The NIS2 Directive is the most significant cybersecurity regulation to hit European businesses this decade. For companies operating in Spain, the situation is particularly pressing: the country missed the original transposition deadline, the national transposition law is still going through Parliament, and on 8 July 2026 the European Commission referred Spain to the Court of Justice of the EU, asking for financial penalties. If your organization falls within scope, the obligations already exist under EU law and the enforcement gap is closing.
What Is NIS2 and Why Does It Matter?
Directive (EU) 2022/2555, commonly known as NIS2 (Network and Information Security 2), establishes a unified cybersecurity framework across all EU Member States. It replaces the original NIS Directive from 2016, which was widely regarded as insufficient given the dramatic evolution of cyber threats.
NIS2 entered into force in January 2023, with Member States required to transpose it into national law by 17 October 2024. Spain failed to meet that deadline. The Draft Law on Cybersecurity Coordination and Governance (Ley de Coordinación y Gobernanza de la Ciberseguridad) was approved by the Council of Ministers on 14 January 2025, creates a National Cybersecurity Centre as single competent authority and point of contact, and as of September 2026 is still pending final parliamentary approval. In the meantime, Royal Decree-law 12/2018, which transposed the first NIS Directive, remains in force.
The European Commission has escalated the case step by step:
| Date | Milestone |
|---|---|
| 17 October 2024 | Transposition deadline for Directive (EU) 2022/2555 expires |
| 28 November 2024 | Letters of formal notice to Member States that had not notified transposition measures |
| 14 January 2025 | Spanish Council of Ministers approves the draft Cybersecurity Coordination and Governance Law |
| 7 May 2025 | Reasoned opinions to 19 Member States, Spain included, with two months to respond |
| 8 July 2026 | The Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice of the EU and asks for a lump sum plus daily penalties until complete transposition is notified |
Sources: European Commission, reasoned opinions of 7 May 2025, European Commission, referral to the Court of Justice of 8 July 2026 and Spanish National Security Department, draft law.
What already applies in Spain without the transposition law
The delay does not create a legal vacuum:
- Royal Decree-law 12/2018 and its implementing Royal Decree 43/2021 still require operators of essential services and digital service providers to manage risk and report incidents to their reference CSIRT.
- Commission Implementing Regulation (EU) 2024/2690 applies directly, without transposition, to DNS providers, TLD registries, cloud and data centre providers, CDNs, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers. It sets the technical and methodological requirements for the Article 21 measures and the thresholds that make an incident significant for those entities.
- The Digital Operational Resilience Act (DORA) has applied directly to financial entities since 17 January 2025.
- Customers and regulators across the EU already push NIS2-aligned requirements down their supply chains, regardless of the Spanish calendar.
What makes NIS2 fundamentally different from its predecessor is its dramatically expanded scope: more sectors, more organizations, stricter obligations, harsher penalties, and direct accountability for senior management. This is not an incremental update; it's a paradigm shift in how Europe governs cybersecurity.
Who Must Comply With NIS2 in Spain?
NIS2 categorizes organizations into two groups: essential entities and important entities. Both must implement security measures, though the level of regulatory supervision and maximum penalties differ.
High-Criticality Sectors (Essential Entities)
- Energy: electricity, gas, oil, hydrogen, district heating and cooling
- Transport: air, rail, maritime, and road (see logistics and transport cybersecurity under NIS2)
- Banking and financial market infrastructures
- Healthcare: hospitals, laboratories, pharmaceutical and medical device manufacturers
- Drinking water and wastewater
- Digital infrastructure: DNS providers, TLD registries, cloud services, data centres, content delivery networks, trust service providers, public electronic communications networks (see NIS2 obligations for telecom operators)
- ICT service management (B2B): managed service providers and managed security service providers (MSP/MSSP)
- Public administration (central and regional government)
- Space: ground-based infrastructure operators
Other Critical Sectors (Important Entities)
- Postal and courier services
- Waste management
- Chemical industry
- Food: production, processing, and distribution
- Manufacturing: medical devices, computers, electronics, optics, machinery, motor vehicles, transport equipment
- Digital providers: online marketplaces, search engines, social networking platforms (see cybersecurity for retail, eCommerce and marketplaces)
- Research: research organizations
Size Threshold
As a general rule, NIS2 applies to organizations with 50 or more employees or annual revenue exceeding EUR 10 million. However, there are critical exceptions: SMEs providing services in especially sensitive areas such as DNS, trust services, or telecommunications may be included regardless of their size.
The directive borrows the SME definition from Commission Recommendation 2003/361/EC, and headcount and turnover are computed on a consolidated basis with partner and linked enterprises:
- Large enterprise (250 or more employees, or turnover above EUR 50 million and balance sheet above EUR 43 million): essential entity when it operates in an Annex I sector.
- Medium enterprise (50 to 249 employees, or turnover between EUR 10 million and EUR 50 million): important entity in Annex I and Annex II sectors, except for the categories the directive treats as essential regardless of size (DNS, TLD registries, qualified trust service providers, central public administration).
- Small and micro enterprises: outside NIS2 unless a sector-specific exception applies.
Essential vs Important: What Changes in Practice
| Aspect | Essential entity | Important entity |
|---|---|---|
| Supervision | Ex ante and ex post: the authority may inspect without a prior incident | Ex post: the authority acts after an incident, a complaint or evidence of non-compliance |
| Audits | Regular and targeted audits can be ordered | Only after evidence of non-compliance |
| Maximum fine | EUR 10 million or 2% of global annual turnover, whichever is higher | EUR 7 million or 1.4% of global annual turnover, whichever is higher |
| Accessory measures | Suspension of certifications, temporary ban on management functions | Publication of the breach and binding orders; no certification suspension or management ban |
The substantive obligations (Article 21 measures and incident reporting) are identical for both categories. What changes is the intensity of supervision and the sanction ceiling.
If your company operates in any of these sectors and meets the size criteria, you are subject to NIS2. The question is not whether it applies to you, but how quickly you can achieve compliance.
The 10 Core NIS2 Obligations
The directive structures its requirements into three pillars: governance, risk management, and incident reporting. Here's what your organization must implement.
1. Board-Level Accountability
NIS2 mandates that management bodies approve cybersecurity risk management measures, oversee their implementation, and bear direct responsibility for non-compliance. Board members and senior executives must receive mandatory training in cybersecurity risk management. Cybersecurity is no longer an IT department concern; it's a boardroom responsibility.
2. Comprehensive Risk Management
Entities must implement proportionate technical, operational, and organizational measures to manage risks to network and information systems. NIS2 specifies a risk-based approach covering:
- Risk analysis and information system security policies
- Incident handling (prevention, detection, and response)
- Business continuity, backup management, and disaster recovery
- Supply chain security
- Security in system acquisition, development, and maintenance
- Policies and procedures for assessing the effectiveness of measures
- Basic cyber hygiene practices and training
- Cryptography and encryption policies
- Human resources security, access control policies, and asset management
- Multi-factor authentication (MFA) and secured communications
3. Supply Chain Security
Entities must assess the cybersecurity posture of their direct suppliers and service providers, considering each supplier's specific vulnerabilities, the quality of their cybersecurity practices, and their secure development procedures. This includes contractual security clauses and periodic audits. For suppliers of hardware and software products, the Cyber Resilience Act (CRA) adds baseline security obligations across the whole product lifecycle that reinforce this supply chain due diligence.
4. Incident Reporting
NIS2 establishes strict notification timelines to the relevant CSIRT:
- Early warning: within 24 hours of detecting a significant incident
- Official notification: within 72 hours with an initial assessment of severity and impact
- Final report: within one month with a detailed description, root cause analysis, mitigation measures, and cross-border impact if applicable
- Intermediate report: on request of the CSIRT, with status updates while the incident is being handled
If personal data is involved, the GDPR breach notification to the AEPD (72 hours from awareness) runs in parallel and is a separate procedure with its own sanctions. The procedure should define how the DPO and the security lead coordinate both tracks. For entities under DORA, that regulation takes precedence as lex specialis for ICT incidents, with an initial notification due within four hours of classifying an incident as major and no later than 24 hours from awareness.
5. Registration and Self-Identification
Entities must register with the competent authority, providing information about their name, address, sector, contact details, and IP ranges. This self-identification process is mandatory; failure to register does not exempt you from compliance.
6. Business Continuity
Documented business continuity and disaster recovery plans (BCP/DRP) with periodic testing to demonstrate their effectiveness. Having a plan on paper is not enough; you must prove it works.
7. Encryption and Communication Security
Implementation of cryptography and encryption policies appropriate to the risk level, including secure communications within the organization and with third parties.
8. Access Control and Identity Management
Access control policies based on the principle of least privilege, with multi-factor authentication (MFA) for access to critical systems.
9. Vulnerability Management
Documented processes for vulnerability identification, assessment, and remediation, including continuous monitoring and timely patch management.
10. Periodic Effectiveness Assessment
Security measures are not static. NIS2 requires entities to regularly evaluate the effectiveness of their controls through security audits, penetration testing, and simulation exercises.
NIS2 Penalties: A Steep Price for Non-Compliance
NIS2's enforcement regime is considerably tougher than its predecessor and follows the GDPR model to ensure real deterrent effect.
For essential entities: fines of up to EUR 10 million or 2% of global annual turnover, whichever is higher. Member States may also impose temporary suspension of certifications and temporary bans on individuals holding management positions.
For important entities: fines of up to EUR 7 million or 1.4% of global annual turnover.
Under the directive, the suspension of certifications and the temporary ban on management functions are reserved for essential entities; important entities face fines, binding orders and publication of the breach. The Spanish draft law follows the usual national structure of minor, serious and very serious infringements, but its final amounts will only be known once the text is enacted.
The most critical point for executives: NIS2 establishes personal liability for management body members for failure to fulfil supervisory obligations. Board members and CEOs may face individual consequences if they fail to ensure adequate cybersecurity governance.
Competent Authorities and CSIRTs in Spain
Until the new law formally designates the NIS2 authorities, the institutional map that operates today is the one set by Royal Decree-law 12/2018 and Royal Decree 43/2021:
| Body | Scope |
|---|---|
| INCIBE-CERT | Reference CSIRT for the private sector and for entities outside the remit of CCN-CERT |
| CCN-CERT | Reference CSIRT for the public sector and for entities subject to the National Security Framework (ENS) |
| ESPDEF-CERT | Ministry of Defence CSIRT for defence networks and their contractors |
| Sectoral authorities | Ministries responsible for each sector (energy, transport, health, water and others) and, for finance, the supervisors coordinating with DORA |
| National Cybersecurity Centre | Single national authority and point of contact foreseen in the draft law, not yet operational |
At EU level, ENISA runs the CSIRTs Network and publishes technical implementation guidance, and the European Commission keeps a public transposition tracker per Member State. For a private company the practical takeaway is simple: build the 24h/72h/1 month reporting channel today with INCIBE-CERT as counterpart, and revisit it when the national law designates the final authorities. More on the Spanish agency in What is INCIBE.
How NIS2 Relates to ENS, DORA, and ISO 27001
NIS2 doesn't exist in isolation. Its implementation must be coordinated with other frameworks your organization may already follow.
NIS2 and ENS
Spain's National Security Framework (ENS) is mandatory for the public sector and its technology providers. NIS2 and ENS share security objectives, but NIS2 extends scope to the private sector and adds requirements around incident notification and governance. If your organization is already ENS-certified, you have a solid foundation, but you'll need to address NIS2-specific obligations, particularly supply chain security and board-level accountability. At Secra, we help organizations manage both frameworks in an integrated manner through our GRC services.
NIS2 and DORA
The Digital Operational Resilience Act (DORA), applicable since January 2025, specifically targets the financial sector. DORA is considered lex specialis in relation to NIS2, meaning its more specific requirements take precedence for financial entities. However, financial institutions must also comply with NIS2's general provisions where DORA does not provide more specific rules.
NIS2 and ISO 27001
ISO 27001 certification provides an excellent foundation for NIS2 compliance, covering most risk management requirements. However, NIS2 adds specific obligations not addressed by ISO 27001, such as incident notification timelines, management liability, and certain supply chain requirements.
Side-by-Side Comparison
| Framework | Scope | Mandatory | Certifiable | Legal basis |
|---|---|---|---|---|
| NIS2 | Cybersecurity of essential and important entities in Annexes I and II | Yes, for entities in scope | No: regulatory compliance, not certification | Directive (EU) 2022/2555 and the future Spanish transposition law |
| ISO 27001:2022 | Information security management system, any sector | No | Yes, accredited third-party audit | International standard |
| ENS | Information systems of the public sector and of its suppliers | Yes, for public bodies and suppliers handling their information | Yes: certification or self-assessment depending on category | Royal Decree 311/2022 |
| DORA | Digital operational resilience of the financial sector | Yes, for financial entities and critical ICT third parties | No | Regulation (EU) 2022/2554, applicable since 17 January 2025 |
A large financial entity may be subject to NIS2, DORA and, if it serves public bodies, ENS at the same time. The efficient strategy is one management system built on ISO 27001:2022 with framework-specific extensions, rather than three parallel programmes. See DORA vs NIS2 and ISO 27001 and NIS2.
Your 7-Step NIS2 Compliance Roadmap
Preparing for NIS2 requires a structured approach combining analysis, implementation, and validation. Here's the roadmap we recommend at Secra.
Step 1: Determine Whether NIS2 Applies to You
Review the sectors and size criteria outlined above. If you're uncertain, consult a compliance specialist. Remember that the assessment isn't limited to your primary sector: if you provide ICT services to essential entities, you may be in scope.
Step 2: Conduct a Gap Analysis
Compare your current cybersecurity posture against NIS2 requirements. Identify gaps in your technical, organizational, and governance controls. If you already hold certifications like ENS or ISO 27001, your starting point will be more advanced, but you'll still need to assess the differences.
Step 3: Assess Your Supply Chain
Identify your critical ICT suppliers, evaluate their cybersecurity practices, and incorporate security clauses into contracts. This obligation is among the most complex and time-consuming, so it should be prioritized early.
Step 4: Implement Technical Measures
Deploy the required security controls: vulnerability management, MFA, encryption, network segmentation, continuous monitoring, and backup systems. A penetration test will validate the real-world effectiveness of your controls and uncover attack vectors that might otherwise go undetected. These same controls are the baseline that cyber insurers now require before underwriting a policy, and they shape what a cyber insurance policy actually covers after an incident.
Step 5: Establish Incident Reporting Procedures
Define and document a clear procedure for incident detection, classification, and notification within NIS2 timelines (24h / 72h / 1 month). Conduct periodic tabletop exercises to verify that your team knows and follows the procedure.
Step 6: Engage Senior Management
Ensure that management bodies understand their responsibilities under NIS2, formally approve the security policy, and receive mandatory training. This is not a checkbox exercise; personal liability for executives makes their active involvement essential.
Step 7: Audit and Continuously Improve
NIS2 is not a one-time compliance project but an ongoing process. Schedule regular security audits, penetration tests, and Red Team exercises to assess your organization's real resilience against advanced threats. Feed the results back into your continuous improvement cycle.
A 12-Month Timeline for the Roadmap
For a mid-sized organisation with no prior security programme, the seven steps above realistically take 9 to 14 months. This is the phasing we use as a reference:
| Phase | Months | Content | Deliverable |
|---|---|---|---|
| 0. Applicability and registration | 1 | Determine category and group entities in scope, appoint the security lead, map critical services | Applicability statement approved by the board |
| 1. Gap analysis | 2 to 3 | Maturity assessment of the ten Article 21 domains (0 to 5 scale), prioritisation by risk and regulatory impact | Gap report with remediation plan and effort estimate |
| 2. Priority controls | 3 to 8 | 24h/72h procedure, MFA on privileged and remote access, encrypted and immutable backups, critical ICT supplier management, board training | Operational controls with evidence of application |
| 3. Documentation | 6 to 9 (in parallel) | Master policy, domain policies, procedures and records | Usable, not decorative, documentation |
| 4. Testing and drills | 9 to 10 | Internal and external penetration testing, cloud and IAM configuration review, board tabletop, CSIRT notification drill, ransomware recovery exercise | Test reports and drill minutes |
| 5. External audit | 10 to 12 | Independent compliance audit and, optionally, ISO 27001:2022 certification in parallel | Report defensible before the authority |
After month 12 the work continues: annual risk review, supplier inventory refresh, recurring training, periodic drills and quarterly metrics to the board. NIS2 is a permanent capability, not a project with an end date.
Common NIS2 Compliance Mistakes
- Assuming ISO 27001 covers everything. ISO 27001:2022 covers a large share of Article 21, but 24-hour CSIRT notification, registration as an obligated entity, deepened supply chain management and mandatory board training do not map automatically.
- Delaying the 24-hour early warning out of reputational fear. The early warning is not a public statement, it is a preliminary communication to the authority. Missing the deadline is a standalone infringement regardless of how the incident evolves.
- Confusing NIS2 and GDPR notifications. They are independent procedures with different authorities; an incident involving personal data triggers both.
- Inventorying only direct ICT suppliers. Data centres, ISPs, cloud providers, enterprise software, monitoring tools and MSSPs are critical dependencies that often fall outside the initial scope.
- Proving effectiveness with questionnaires. Declarative answers from the IT team demonstrate nothing. Authorities value real testing: penetration tests with results, documented tabletop drills and, where size justifies it, red team or threat-led penetration testing (TLPT).
- Training only the board, or only the staff. Board training is mandatory and new, but the operational front line still needs general awareness, differentiated technical training and reinforced training for users who repeatedly fail phishing simulations.
- Keeping no trace of board decisions. Personal liability requires minutes and evidence of due diligence, not just a signed policy.
What we see in our engagements
In mid-sized companies that already hold ISO 27001, the Article 21 obligation that costs the most is incident handling with 24 and 72 hour notification: a written procedure usually exists, but not the escalation chain, the templates or a drill that has tested it. For clients without a SOC we solve it with an internal procedure, notification templates per phase (early warning, notification, final report) and an annual drill.
Frequently Asked Questions
Has Spain transposed NIS2?
No. As of September 2026 the Cybersecurity Coordination and Governance Law is still in Parliament, and the European Commission referred Spain to the Court of Justice of the EU on 8 July 2026 for failing to notify complete transposition. Royal Decree-law 12/2018 (NIS1), Implementing Regulation (EU) 2024/2690 for digital infrastructure and DORA for finance apply in the meantime.
Does NIS2 replace ENS for public sector suppliers?
No, they are complementary. ENS governs systems that process public sector information or deliver public services, including those of suppliers. NIS2 governs the cybersecurity of entities in the designated sectors. An ICT supplier to the administration may carry ENS obligations through its contract and NIS2 obligations through its sector and size.
Do I have to report every incident within 24 hours?
No. Only significant incidents: those that have caused or may cause severe operational disruption, considerable financial loss, or considerable damage to other natural or legal persons. Other incidents must be logged internally but not formally reported.
How do I demonstrate compliance to an auditor or the authority?
With documentary and operational evidence: approved and current policies, an up-to-date risk analysis, an incident log with detection and response times, CSIRT notification records, training records including the board, technical test results, management review minutes, security metrics, asset and supplier inventories, and contracts with security clauses. Every compliance claim must be traceable to a record.
If I hold ISO 27001, am I NIS2 compliant?
Partially. In our gap analyses ISO 27001:2022 covers roughly 65 to 75% of Article 21. The usual gaps are 24h/72h notification, formal supply chain management and board-specific training. See ISO 27001 and NIS2.
Prepare Your Organization for NIS2 With Secra
The NIS2 Directive represents the most consequential change in European cybersecurity regulation in over a decade. For businesses operating in Spain, the combination of delayed transposition and European Commission pressure creates a scenario where early preparation is the only sound strategy.
At Secra, we guide organizations through the entire NIS2 compliance journey: from the initial gap analysis through technical control implementation, compliance evidence preparation, and offensive security audits that validate the real-world effectiveness of implemented measures.
Request a free initial assessment and find out where your organization stands relative to NIS2 requirements. Our GRC and offensive cybersecurity consultants will provide a clear diagnosis and a tailored action plan for your sector and maturity level.
Contact us and get ahead of the regulation before time runs out.
Official Sources
- Directive (EU) 2022/2555 (NIS2), Official Journal text as published in Spain
- Commission Implementing Regulation (EU) 2024/2690: technical requirements and significant incidents for digital infrastructure
- European Commission: NIS2 Directive policy page
- European Commission: referral of Ireland, Spain, France and the Netherlands to the Court of Justice (8 July 2026)
- Spanish National Security Department: draft Cybersecurity Coordination and Governance Law
- Royal Decree-law 12/2018 on the security of network and information systems
- Royal Decree 43/2021 implementing Royal Decree-law 12/2018
- Royal Decree 311/2022, National Security Framework (ENS)
Related Reading
Sources
About the author
Jose Luis Bueno Díaz, COO and co-founder
Ethical hackers with OSCP, OSEP, OSWE, CRTO, CRTL and CARTE certifications, 7+ years of experience in offensive cybersecurity, and authors of CVE-2025-40652 and CVE-2023-3512.