{"id":2158,"date":"2025-02-06T11:20:41","date_gmt":"2025-02-06T11:20:41","guid":{"rendered":"https:\/\/inprotech.es\/?p=2158"},"modified":"2025-02-17T12:52:55","modified_gmt":"2025-02-17T12:52:55","slug":"how-does-the-nis2-regulation-affect-spain-2","status":"publish","type":"post","link":"https:\/\/inprotech.es\/en\/how-does-the-nis2-regulation-affect-spain-2\/","title":{"rendered":"How Does the NIS2 Regulation Affect Spain?"},"content":{"rendered":"

On January 14, the Spanish government announced the approval of the preliminary draft of the new Spanish cybersecurity law, whose name was chosen as the <\/span>\u201cCybersecurity Coordination and Governance Law\u201d<\/b>.<\/span><\/p>\n

This law arises as a transposition of the <\/span>Network and Information Security 2 Directive (NIS2)<\/a>, <\/b>approved by the EU in 2022, and with the aim of \u201creinforcing the protection of networks and information systems, which are subject to serious cyber threats and risks that require adapted, coordinated and innovative responses\u201d. With this, the intention is to position this new law as the most important cybersecurity regulation in Spain.<\/span><\/p>\n

The following are the most important points contained in the preliminary draft of the law.<\/span><\/p>\n

Creation of the National Center for Cybersecurity<\/b><\/h2>\n

In order to constitute a single competent national authority for cybersecurity, it is proposed to create the <\/span>National Cybersecurity Center<\/b>, which will carry out functions of direction, coordination and supervision, as well as the promotion of the activities provided for by the law.<\/span><\/p>\n

On the other hand, it will also act as a single point of contact for cross-border and cross-sector cooperation, in addition to acting as a national authority for cybersecurity crisis management and as a national cybersecurity incident response team, coordinating the network of national reference <\/span>CSIRT<\/b> (Cybersecurity Incident Response Teams): <\/span>CCN-CERT<\/b>; <\/span>INCIBE-CERT<\/b> and <\/span>ESPDEF-CERT<\/b>.<\/span><\/p>\n

Entities classification<\/b><\/h2>\n

The new law classifies entities into two types based on their level of criticality in relation to national security, market and other key aspects of cybersecurity:<\/span><\/p>\n

Essential Entities<\/b><\/h3>\n

These are organizations whose service interruption or failure could have a significant impact on public safety, public order, public health, or cause critical systemic risks. Given their relevance, they are subject to a series of measures:<\/span><\/p>\n