NIS2 Spain: Draft Cybersecurity Coordination & Governance Law
Understand how Spain plans to transpose the NIS2 Directive through the future Cybersecurity Coordination and Governance Law (Ley de Coordinación y Gobernanza de la Ciberseguridad), the creation of the National Cybersecurity Centre (CNCS), and what essential and important entities should already be doing to prepare.
Introduction: NIS2 Directive & the Spanish context
Spain already has a relatively advanced national cybersecurity framework, including the National Security Scheme (Esquema Nacional de Seguridad – ENS) and specific rules for 5G networks and services. Until now, however, regulation has been fragmented across several decrees and sectoral rules rather than a single NIS2-aligned law.
Directive (EU) 2022/2555 (NIS2) requires Spain to consolidate and upgrade this framework. The Government is doing so via the future Cybersecurity Coordination and Governance Law, which will transpose NIS2, integrate the EU Critical Entities Resilience (CER) rules, and create a new National Cybersecurity Centre (CNCS) under the Ministry of the Interior.
NIS2 implementation in Spain
On 14 January 2025 the Council of Ministers approved the Draft Law on Cybersecurity Coordination and Governance (Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad), which is the main legislative vehicle to transpose NIS2 into Spanish law. The draft was published for public consultation in January and is being processed under an urgent parliamentary procedure.
The draft law merges NIS2 with the EU Critical Entities Resilience (CER) framework and establishes a comprehensive national governance model for cybersecurity, placing the future Centro Nacional de Ciberseguridad (CNCS) at the centre and defining the roles of existing bodies such as INCIBE-CERT, CCN-CERT and sectoral regulators.
Spain missed the EU transposition deadline of 17 October 2024, and at the time of writing the law has not yet been promulgated in the Official State Gazette (BOE). However, the European Commission has launched infringement proceedings, and all signals point to adoption in the short term, with obligations then applying within a phased implementation timetable.
Status
NIS2 is not yet fully transposed in Spain. A draft Cybersecurity Coordination and Governance Law has been approved by the Government and is under urgent parliamentary scrutiny, but is not yet in force.
Legal structure (planned)
A single Cybersecurity Coordination and Governance Law will transpose NIS2 and CER, define scope, obligations, authorities and sanctions, and sit alongside existing instruments like the ENS for public-sector and critical information systems.
Scope
The draft law follows NIS2 in classifying entities as essential or important, expanding coverage to sectors such as waste management, food, scientific research and public administrations in addition to traditional critical sectors.
NIS2 Spain: what you need to know about compliance
Even before the Spanish law is formally adopted, NIS2 gives a clear picture of the obligations that essential and important entities will face. The draft law essentially mirrors those requirements and embeds them into Spain’s legal and institutional landscape.
Who is in scope?
- Entities in NIS2 Annex I sectors (energy, transport, banking, financial market infrastructures, health, drinking water, digital infrastructure, public administration, etc.).
- Entities in Annex II sectors (postal and courier services, waste management, food, manufacturing of critical products, ICT service management, research, etc.).
- Size-independent entities, including DNS and TLD operators, providers of trust services, major cloud and data-centre operators and certain managed and security service providers.
- Additional operators identified by Spain as critical or of high relevance for national security and public services, including certain public administrations.
Core obligations (expected)
- Implement risk-management measures covering governance, policies, asset management, network and system security, access control, vulnerability management, backup and recovery.
- Maintain incident-preparedness and business continuity plans, including disaster recovery and crisis-communication procedures.
- Report significant cyber incidents and certain cyber threats on tight deadlines (initial notification within 24 hours, followed by more detailed reports).
- Manage supply-chain cybersecurity risk, including contractual requirements for key providers and due diligence on ICT and security suppliers.
- Ensure that senior management is directly responsible for cybersecurity governance, approves policies and receives regular training and reporting.
Practical approach
In practice, Spanish organisations are advised to treat NIS2 as the “north star” and use the draft law as an interpretive guide, aligning controls with recognised frameworks such as ISO/IEC 27001 or NIST CSF and integrating them with ENS requirements where applicable.
NIS2 timeline & key dates (Spain)
Sector-specific notes for Spain
- Energy: electricity, gas and oil operators, as well as major grid and generation assets, are expected to be classified as essential entities with strict resilience obligations, especially after recent large-scale outages.
- Transport: rail, air, maritime and road transport operators, ports and airports will fall in scope, reflecting Spain’s role as a key logistics hub in Europe and the Mediterranean.
- Digital infrastructure & telecom: electronic communications networks, data centres, cloud and major digital platform providers will face strong requirements on uptime, incident reporting and continuity planning.
- Finance & DORA interplay: banks and financial market infrastructures will need to align NIS2 obligations with existing EU financial ICT-risk frameworks such as DORA, avoiding duplicated controls.
- Public administration & services: central, regional and local administrations, as well as certain public entities, will be explicitly covered, building on ENS and extending obligations to broader digital services.
- Waste, food & research: sectors newly highlighted by NIS2 (waste management, food supply, scientific research) will also be affected, particularly where they operate critical facilities or support essential services.
Penalties for non-compliance (expected)
The draft law mirrors NIS2’s strong sanctions regime. While final figures may still be adjusted during parliamentary debate, companies should expect penalties in the same order of magnitude as the Directive.
- For essential entities, fines up to the higher of €10 million or 2% of worldwide annual turnover for the most serious infringements.
- For important entities, fines up to the higher of €7 million or 1.4% of worldwide annual turnover.
- Additional fines for procedural breaches such as late or incomplete incident reporting, failure to cooperate with authorities or failure to implement corrective measures.
- Corrective measures may include mandatory remediation plans, enhanced supervision, follow-up audits and, in extreme cases, temporary restrictions on operations.
- Management bodies may face specific consequences for repeated or serious negligence in fulfilling governance obligations for cybersecurity.
How to prepare for NIS2 in Spain
- Check if you are likely in scope: map your business against NIS2 Annex I & II sectors and Spanish critical sectors; consider size, revenue and the essential nature of your services.
- Monitor the Spanish draft law: follow updates on the Cybersecurity Coordination and Governance Law and any changes introduced during parliamentary debate.
- Run a NIS2 readiness assessment: benchmark your current cybersecurity governance, controls, incident response and documentation against NIS2 Article 21 and the obligations outlined in the draft law.
- Align with ENS where applicable: if you already fall under the National Security Scheme (ENS), align your NIS2 preparations with ENS requirements to avoid duplicated work.
- Strengthen detection & incident reporting: make sure you can detect, investigate and classify incidents quickly, and that you have processes to notify authorities within 24 hours when required.
- Address supply-chain risk: identify critical suppliers and update contracts with clear cybersecurity, audit and incident-notification clauses consistent with NIS2 expectations.
- Use recognised frameworks: build or refine your information security management system using ISO/IEC 27001, NIST CSF or similar to structure your compliance roadmap.
- Engage leadership early: inform boards and senior management about expected obligations and sanctions so they can allocate funding, set risk appetite and support a multi-year roadmap.