NIS2 obligations in Spain

Competent authority & CSIRT Legal ref: Art. 7, 9

• The National Cybersecurity Centre (CNC) . ecs-org.eu · 28 Oct 2026 · secondary source
• National Security Council (National Security Department) . ecs-org.eu · 28 Oct 2026 · secondary source
• Secretary of State for Digital Progress . ecs-org.eu · 28 Oct 2026 · secondary source
• CCN-CERT (National Cryptologic Centre). ecs-org.eu · 28 Oct 2026 · secondary source
• INCIBE-CERT (National Cybersecurity Institute of Spain). ecs-org.eu · 28 Oct 2026 · secondary source
• ESPDEF-CERT (Joint Cyberspace Command) . ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT-MIR-PJ (Cybersecurity Coordination Office) . ecs-org.eu · 28 Oct 2026 · secondary source
• National Cybersecurity Centre (SPOC). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Defence: National Cryptologic Centre. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry for Digital Transformation and Public Administration: Secretary of State for Telecommunications and Digital Infrastructures and the Secretary of State for Digitalisation and Artificial Intelligence. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of the Interior: Cybersecurity Coordination Office of the Secretary of State for Security. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 3 Annex 1, 2

• NIS2 plus the nuclear industry as a sector of ‘high criticality’ and private security as a sector in ‘other sectors’. Financial entities covered by DORA are excluded from the scope. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 26

• The National Cybersecurity Centre will maintain a register of providers of digital services and infrastructures, collecting the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification, as well as the type of entity . ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details of the entity and its legal representative, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. The National Cybersecurity Centre is tasked with the preparation of a list of important and essential entities with a deadline of April 17, 2025. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 18

• Entities’ Information Security Officers should report significant incidents through the National Platform for Notification and Monitoring of Cyber Incidents and the competent CSIRT without undue delay. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours (24 hours for trust service providers). ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 42

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover(important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• The draft law includes additional fines based on the seriousness of the offence: ecs-org.eu · 28 Oct 2026 · secondary source
• From 500,000 to 2,000,000 EUR (very serious infringements). ecs-org.eu · 28 Oct 2026 · secondary source
• From 100,000 to 500,000 EUR (serious infringements). ecs-org.eu · 28 Oct 2026 · secondary source
• From 10,000 to 100,000 EUR (minor infringements). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 33

• Reference to EU certification schemes. Based on the Esquema Nacional de Seguridad (ENS), a national law that defines cybersecurity processes and security controls to be implemented by companies, and provides an accreditation framework. The draft law requires all entities in scope to appoint a Chief Information Security Officer. The Chief Information Security Officer of essential entities should be accredited by the Ministry of Interior. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Draft Law

What changed recently

1. 8 Jul 2026
   Referred by the Commission to the Court of Justice for failing to notify transposition digital-strategy.ec.europa.eu source-checked