We classify your entity under NIS2, build the risk-management measures and incident reporting it requires, and map them to the national rules that apply to you, including the Esquema Nacional de Seguridad in Spain, so that one set of controls answers all of them.
For
You receive
NIS2 applies to public and private entities of a type listed in Annex I (sectors of high criticality, such as energy, transport, health, drinking water, waste water, digital infrastructure, ICT service management and space) or Annex II (other critical sectors, such as postal services, waste management, chemicals, food, manufacturing and research) that qualify as medium-sized enterprises under Recommendation 2003/361/EC or exceed its ceilings (Article 2(1)). Some entities are in scope regardless of size, including providers of public electronic communications networks or services, trust service providers, TLD name registries, DNS service providers, domain name registration services and entities identified as critical entities under Directive (EU) 2022/2557 (Article 2(2) to (4)). Article 3 then sorts in-scope entities into essential and important. Where a sector-specific Union act imposes at least equivalent requirements, as DORA does for financial entities, the corresponding NIS2 provisions do not apply (Article 4).
The obligations sit with the entity and its management body. Management bodies approve the cybersecurity risk-management measures, oversee their implementation, can be held liable for infringements of Article 21 and must follow training (Article 20). The measures follow an all-hazards approach and include at least the ten areas of Article 21(2), from risk analysis and incident handling to supply chain security, vulnerability handling, cryptography and multi-factor authentication. Significant incidents are reported to the CSIRT or, where applicable, the competent authority: an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours, and a final report no later than one month after the incident notification (Article 23(4)). Member States may require the use of ICT products, services and processes certified under European cybersecurity certification schemes (Article 24).
NIS2 is a directive: the competent authorities, the CSIRTs that receive notifications and the penalties are set by each Member State's national transposition. Outside Spain, we map the deliverables to the transposition of the Member State concerned, and we work in English and Spanish. In Spain, we start from what you already have. Operators of essential services under Real Decreto-ley 12/2018, which transposed the first NIS Directive, must already have security policies, an information security officer and incident notification under Real Decreto 43/2021, and critical operators under Ley 8/2011 must already have an Operator Security Plan. The Esquema Nacional de Seguridad (Real Decreto 311/2022) applies directly to the whole public sector as defined in Article 2 of Ley 40/2015, which includes private-law entities linked to or dependent on a public administration, and also to private companies that provide services or solutions to public sector entities (Article 2(1) and (3)). Its Annex II measures address many of the same areas as Article 21(2), but they depend on the category of each system: supply chain protection (op.ext.3) applies only to ALTA systems, and certified components (op.pl.5) to MEDIA and ALTA. We map the frameworks so that one set of controls and evidence serves all of them.
Sector, subsector and type of entity against Annexes I and II, the size test including partner and linked enterprise data, the size-independent cases of Article 2(2) to (4), the resulting essential or important status with its legal reasoning, jurisdiction under Article 26, and the information Article 3(4) requires for the national list of entities.
Typical duration: 2 to 3 weeks
Each Article 21(2) measure mapped to the ENS Annex II measures (org, op, mp) that apply to the category of your systems and, in Spain, to your existing obligations as an operator of essential services or critical operator, with your current evidence, the gaps and a remediation plan prioritised by risk and effort. Evidence you already have is reused, not duplicated. Where remediation needs technical implementation, we coordinate it with your usual integrator.
Typical duration: 4 to 6 weeks
Criteria for a significant incident under Article 23(3), and under Implementing Regulation (EU) 2024/2690 where it applies to you; roles, decision rights and the moment the clock starts; the recipients that apply to your type of entity in the Member State concerned; templates for the early warning (24 hours), the incident notification (72 hours), the intermediate report on request and the final report (one month after the notification), and for informing the recipients of your services. Tested in a tabletop exercise.
Typical duration: 3 to 4 weeks
A tiered questionnaire for ICT and OT suppliers built on Article 21(3): vulnerabilities specific to each supplier, product quality, secure development procedures, vulnerability handling and remote access to industrial systems. Contract clauses for security requirements, incident notification to you, vulnerability disclosure, audit rights and end of support. IEC 62443 serves as the reference for OT suppliers.
Typical duration: 3 to 5 weeks
A training session for the management body on its Article 20 duties, its liability and the decisions it must take, and a quarterly dashboard with the indicators it needs to approve and oversee the measures: gap closure, significant incidents and near misses, supplier risk and accepted exceptions.
Typical duration: Half-day session; dashboard set up in 2 weeks
Start with the type of entity in Annex I or II, then the size. Medium-sized or larger means at least 50 employees, or annual turnover and balance sheet total both above EUR 10 million, with the data of partner and linked enterprises taken into account under Recommendation 2003/361/EC. An Annex I entity that exceeds the medium-sized ceilings (250 employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million) is essential. Other in-scope entities are important unless another ground of Article 3(1) applies. Qualified trust service providers, TLD name registries and DNS service providers are essential regardless of size.
Yes. Drinking water (sector 6 of Annex I) covers suppliers and distributors of water intended for human consumption as defined in Directive (EU) 2020/2184, and waste water (sector 7) covers undertakings collecting, disposing of or treating urban, domestic or industrial waste water as defined in Directive 91/271/EEC. Sector 6 excludes distributors for which distributing drinking water is a non-essential part of their general activity of distributing other commodities and goods; sector 7 excludes undertakings for which waste water activity is a non-essential part of their general activity. As Annex I sectors, a utility above the medium-sized ceilings is essential and a medium-sized one is important, unless another ground of Article 3(1) applies: entities identified as critical entities under Directive (EU) 2022/2557 are essential, and a Member State may also treat as essential the entities it identified as operators of essential services before 16 January 2023 (Article 3(1)(f) and (g)).
An early warning to the CSIRT or, where applicable, the competent authority, without undue delay and in any event within 24 hours of becoming aware of a significant incident. Where applicable, it states whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact. The incident notification follows within 72 hours, with an initial assessment of severity and impact and, where available, indicators of compromise; the final report is due no later than one month after that notification. An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable damage to other persons (Article 23(3)).
To their competent authority, through their reference CSIRT (Article 19 of Real Decreto-ley 12/2018). The reference CSIRT depends on the type of entity: CCN-CERT for entities within the scope of Ley 40/2015, that is, the public sector, and INCIBE-CERT for the others, operated jointly with CNPIC for incidents that affect critical operators (Article 11). Real Decreto 43/2021 requires notification of incidents with a critical, very high or high impact level, as set out in the Instrucción nacional de notificación y gestión de ciberincidentes in its annex, which also sets the time limits (Articles 9 and 10). Your procedure must cover these rules and the 24-hour, 72-hour and one-month sequence of NIS2, and we update it when the Spanish transposition is published.
Article 20 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and follow training, and makes them liable for infringements of Article 21. For essential entities, Article 32 adds that persons acting as legal representatives can be held liable for breach of their duty to ensure compliance and, where enforcement measures remain ineffective, persons at chief executive officer or legal representative level can be temporarily prohibited from exercising managerial functions. National law sets the details, including the rules for public institutions.
Supply chain security, including the relationships with direct suppliers and service providers, is one of the minimum measures of Article 21(2)(d). Entities must take into account each direct supplier's specific vulnerabilities, the overall quality of their products and cybersecurity practices, including secure development, and the results of coordinated Union risk assessments of critical supply chains (Article 21(3)). NIS2 makes no separate category for OT: a network and information system includes any device that processes digital data under a programme (Article 6(1)), so controllers, engineering workstations and remote maintenance links are covered when the entity uses them for its operations or services.
Many measures overlap, but not all, and the answer depends on the category and scope of your certified systems. Points to check: ENS conformity is determined per information system, while Article 21 covers the network and information systems used for your operations or services; supply chain protection (op.ext.3) applies only to ALTA systems in the ENS, while Article 21(2)(d) applies to every NIS2 entity; the ENS sets no 24-hour, 72-hour and one-month reporting sequence; and Article 20 adds training and liability for the management body. The measures matrix shows what ENS evidence you can reuse and what is left.
Not directly. Article 24 lets Member States require essential and important entities to use particular ICT products, services and processes certified under European cybersecurity certification schemes, such as EUCC, to demonstrate compliance with particular Article 21 requirements, and empowers the Commission to make this mandatory for categories of entities by delegated act. In Spain, the ENS already requires certified security functionality for security products in proportion to the system category (Article 19 of Real Decreto 311/2022 and measure op.pl.5).