More and more companies require their suppliers to demonstrate that they adequately protect the information they manage. This is not a minor issue: according to the Cost of a Data Breach 2026 report from IBM and the Ponemon Institute, the average global cost of a data breach reached $4.99 million, 12% higher than the previous year. This reality has made cybersecurity a key factor in maintaining the trust of customers and partners.

In Spain, cyberattacks increased by 66% during the first quarter of 2025 compared to the same period of the previous year. In addition, a business interruption can cost between €4,000 and €7,500 per minute, while companies take 25% longer than expected to recover after an incident.

The NIS2 Directive expands the number of organizations required to implement cybersecurity measures across the European Union. Its goal is to strengthen the protection of essential sectors and improve resilience against increasingly frequent and sophisticated cyber threats.

While many organizations believe this regulation only applies to large corporations or critical infrastructure, the reality is quite different. NIS2 significantly expands the number of companies required to implement cybersecurity measures and, in many cases, also applies to suppliers that are part of the supply chain.

It is important to keep in mind that NIS2 is a European directive that each country must transpose into its national legislation. In Spain, the future Cybersecurity Coordination and Governance Act—which will implement these requirements—is still going through the legislative process as of the date of this article. As a result, some details, including specific thresholds, deadlines, and enforcement provisions, will be confirmed once the law is enacted. Even so, taking a proactive approach remains the best course of action.

Validity notice. This article has been prepared using information current as of July 20, 2026. The transposition of NIS2 is still underway, and the technical reference framework is being updated, so some information may change. We will continue to expand and update this article as new developments become available.

Preparing for a compliance audit of the National Security Framework (ENS) requires proper planning, the real implementation of security controls, and a continuous improvement approach to information security management. An ENS audit not only verifies regulatory compliance, but also assesses the effectiveness of the security measures applied to an organization’s information systems.

In an increasingly digital and technology-driven society, organizations, both public and private, must understand which regulatory frameworks and standards they are required to apply in order to protect information, comply with legislation, and build trust with customers and partners. Among these references, the National Security Framework (ENS) holds a central role in Spain, while other frameworks such as ISO 27001, those developed by NIST, or the General Data Protection Regulation (GDPR) have a broader or different scope.

Implementing the National Security Framework (ENS) in an organization is a rigorous process that requires planning, technical execution, and continuous control. The ENS is a mandatory legal framework in Spain for public sector entities and for private organizations that handle sensitive data or provide services to the government, aiming to ensure that information and electronic services are managed under clear and consistent security requirements.

The National Security Framework (ENS) is the Spanish regulatory framework that establishes the principles, minimum requirements, and security levels applicable to information systems in the public sector and to companies that manage sensitive information or collaborate with the government. The objective of the ENS is to protect information and digital services against threats, ensuring the confidentiality, integrity, availability, authenticity, and traceability of data.

Today, no organization that manages information, critical systems, or digital services can afford to ignore the security requirements mandated by regulations. The rise in cyberattacks, the outsourcing of technology services, and dependence on third parties have made compliance with cybersecurity standards a critical factor for business continuity.