 Awareness for Operational Teams, a Phishing and Response Tabletop Exercise, and a Tailored Resilience Program. These programs address different needs and help organize a learning sequence appropriate to the audience. [7]
In a tailored pathway, we can start with leadership preparation, develop sessions for teams, and finish with a joint exercise. The sequence is agreed with the organization, taking account of its starting point and intended outcomes.
Practicing situations teams need to resolve
A tabletop exercise can simulate a fraudulent request to change bank details or an unavailable invoicing system. Participants work through the decisions defined in procedures: who verifies the information, who receives the alert, who decides the response, and how operations continue.
This work helps identify uncertainties and correct procedures before they are needed in a real event. It also creates conditions for people to report a suspicion or mistake quickly, with clarity about what to do and whom to contact.
Learning should be reinforced over time, especially when new employees join, tools change, or processes are reviewed. Frequency is part of program design and should reflect risk and the organization's development.
Assessing learning and demonstrating the work completed
The Academy includes assessment and verifiable certificates in programs where applicable, with consultation and validation mechanisms. Training documentation helps organizations track completed pathways and gather evidence for internal management. [5]
We recommend that training records include objectives, content, dates, duration, participants, assessment results, and improvements identified. Results should support decisions: reinforce a topic, clarify a procedure, or adapt the next exercise.
A certificate confirms completion under the program's terms. Overall compliance with NIS2 and the national framework also requires governance, technical and organizational measures, implementation, and ongoing review. Training contributes to that work and should be integrated into it.
Prepare your team with Academia Cyberprotech®
If you want to prepare leadership, strengthen team knowledge, or structure a cybersecurity training plan, talk to us. Share your organization's activity, participants' roles, priorities, and preferred format.
At Academia Cyberprotech®, we design a tailored learning pathway with you, with specific objectives and practical application. One-to-One or One-to-All. Live, in person, or hybrid. With support suited to those who need to decide and act.
Explore the offering and request a proposal at academia.cyberprotech.pt, or contact academia@cyberprotech.pt.