The New Cybersecurity Framework: What Was Left Undone

The verdict of the public consultation

On 14 April 2026 I submitted ten proposals to the public consultation. The verdict has now arrived — and it says as much about the regulation as about what still remains to be done.

On 14 April 2026 I published on LinkedIn From Regulatory Compliance to Operational Resilience: 10 Proposals for the New Cybersecurity Framework, and I submitted those same ten proposals to the public consultation on the Projeto de Regulamento de execução do Regime Jurídico da Cibersegurança (the draft implementing regulation of Portugal’s Legal Framework for Cybersecurity, which transposes Directive (EU) 2022/2555 — the NIS 2 Directive).

The Centro Nacional de Cibersegurança (CNCS, Portugal’s National Cybersecurity Centre) has since published the Public Consultation Report. For the sake of rigour, it is worth taking stock — and doing so by separating what the report says from what I, as an engineer, read in it. These are distinct levels and must not be confused.

Part I — The facts (what the report contains)

Everything in this section can be checked in the Public Consultation Report and the documents of the process. There is no interpretation here.

• Framework. This is the Implementing Regulation of the Legal Framework for Cybersecurity, approved by Decreto-Lei n.º 125/2025, de 4 de dezembro (Portuguese Decree-Law No. 125/2025 of 4 December), as part of the transposition of the NIS 2 Directive.
• Consultation period. It ran from 10/03/2026 to 22/04/2026, under Article 101(2) of the Código do Procedimento Administrativo (Portugal’s Code of Administrative Procedure).
• Participation. The CNCS received contributions from 56 organisations and individuals.
• Authorship of the report. Document signed by the Coordinator of the CNCS, Lino Santos (June 2026).
• Verdict on my ten proposals. All ten were classified as “Não acolhido” (not accepted). The report justifies each refusal essentially with three recurring arguments: the Regulation already sets mandatory minimum measures, “applicable in a comprehensive, cross-cutting way and intended to cover the largest possible number of situations”; verification of their application “takes into account the principle of proportionality”; and it is up to each entity, depending on its residual risk analysis, to implement more demanding measures.
• Changes on the risk-management axis. Over the whole process, the Regulation underwent dozens of wording changes that were accepted or partially accepted (among others, Articles 6, 13 to 17, 22 to 28 and 30, and several controls in Annex III). On the axis that concerns me — the management of residual risk and the asset inventory — the two substantive changes were: Article 31 — wording clarified so that it now refers expressly to the analysis and management of cybersecurity risk and of residual risk, based on the logic of critical processes and functions; Article 32 — wording changed, limiting the obligation to list assets to those directly accessible to the public over the Internet (a contribution in which, among others, MEO’s position was partially accepted).

This is the factual record. My ten proposals were not accepted as such. Strictly speaking, however, one of the vectors I defended did see the text move: control PR.FC-2 (training of staff with specialised functions), at the centre of my Proposal 9, was changed — even though the report credits the change to contributions from ANA, E-REDES, CTT and the Aliança para a Cibersegurança (Cybersecurity Alliance), and not to mine. The formulation “10/10 not accepted” is therefore formally exact; in substance, the Regulation moved on a matter I had flagged, without referencing it.

Part II — The analysis (my engineering reading)

Methodological note. Everything that follows is analysis for which I am responsible. The “reading of convergence” below results from the cross-check I myself make between my contribution and the public contributions of other entities. It is not a formal finding of the CNCS, which assesses contributions entity by entity and does not aggregate them by risk vector.

1. I was not alone in the diagnosis — and this can be checked

What Table 1 shows. Three risk vectors in which other participants in the consultation reached, on their own, the same diagnosis as the ten proposals, and the verdict the CNCS gave to those contributions: reference standards for OT, proposed by Siemens and the University of Minho (not accepted); maturity and evidence in the supply chain, by JCF, TAG and SPMS (not accepted or partially accepted); and the resilience of communications if systems collapse, by EDP (accepted).

My reading — and I present it as a reading — is that the heavy-engineering community and infrastructure operators identified the same blind spots independently. I impose a distinction on myself, however: there was convergence in the diagnosis, not necessarily in the remedy. Several entities touched on OT and the supply chain, but sometimes asked for solutions in the opposite direction to mine — NOS, for example, asked that supply-chain risk management be “calibrated to the impact, criticality and nature of the suppliers”, that is, more leeway; I argued for the opposite, a regulatory floor. This is precisely what sets my contribution apart: where most asked for flexibility, I asked for a prescriptive minimum calibrated to the physical consequence. The fact that Siemens asked for specific reference standards for OT, and that the regulator refused them on the grounds of generic comprehensiveness, is the central symptom of the problem I describe next.

2. The incoherence of proportionality: the argument that turns the regulator’s key against its own decision

The CNCS rejected the OT/IT differentiation (my Proposal 1), stating that the Regulation “already responds to the need for network segregation, to the requirement of zero trust and to the risk management of assets, including legacy and OT”, and that “the measures are intended to be as comprehensive as possible”. At the same time, and across the board, it invokes the principle of proportionality.

This is precisely where the internal contradiction lies — and this is the technical point I want to make clear:

Cross-cutting comprehensiveness and proportionality are not the same thing. They tend to be opposites.

Proportionality, strictly speaking, requires the measure to be calibrated to the consequence of failure. The Regulation does not ignore differentiation — it stratifies the measures into Basic, Substantial and High levels, indexed to the Risk Matrix and to the classification of the entity. The problem, therefore, is not the absence of differentiation; it is the axis along which it is made. The levels of the QNRCS (Quadro Nacional de Referência para a Cibersegurança, Portugal’s national cybersecurity reference framework) scale with the classification of the entity; the cyber-physical consequence, however, does not reside in the entity — it resides in the asset. The same essential operator houses, under the same compliance level, a mail server and a PLC (programmable logic controller) that commands the circuit breakers of a high-voltage substation or the gates of a port — and the physical consequence of compromising each one is incommensurable. This is the variable that differentiation by entity does not capture and that proportionality obliges us to weigh: the cyber-physical impact at the level of the zone and the conduit, not of the legal person.

Engineering itself has already solved this problem. The ISA/IEC 62443-3-2 standard puts proportionality into practice through zones and conduits with Target Security Levels (SL-T) assigned by risk assessment. In other words: the technical standard that gives concrete form to the principle of proportionality in an OT environment is exactly the one the Regulation refused to reference.

What Figure 1 shows. On the left, the IT zone (mail server, corporate systems), whose security level is set by the classification of the entity. On the right, the OT zone (a PLC that commands a circuit breaker, a port gate, a high-voltage substation), where what counts is the physical consequence of a failure. Between the two, a conduit with human validation. The bar at the bottom shows the consequence of failure growing from IT towards OT. The line at the foot sums it up: the target security level (SL-T) should be calibrated to the zone, not to the entity — proportionality means calibrating, not levelling.

Hence my analytical conclusion: by referring OT differentiation to “proportionality assessed at the verification stage”, the regulator did not apply proportionality — it postponed it, transferring to the operational engineer on the ground a decision that should have a regulatory floor. I do not impute bad faith to the CNCS; I point to an incoherence of principle that can still be corrected by means of a technical instruction.

3. What I defended, with due technical rigour

What Table 2 shows. The ten proposals, each with the control of the draft regulation it concerns; the contributions of other participants that pointed in the same direction; the verdict the CNCS gave to those contributions; and, in the last column, the verdict on the author’s proposal: “not accepted” in all ten.

Formal score. The ten proposals were rejected in full (10/10 “Não acolhido”), with an unvarying standard justification from the CNCS: “the Regulation already responds / entities may implement more demanding measures depending on their risk analysis”. There was not a single direct acceptance — even though, as I noted in Part I, the text moved on one vector I had flagged (PR.FC-2), through other contributors.

Convergence (6 of the 10). Proposals 1, 2, 4, 5, 8 and 9 were corroborated by third parties — leading operators and manufacturers in the field of critical infrastructure: BSO Consulting, Thales, Siemens, RS, APRITEL, NOS, E-REDES, CTT, ANA Aeroportos, TAG, JCF and the Aliança para a Cibersegurança. The technical core of the contribution was not marginal: it coincided with the engineering reading of the industry itself.

Decisive contrast. In the very controls where I made proposals (PR.FC-2 training, PR.GA-3 MFA, GR.CA-7 supply chain), the CNCS accepted or partially accepted — but always through the other contributors. The fault line is not technical; it lies in the nature of the request: the accepted contributions asked for clarification or correction of the wording of existing controls; I proposed regulatory additions (new obligations in the text, at the “High” level). The regulator systematically rejected the creation of new obligations, referring them to the autonomy of the entity and to the principle of proportionality.

Pioneering proposals (6, 7 and 10). Post-Quantum Transition (PQC), Cyber Insurance and AI/Algorithm Integrity were proposed by me alone — none of the other 55 participants raised them. They were rejected with the same generic argument of referral to the entity’s risk analysis, without a substantive assessment of their forward-looking merit. It is the clearest indicator of anticipation compared with the body of contributions: matters that the Implementing Regulation, in this version, chose not to develop in detail.

I take advantage of this assessment to clarify three points which, in their popularised wording, deserved greater engineering rigour. I do so on purpose: technical credibility is also built by correcting oneself.

On OOBM and recovery (Proposal 3). The Out-of-Band management network (OOBM) is not, in itself, a black start capability. Black start is a procedure for restoring the power system (self-starting units, controlled islanding and resynchronisation). What OOBM guarantees is the segregated command and telemetry plane that allows the operations team to maintain observability and remote control during a restoration, even with the production network compromised by ransomware. It is an enabler of the response, not the act of restoration. The correct wording matters, because it is what distinguishes an implementable regulatory requirement from a vague promise.

On automation and grid stability (Proposal 4 — Human-in-the-Loop). This proposal is not autonomous: it is the justifying consequence of Proposal 1. My concern is stated as a scenario, not as an accomplished fact: if an automated mitigation decision had direct tripping authority over synchronous generation, the resulting rise in RoCoF (rate of change of frequency) in a grid with a high penetration of power electronics could compromise dynamic stability. It should be stressed that a correct architecture of zones and conduits (Proposal 1) would prevent, from the outset, an IT mitigation control from exercising direct destructive command over OT — which is why the two points are, in essence, one: it is to block this causal chain — false positive → trip → loss of generation → dynamic instability — that a destructive decision in OT cannot do without both human validation and the segmentation that confines it. The regulator’s answer (measure DE.MC-7, which returns the management of false positives to the entity) confirms the gap: the option exists; the floor is missing.

On the credentials vector (Proposal 5). I maintain my defence of phishing-resistant MFA (FIDO2/PKI) for administration profiles. For the sake of rigour, I avoid headline numbers: it is enough to note that credential compromise remains, recurrently, among the main initial access vectors reported in the sector’s incident telemetry (a line consistent with successive editions of the Verizon DBIR). A percentage is not needed to justify the measure; risk engineering is enough.

Conclusion: proportionality properly understood is the way, not the obstacle

The Regulation is a milestone. But its weakest point is not its ambition — it is the axis of its differentiation. By stratifying the measures by the classification of the entity and not by the cyber-physical consequence of the asset, it treats Operational Technology as a special case of the IT regime — which is incompatible with the very principle of proportionality that the regulator invokes to justify it.

The correction does not require reopening the law. It requires a technical instruction that makes the OT regime autonomous, anchored in IEC 62443-3-2 and in the logic of zones and conduits with security levels calibrated to the physical consequence of failure. It is proportionality — this time applied, not postponed.

Resilience is not decreed on a sheet of paper; it is built with rigour and engineering on the ground. The ten proposals were not accepted. The diagnosis that supports them, however, still stands.

I remain entirely at your disposal for any further technical discussion that may be considered useful.

— Gaspar do Amaral

Regulatory references

• Directive (EU) 2022/2555 (NIS 2 Directive)
• Decreto-Lei n.º 125/2025, de 4 de dezembro (Portuguese Decree-Law No. 125/2025 of 4 December, Legal Framework for Cybersecurity)
• Public Consultation Report on the Implementing Regulation of the RJC (Legal Framework for Cybersecurity), CNCS (June 2026)
• ISA/IEC 62443-3-2 — Security risk assessment for system design (zones, conduits and SL-T)
• NIST SP 800-207 — Zero Trust Architecture
• ANSI/TIA-942 — data centre infrastructure redundancy, including redundant distribution paths (Tier III/IV)
• ISO 22301 / NIST SP 800-34 — business continuity and contingency planning (path diversity and recovery)
• Verizon Data Breach Investigations Report (DBIR) — initial access vectors

The ten original proposals were submitted to the public consultation on 14 April 2026. This text is the technical assessment of the corresponding verdict.

Methodological note

What this page is. A translation of the article the author published on LinkedIn on 25 June 2026; the full Portuguese version is on this site.

Tables and figure. The two tables and the figure of the original were images with texts in Portuguese; they were redrawn with the same content, translated. They reproduce the author’s reading of the CNCS Public Consultation Report (June 2026), not an official aggregation by the regulator. The paragraphs “What Table 1 shows”, “What Table 2 shows” and “What Figure 1 shows” were added in the translation to explain each image, following the author’s rule for his articles; they add no new facts.

Names of laws and labels. The Directive is cited by its official English name. Portuguese instruments without an official English translation (Decreto-Lei n.º 125/2025, Código do Procedimento Administrativo, the draft Regulation and the QNRCS) are kept in Portuguese with an explanation in brackets. The CNCS verdicts are quoted in Portuguese (“Não acolhido”, not accepted) with a translation. Codes such as PR.FC-2, PR.GA-3, GR.CA-7, ID.GA-2 and DE.MC-7 identify controls in Annex III of the regulation and are kept as in the original.

References

1. Gaspar do Amaral — From Regulatory Compliance to Operational Resilience: 10 Proposals for the New Cybersecurity Framework (14/04/2026) — the ten proposals submitted to the public consultation
2. Centro Nacional de Cibersegurança — Regulamento do Regime Jurídico da Cibersegurança (consulta pública) — Public Consultation Report and documents of the process (in Portuguese)

Gaspar do Amaral · Original in Portuguese of 25 June 2026, published on this site; translation issued on 27 October 2026 · Figures and tables © Aprecisa.com · AI-assisted