Spain

(a) What is the NIS2 implementation status?

Spain has not yet fully transposed NIS2, but a draft law is in place. The draft legislation expands the scope beyond NIS2 (Art. 3), including additional sectors such as nuclear industry (high criticality sector) and private security (other sectors), while excluding financial entities already covered by DORA. The framework is based on the national cybersecurity scheme (ENS) and EU certification schemes (Art. 33). It requires essential entities to appoint a Chief Information Security Officer (CISO), with accreditation for essential entities provided by the Ministry of Interior.

(b) What is the envisaged NIS2 implementation timeline?

Under the Spanish NIS2 framework, the National Cybersecurity Centre (Centro Nacional de Ciberseguridad – CNC) maintains a register of providers of digital services and digital infrastructures in accordance with Article 26.

The registration obligation corresponds to the requirements set out under NIS2 but is implemented through the existing national regulatory framework.

At present, there is no single, uniform national registration deadline beyond the deadline applicable to the preparation of the relevant lists under the national framework.

(c) What does the NIS2 mean for other national cybersecurity legislation?

This Directive will require an update of the Spanish regulations, specifically in 12/2018 Royal Decree-and the 43/2021 Royal Decree.

(d) Who will be the supervisory authority and how are they preparing the market?

Without the transposition of the directive being published in Spain yet, it is difficult to answer this question. However, if we use the competent authority established in the previous NIS1 regulation as a reference, it should be the National Center for the Protection of Infrastructures and Cybersecurity (CNPIC).

(e) What should you be doing/on the lookout for?

Regardless of whether the company is a critical or significant entity, all organisations must review the NIS2 requirements and assess their compliance prior to the October 2024 implementation date. Companies will have a number of requirements that include taking measures around operational cyber risk management, cyber hygiene, incident response, incident reporting and supply chain security, employee training, implementing security protocols and policies, providing training for senior management, as well as taking out cyber insurance to prevent personal liability for board members and executives.

As was the case with the EU's GDPR, companies are advised to start this process much earlier to avoid problems.