{"id":123106,"date":"2024-09-27T05:30:30","date_gmt":"2024-09-27T03:30:30","guid":{"rendered":"https:\/\/ceadigilaw.org\/blog\/transposition-de-la-directive-nis2-en-espagne-etat-des-lieux-procedure\/"},"modified":"2024-09-27T05:30:30","modified_gmt":"2024-09-27T03:30:30","slug":"transposition-de-la-directive-nis2-en-espagne-etat-des-lieux-procedure","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/fr\/blog\/transposition-de-la-directive-nis2-en-espagne-etat-des-lieux-procedure\/","title":{"rendered":"Transposing the NIS2 Directive in Spain: current status, legislative process and regulatory challenges"},"content":{"rendered":"
\n

Antonio Tejeda Encinas<\/a><\/strong>, PhD in EU Law. President of the Euro-American Committee of Digital Law - CEA Digital Law \u2013 CEA Digital Law<\/a><\/strong>.\u00a0 <\/span>European Representative for Latin America in Cybersecurity and Digital Transformation<\/span><\/p>\n

1. Introduction and background<\/span><\/strong>
\nCybersecurity has become central to the stability of critical infrastructure and to data protection in Europe. Against this backdrop, the NIS2 Directive, formally Directive (EU) 2022\/2555 of the European Parliament and of the Council, updates the NIS1 Directive (Directive (EU) 2016\/1148) with the aim of improving the resilience and security of the Member States\u2019 network and information systems. The update responds to the growing complexity and frequency of the cyber threats affecting sectors that are essential to the European economy and society.<\/span><\/p>\n

The NIS2 Directive was formally adopted in December 2022 and entered into force in January 2023, with a transposition deadline for Member States of 17 October 2024 and effective application from 18 October 2024.<\/span><\/p>\n

We will analyse the state of transposition of this Directive in Spain, the existing regulatory framework and the legislative procedure to be followed to ensure that it is implemented correctly.<\/span><\/p>\n

2. The pre-existing legal framework in Spain:<\/span><\/strong>
\nBefore the NIS2 Directive, Spain already had a cybersecurity regulatory framework adapted to the NIS1 Directive:<\/span><\/p>\n

** Real Decreto-ley 12\/2018, of 7 September (Spanish Royal Decree-Law 12\/2018): transposed the NIS1 Directive into Spanish law, establishing a set of cybersecurity measures for operators of essential services and digital service providers. RDL 12\/2018 defined the categories of services and the obligations regarding security and incident notification.<\/span><\/p>\n

** Real Decreto 311\/2022, of 3 May (Spanish Royal Decree 311\/2022): regulates the National Security Framework (Esquema Nacional de Seguridad, ENS), an instrument that harmonises minimum security requirements in the public sector and which, in many respects, was already aligned with the new requirements of NIS2. The ENS is mandatory for all public-sector entities and for the suppliers that provide services to them.<\/span><\/p>\n

Why did the NIS1 Directive and the ENS coexist?<\/span><\/strong>
\nThe ENS was created before the NIS1 Directive in order to unify and standardise security measures for Spanish public-sector entities. It exists because public administrations needed to maintain a minimum level of cybersecurity and information protection. So, while the NIS1 Directive focused on operators of essential services and digital service providers, the ENS covered only public-sector entities and their suppliers.<\/span><\/p>\n

When NIS1 was implemented in 2018, a specific framework had to be created to cover essential private operators that were not subject to the ENS. As a result, the obligations under the NIS1 Directive and the ENS coexisted, but applied to different entities. With the arrival of NIS2, the ENS is being updated to harmonise its requirements and extend its scope to private entities in critical sectors, removing part of this segmentation.<\/span><\/p>\n

The pre-existing framework thus lays the groundwork for incorporating NIS2, which broadens and redefines the categories of entities subject to the rules and imposes more rigorous security obligations, along with a stricter penalty regime.<\/span><\/p>\n

3. Objectives and scope of the NIS2 Directive:<\/span><\/strong>
\nNIS2 aims to achieve a high common level of cybersecurity across the European Union. To that end, it is built around the following principles:<\/span><\/p>\n

Wider scope: it covers new sectors considered to be of high criticality (energy, transport, health, digital infrastructure) and of critical importance (waste management, chemical and food manufacturing).<\/span><\/p>\n

Classification of entities as essential or important: based on the criticality of the sector and the size of the entity. Security and notification obligations are stricter for essential entities.<\/span><\/p>\n

Stronger obligations: it introduces more demanding obligations on risk management, governance and resilience, and sets specific requirements for supply chain security and crisis management.<\/span><\/p>\n

A tougher penalty regime: fines for non-compliance can reach \u20ac10 million or 2% of annual turnover for essential entities, and \u20ac7 million or 1.4% of annual turnover for important entities.<\/span><\/p>\n

4. The process of transposing the NIS2 Directive in Spain:<\/span><\/strong>
\nSpain is transposing the NIS2 Directive by means of a Real Decreto-ley (royal decree-law, RDL), which will allow the Government to meet the deadline set by the EU (17 October 2024). The use of an RDL is justified on the grounds of the extraordinary and urgent need to adapt the legislation in good time, so as to avoid penalties from the European Commission and guarantee the security of critical infrastructure.<\/span><\/p>\n

The Real Decreto-ley (RDL): allows the NIS2 measures to enter into force immediately, but must be ratified by Parliament within 30 days. This legislative tool is used to keep to the European timetable, ensuring formal transposition on time, but it does not mean that the text has been definitively adopted as a law.<\/span><\/p>\n

Debate and approval by the Cortes Generales (the Spanish Parliament): once ratified, the RDL will undergo a full parliamentary debate in order to become a definitive Law, at which point adjustments and amendments may be made in the light of the views of the parliamentary groups and the social stakeholders concerned. This process allows for greater participation and transparency, although it leaves the content of the RDL open to possible amendment.<\/span><\/p>\n

5. Current state of transposition:<\/span><\/strong>
\nThe transposition of the NIS2 Directive is currently at an advanced stage: the drafting of the royal decree-law is almost complete and its approval by the Council of Ministers is expected before the deadline (17 October 2024). According to unofficial sources and an analysis of the regulatory framework, the main changes are expected to focus on:<\/span><\/p>\n

Updating cybersecurity requirements for the public and private sectors.<\/span><\/p>\n

Extending the coverage of the ENS to include new sectors and important entities as classified under NIS2.<\/span><\/p>\n

Coordination between authorities: the National Cryptologic Centre (CCN), together with the Ministry of Economic Affairs and Digital Transformation, will be responsible for supervising compliance and coordinating with the relevant CSIRTs (Computer Security Incident Response Teams).<\/span><\/p>\n

6. Potential problems and challenges in transposition:<\/span><\/strong>
\nParliamentary approval: although the RDL ensures that the NIS2 obligations enter into force, a lack of parliamentary consensus could delay final approval of the law, creating regulatory uncertainty.<\/span><\/p>\n

Adaptation by the entities concerned: entities that were not previously subject to NIS1 (for example, waste management services and food manufacturing) will have to adapt quickly to the new requirements.<\/span><\/p>\n

Effective enforcement of the penalty regime: ensuring that penalties are proportionate and effective will require sound coordination between regulators and the competent authorities.<\/span><\/p>\n

This analysis aims to provide a comprehensive picture of the current situation and of the process of implementing the NIS2 Directive in the Spanish legislative context.<\/span><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Antonio Tejeda Encinas, PhD in EU Law. President of the Euro-American Committee of Digital Law - CEA Digital Law \u2013 CEA Digital Law.\u00a0 European Representative for Latin America in Cybersecurity and Digital Transformation 1. Introduction and background Cybersecurity has become central to the stability of critical infrastructure and to data protection in Europe. Against this […]<\/p>\n","protected":false},"author":2,"featured_media":112286,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1119],"tags":[],"cea_women":[],"class_list":["post-123106","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad-fr"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/123106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/comments?post=123106"}],"version-history":[{"count":0,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/123106\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media\/112286"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media?parent=123106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/categories?post=123106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/tags?post=123106"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/cea_women?post=123106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}