Frequently asked questions Page 17 of 27

Frequently asked questions — page 17

• Am I required to declare income earned abroad?

  In many cases, yes—there is an obligation to declare income earned outside Portugal. The rule depends on the type of income and how it is classified for tax purposes. To confirm your situation, speak to an accountant or review the applicable tax guidance.
• What is subject to 13% VAT?

  The reduced VAT rate can apply to certain goods and services, according to the legal list in force. The specific application depends on the nature of the service and how both the supplier and the customer are classified for tax purposes. Check the service classification and the applicable rule.
• How much Corporation Tax does a company pay?

  Corporation Tax depends on the tax regime, the taxable base, and any special factors (exemptions, deductions, and special regimes). To estimate accurately, you need to review the company’s accounts and how it is classified for tax purposes. An accounting professional can validate the calculation.
• How can I find my VAT number?

  In Portugal, the tax identification number (NIF) is used in the VAT context, and validation can be done through official channels. For companies, the number appears on tax documentation and in the register. Always confirm through official sources or with your accountant.
• What happens during a consulting engagement?

  In consulting, we start by diagnosing the current situation, gathering requirements and carrying out a risk analysis. Then we define a phased strategy and plan, with deliverables and acceptance criteria, which may include implementation and ongoing follow-up.
• What types of consulting are available?

  There are several types, such as IT consulting, cloud consulting, system audits, cybersecurity consulting, and process/automation consulting. The choice depends on the goal: reducing costs, improving security, modernising, or scaling.
• How do I set up a consulting firm in Portugal?

  In general terms, it involves defining the type of activity, choosing the legal form, handling registrations and tax obligations, and preparing commercial documentation. For the details, it’s worth confirming requirements with official bodies and with specialist support.
• What information is needed to start an IT audit of the systems?

  Typically, you’ll need inventories of assets and systems, architecture documentation, policies and procedures, an access matrix, available logs/records, and evidence of backups and tests. Based on that, we define the scope, boundaries and evaluation criteria.
• What are the main deliverables of an IT audit of the systems?

  The most common deliverables include the audit report, a control matrix with supporting evidence, classification of findings by risk, and a prioritised action plan. In projects with follow-up, there may also be verification of implementation and evidence of remediation.
• Does the audit focus only on information security, or also on governance and operations?

  It can cover both, depending on the scope that’s defined. In general, it includes governance and lifecycle, operations and infrastructure, data protection, continuity and access controls, as well as information security.
• How are controls evaluated in the audit (prevention, detection, remediation and recovery)?

  The assessment combines documentary and technical evidence: configurations, functional tests, log analysis, and validation of backups/recovery. Controls are classified by their effectiveness and by how well they reduce risk across the full lifecycle.
• Can the audit be aligned with frameworks such as ISO 27001, COBIT or ITIL?

  Yes. Alignment is done through control and process criteria and mapping, ensuring traceability between the framework requirements and the evidence collected. The outcome makes external audits easier and demonstrates compliance.
• What are the first cybersecurity measures a company should implement to reduce risk quickly?

  Start by protecting identity and access (MFA), strengthening email security against phishing, and ensuring endpoints have up-to-date protection. In parallel, validate backups with restore tests to reduce the impact of ransomware.
• How does risk assessment and the definition of a unified cybersecurity strategy work?

  The assessment maps assets, threats and vulnerabilities, sets priorities based on impact and likelihood, and translates this into a layered roadmap. Then, the strategy is operationalised with monitoring, incident management and continuous improvement.
• Which email and endpoint protection is most important to combat phishing and ransomware?

  For phishing, email protection (detection and blocking) and identity-verification policies reduce the attacker’s success. For ransomware, endpoint protection and segmentation limit spread and speed up containment.
• How can I make sure backups and disaster recovery are actually effective (not just "available")?

  Require regular restore tests, with time metrics and validation of data integrity. Define recovery objectives (RTO/RPO) and run scenario simulations to confirm the process works under pressure.
• What GDPR obligations should I consider for information security, and how do they translate into actions and evidence?

  GDPR requires appropriate technical and organisational measures based on risk, including recovery capability and data protection. In practice, you need documentation, demonstrable controls, access management and incident response procedures.
• What are the essential VoIP features for an enterprise virtual switchboard?

  The most relevant typically include IVR/virtual assistants, call queues, automatic call forwarding, voicemail, call recording (when applicable) and extension management. It’s also worth considering WebPhone and integrations with CRM/ERP.
• Does VoIP work well for remote working and support outside the office?

  It works well when the user’s network has solid connectivity and when the provider applies good QoS and security practices. For businesses, it’s important to validate access policies, endpoints and monitoring.
• Do I need to buy hardware to use VoIP in the cloud?

  In many scenarios, it’s not necessary to buy a dedicated PBX, as the switchboard can be provided in the cloud. That said, you may still need IP phones, gateways or network configuration depending on the design.
• How do encryption and protection against attacks affect the choice of provider?

  Encryption and endpoint protection reduce the risk of interception and attacks. In addition, look for authentication, access management, patching and incident response policies, backed by support and monitoring.
• How do I calculate the total cost of VoIP for my business?

  Consider variables such as the number of extensions, calls (origination/destination), costs for numbers/porting, call recording, IVR, integrations and support. Ideally, request an estimation model based on your actual volume.
• What additional protection should I require besides cloud backup?

  Besides backup, require layers such as encryption, access controls and auditing. To reduce the impact of incidents, complement this with antivirus, intrusion detection and incident response policies.
• Can cloud backups be automatic and scheduled to avoid failures caused by forgetfulness?

  Yes. Ideally, backups should be automated with scheduling and monitoring, to ensure copies run and failures are detected quickly. Request evidence of alerts and reports.
• How does data security work—are the data encrypted before they’re stored in the cloud?

  In line with best practices, data should be encrypted before it’s stored in the cloud, with protection both in transit and at rest. Confirm the key management model, permissions and repository access policies.
• Can I access backups via the web whenever I need and from anywhere?

  Many services provide web access, but with permissions and traceability. Check whether there is granular control, auditing and clear procedures for restoration by authorised teams.
• What should I prepare to implement backup: critical data and regular schedules?

  Start by identifying critical systems and data, setting priorities and establishing intervals based on risk and impact. Then align retention, RPO/RTO and restore testing to validate that recovery works.
• What features should I look for in an enterprise phone system to improve customer service?

  Look for time- and availability-based call forwarding, call queues, IVR and voicemail with notification. If the volume justifies it, include call summaries and automation to reduce manual work and missed calls.
• Can a virtual phone system include call queues and call forwarding?

  Yes. Cloud switchboards support rule-based routing, transfers and call queues, as well as forwarding to voicemail or other destinations. The design of the rules is what ensures the outcome.
• Is it possible to have 24/7 automated service with AI?

  Yes—within solutions that combine a virtual receptionist and an automated voice agent. How it works depends on the IVR/flow design and the integrations needed to respond with context.
• How do user limits and minute caps work on phone systems?

  Typically, there are limits based on the number of users and included minute caps/minutes in the plan. If you exceed them, you may be charged extra per minute or subject to specific rules by destination.
• What should I check about additional numbering before signing up?

  Check how many additional numbers are included, the costs per number, and how numbering ties into queues, IVR and routing. Also confirm porting rules and destination management.
• Do you assess the situation and recommend the network architecture before the quote?

  Yes. We start with an assessment and the network architecture design (locations, routes/cabling paths, racks and requirements). Only then do we move on to the scope proposal and budget aligned with the business objective.
• Does the installation include wired networks and wireless (WLAN) networks for offices and buildings?

  Yes. We plan and install structured cabling and area-based enterprise WiFi coverage, configuring the active equipment to segment traffic and control access.
• Do you offer remote access and VPN (IPSec/SSL) for external devices and users?

  Yes. The VPN is designed to protect traffic and enable remote access with policies and management, integrating with the rest of the security ecosystem.
• How is maintenance carried out: is there remote monitoring and are there monthly reports?

  Yes. We carry out maintenance with remote monitoring, alerts and regular reports. This helps us anticipate failures and reduce the time needed for diagnosis and resolution.
• Do you include backups and disaster recovery (offsite and/or cloud) to ensure business continuity?

  Yes, as part of the continuity strategy. We define backups and disaster recovery (offsite and/or cloud) to reduce the impact of downtime and data loss.
• What type of system should I choose for my premises: IP (NVR) or coaxial (DVR)?

  The choice depends on the quality you want, the number of cameras, the distances involved and how compatible it is with your existing installation. IP (NVR) is usually more flexible for expansion and integrations, while coaxial (DVR) can be advantageous when you have older infrastructure.
• Is it possible to install cameras that allow remote access from a mobile phone?

  Yes. Remote access is set up with users and permissions, and it usually requires a secure network configuration. The exact method depends on the camera type and the NVR platform being used.
• How many days should I keep the footage, and when should I delete it?

  In many cases, the general rule is to keep it for a limited period (often 30 days), and delete it after that timeframe, unless there are legal exceptions. The system design should reflect the purpose and the applicable framework.
• Can I capture audio with CCTV/video surveillance?

  Audio recording can be restricted and must be assessed carefully in light of the legal and privacy context. In many cases, it is recommended to avoid audio unless there is an appropriate basis and framework.
• Where is it not allowed to point cameras (public roads, customer areas or staff areas)?

  In general, you should not point cameras at public roads or at areas where recording could affect the rights of third parties, such as customer/user and staff areas, depending on the applicable framework. A placement checklist should be validated on site.
• Which parameters should I prioritise in an installation for indoor air quality?

  In general, you start with CO2 and particulates to get a practical read on ventilation and contaminant load. Depending on the context, additional indicators and sampling strategies can be considered for specific needs.
• Can the system run with continuous monitoring and generate trends?

  Yes. A continuous collection architecture allows you to visualise trends, identify patterns and support alerts. The value increases when the data is integrated into a platform with reports and history.
• How do you ensure calibration and validation after installation?

  Calibration should be planned and carried out on site, with consistency tests and verification of measurement points. The goal is to ensure traceability and data quality over time.
• Does the system software allow storing data and supporting reports?

  It should allow storage with history, export and report generation by time period and area. Ideally, it also includes alerts and integration with internal processes to reduce manual response.
• What type of team is needed to implement and operate air control?

  Typically it involves technical teams for installation and commissioning, plus support for operations and maintenance. Where there is technology integration, it is recommended to include expertise in networking, security and data management.
• What information do I need to provide to the installer to size the access control system?

  State the number of doors and barriers, the areas to be protected, user profiles, access schedules and audit requirements. If there is CCTV or alarms, also describe the integrations you want and the current network status.
• Do you install and maintain access control systems for different types of doors and barriers?

  Yes. A professional installer should assess the lock type, the site conditions and compatibility with controllers and readers. For maintenance, it is important to define preventive routines and support procedures.
• Can the system work in offline mode and then sync back to the server?

  Yes, depending on the architecture and the management model. The installer should validate how permissions work in offline mode, how synchronisation is performed and how continuity and auditability are ensured.
• Can I manage user permissions centrally (and from a mobile phone)?

  In many scenarios, it is possible to manage permissions centrally and, in some cases, via remote access through apps. Feasibility depends on the platform and the system design.
• What options are available for integration with video, alarms or building automation?

  Integrations can include access events to trigger video, alarms and automation (for example, opening/closing and zone-based rules). Before installation, compatibility validation and interoperability testing should be carried out.
• Which KPIs should I request in a TI consulting Success Case to validate ROI?

  Request KPIs linked to impact: response time, reduction in incidents, uptime, user satisfaction and cost predictability. Also ask for the baseline and before/after evolution to validate ROI with evidence.
• How long does the initial diagnosis usually take, and what deliverables should I require?

  The diagnosis should produce concrete deliverables: a technical and process assessment, a list of vulnerabilities/bottlenecks and an action plan. Require timelines, owners and a roadmap with priorities and dependencies.
• How does the consultancy ensure improvements in data security during and after implementation?

  Improvements should be continuous: policies and audits, access controls, backup management and continuity testing. Also confirm how monitoring will be carried out and how the post-project review will work.
• What should you look at when adopting cloud and/or artificial intelligence to avoid failures?

  Check whether there is an adoption plan, integration requirements and phase-by-phase success criteria. For AI, ask for data governance, quality validation and risk management to prevent inconsistent results.
• What role do leadership and training for the internal team play in the success of the project?

  Without training and alignment, adoption can fail even with good technology. Require a change-management plan with training, internal owners, follow-up routines and mechanisms for continuous feedback.
• What should I share when contacting an IT company to get a faster diagnosis?

  State which device or service is affected, the specific symptoms, error messages (exact text or a screenshot) and when it started. Add the business impact, what you’ve already tried and the urgency (how many users and which critical processes are involved).
• Can I request remote assistance even if the problem seems serious?

  In many cases, yes. The technician can quickly validate the root cause using remote access and guided tests. If there is a risk of data loss, a hardware failure or a need for on-site intervention, the company will guide the transition to an on-site visit or pickup.
• How does the pickup and delivery process for repairs work?

  The pickup procedure, case registration and return after diagnosis and validation are normally agreed. Prepare backups when applicable and include any relevant accessories to avoid delays.
• Is there an estimate and a diagnosis before moving forward with the repair?

  Many companies provide a diagnosis and an offer based on what has been identified, so expectations are aligned before you authorise the repair. Confirm on contact what the terms are, what’s included and how the outcome will be communicated.
• How long does a repair usually take, and how do I book the service?

  The timeline depends on the type of incident, parts availability and the complexity of the diagnosis. To book, send the full context and indicate the urgency. The company will prioritise based on impact and suggest the next step.
• How long does it take to develop an IT Strategic Plan, and how often should I review it?

  The timeframe varies depending on maturity and data availability, but an initial cycle is usually structured over weeks to a few months. Review should be continuous: monthly cadence for monitoring, with quarterly checkpoints to adjust the roadmap.
• Who should lead the PETI within the company (CIO/CTO, IT, business areas) and how should stakeholders be involved?

  Typically, the CIO/CTO leads, with active participation from business areas to ensure goals are aligned. IT handles the technical translation, while providers and customers step in to validate feasibility, dependencies and requirements.
• How do you define IT targets that genuinely connect to business objectives?

  Start with the business objectives and convert them into measurable outcomes using SMART. Then link each target to roadmap initiatives and indicators (including continuity and performance) to ensure traceability.
• How can you choose priorities when your technology budget is limited?

  Use criteria such as business value, risk, dependencies, continuity impact and total cost of ownership. When there are constraints, prioritise low-cost pilots, incremental phases and the controlled postponement of initiatives outside the budget.
• What practices should you use to reduce risks such as delays, cost overruns and scope failures in the PETI?

  Define scope clearly, set goal-based governance and a review cadence, and use risk management with scenarios and simulations. Track progress with KPIs and continuity indicators so you can act early when deviations appear.
• What is the practical difference between preventive and corrective IT maintenance?

  Preventive maintenance happens before a failure, with inspections and planned routines to reduce risks and degradation. Corrective maintenance starts after the issue occurs, focusing on repairing the fault and restoring operations.
• How often should I do internal cleaning, replace thermal paste and check the cooler?

  Frequency depends on the environment and usage (dust, hours of operation and ventilation). As a rule of thumb, thermal paste can be checked at six-month intervals, and checking drivers and software routines can be done quarterly.
• What are the most important software checks to prevent slowdowns and infections?

  Prioritise system and driver updates, malware checks (anti-virus/anti-spyware), cleaning temporary files and vulnerability control. Regular routines reduce both slowdowns and exposure to attacks.
• Does a preventive checklist really reduce the cost of technical support and downtime?

  Yes, because it reduces the likelihood of recurring failures and cuts down on downtime. It also improves cost predictability by replacing urgent interventions with planned activities.
• How can I set up a preventive programme for a fleet of computers (calendar and priorities)?

  Start by inventorying the devices and classifying criticality. Then define how often each type of task should be performed (hardware, software, security) and record evidence. Use SLAs by severity and review the calendar based on the incident history.
• What criteria determine whether IT corrective maintenance should be immediate, deferred or planned?

  The decision depends on the service criticality, the level of degradation, whether redundancy exists and what contingency is available. If downtime impacts operations with no alternative, it tends to be immediate. If there is contingency and controlled risk, it can be deferred. If preparation and a maintenance window are required, it is planned.
• What does a well-executed IT corrective maintenance process usually include?

  It usually involves detecting the issue and opening the ticket, performing diagnostics (often remotely), carrying out on-site intervention when needed, repairing or replacing the faulty parts, verifying proper operation and documenting both the root cause and the solution. This improves traceability and reduces recurrence.
• When does it make sense to use a palliative approach instead of a curative one?

  A palliative approach is appropriate when you need to stabilise quickly in order to resume operations, while the root cause will still be addressed later with more time and preparation. A curative approach is preferable when the goal is to eliminate the underlying source of the problem and reduce recurrence.
• How can I reduce cost and downtime in IT corrective maintenance?

  Use clear SLAs, monitoring to detect issues early, standardised procedures, and complete documentation in the ticket. In addition, structural fixes and parts/vendor management reduce rework and speed up resolution.
• What kind of risk and incident documentation helps prevent recurrence?

  Record symptoms, impact, evidence (logs and events), recent changes, probable/confirmed root cause, and the actions taken. Complement this with an understanding of the surrounding risk landscape and periodic reviews to turn incidents into operational learning.
• How do I choose the most suitable IT Incident Management approach for my context?

  Assess the volume and criticality of the services, your current maturity, security requirements, and 24/7 response capability. Compare SLAs by severity, escalation paths, reporting, and evidence of readiness to decide between an in-house, hybrid, or managed model.
• What should be included in closing an incident to ensure continuity and compliance?

  Include the root cause (where applicable), corrective/preventive actions, an update to the documentation, and the evidence record. Make sure that stakeholder communications are complete and that the incident is closed only after validating the service recovery.
• How can I automate detection and response (runbooks) without losing control and investigation quality?

  Start by automating repetitive, low-risk tasks, while keeping human validation for critical decisions. Use version-controlled runbooks, escalation criteria, and integrate with monitoring and logs to preserve traceability.
• What metrics help measure the effectiveness of IT Incident Management?

  Use time to first response by severity, average time to resolution, first-level resolution rate, and the availability of critical systems. Complement this with recurrence analysis to measure continuous improvement.
• How can I practically improve preparedness for cyber incidents?

  Set up scenario-based training, test runbooks, recovery exercises, and periodic process reviews. Keep the inventory, critical dependencies, and risk management up to date to reduce uncertainty during response.
• Which is the best cloud service for enterprise storage?

  The “best” option depends on your security requirements, SLAs, data types, and TCO. Compare encryption, auditing, availability, backup options, and total costs before deciding.
• What is virtual storage?

  It is a cloud service that provides storage capacity and operations over the network, with centralised management. Typically, it includes permission-based access, scalability, and protection mechanisms.
• Where should businesses store files online?

  For businesses, the choice should consider governance, access controls, encryption, retention, and recovery. Avoid solutions that are only “free” when you have compliance and continuity requirements.
• What is the practical difference between backup and archiving in corporate cloud storage?

  Backup is intended for restoring after incidents, with defined retention and tested recovery. Archiving focuses on long-term retention and less frequent access, keeping costs and policies aligned.
• What criteria should I use to choose cloud storage for sensitive data?

  Prioritise granular access control, encryption in transit and at rest, auditing, retention policies, and a backup/disaster recovery plan with defined RPO and RTO.
• What are the stages for implementing a cloud solution from scratch up to go-live?

  Typically it includes discovery and inventory, architecture design, migration strategy, security and operational readiness, phased execution (coexistence and cutover), and final validation with testing. At go-live, runbooks, monitoring, and a rollback plan come into play.
• How do I decide between IaaS, PaaS and SaaS for each application?

  The decision depends on the level of control you need, the degree of management you want, and the type of workload. In general, IaaS provides more control over infrastructure, PaaS reduces operational effort, and SaaS accelerates adoption when the process already fits the service.
• What should a migration plan include to reduce downtime and operational risk?

  It should include prioritisation by value and risk, a coexistence strategy, validation criteria, cutover windows, a rollback plan, and restoration tests. It should also cover communication and training to minimise user impact.
• What security measures should I require in the cloud (accesses, encryption, and threat prevention)?

  Require identity as the perimeter (MFA, Conditional Access, and PIM), privileged access policies, encryption in transit and at rest, and protection against phishing and malware. Also ensure event auditing and configuration hardening.
• How can I ensure business continuity and disaster recovery after the migration?

  Define RPO/RTO, implement backups with restoration testing, redundancy, and, where applicable, geographic replication. Continuity should be validated with periodic exercises and procedure documentation.
• Which IT services are the best candidates for outsourcing IT services?

  In general, good candidates include: helpdesk and managed services, infrastructure, cloud, applications with continuous operations, and managed cybersecurity. Ideally, start with services that have stable volumes and clear metrics.
• Are IT services outsourcing and offshoring the same thing?

  No. Outsourcing is a contracting model (delegating operations to a partner). Offshoring is a geographic choice (operating in another country). You can outsource onshore, nearshore, or offshore.
• How do you measure the success of outsourcing IT services?

  Use KPIs and SLAs such as: response time, resolution time, availability (uptime), incident rate, change success rate, and service quality. Combine technical metrics with business indicators.
• What risks should I anticipate when hiring an external provider?

  The main risks are vendor lock-in, misaligned expectations, security failures, and impacts on business continuity. Mitigate them with governance, SLAs/KPIs, security requirements, and a well-defined transition plan.
• How quickly can a company start outsourcing, and which steps are essential?

  Timing varies depending on the scope, but it usually starts with service diagnosis and design, followed by onboarding/transition and SLAs validation. Essential steps include requirements gathering, transition planning, testing, and continuous improvement.
• What is included in IT Network Management for Enterprises?

  It typically includes monitoring, incident management, preventive maintenance, change management, capacity management, and KPI reporting. The scope should be defined by severity and SLAs.
• How does the support model work with SLAs and escalation?

  Response time and resolution time are defined based on criticality, with escalation to higher technical tiers when needed. The customer receives updates and evidence of the incident status.
• What are the risks of not managing the network continuously?

  It increases the likelihood of downtime, recurring incidents, and unpredictable costs. Without change control and monitoring, security and continuity become more vulnerable.