CIBERSECURITY | REGULATORY COMPLIANCE
NIS2 Directive: Get ready for its transposition in Spain
While Spain finishes transposing Directive (EU) 2022/2555, there's a foundation you can already build on: if your organization complies with ENS or ISO 27001, adjusting a few parameters will be all that's left once the law is transposed.
NOTICE
GET AHEAD OF NIS2
While the law is still in progress, we don't sell "NIS2 compliance" as a closed-ended service. What we offer is the preparation of your infrastructure based on ENS and ISO 27001, so that the final adaptation is quick once the regulation is published.
Do you already have an in-house CISO or technical cybersecurity lead?
We supply the documentation framework and materials. Your team manages the implementation and achieves full compliance.*
Up to €7,000
One-time payment
- Documentation framework and templates tailored to NIS2 Directive requirements
- Guide and checklist for cybersecurity risk-management measures (NIS2 Article 21)
- Implementation and internal verification managed by your team
Tailored NIS2 Directive compliance for your organization
End-to-end bespoke service. We guide you from initial gap analysis to full regulatory alignment.*
Custom quote
Based on requirements
- Customized compliance roadmap aligned with your organization's risk profile and impact tier
- Implementation of governance, cybersecurity policies, KPIs, incident reporting protocols, and Article 21 measures
- Continuous guidance through final verification and compliance audit
- Dedicated CISO and cybersecurity experts integrated into your team
WHY THERE'S SO MUCH UNCERTAINTY RIGHT NOW
Four facts explain the delay. None of them justify it as an excuse not to act.
The Directive has already been binding in the EU since 2023. Spain is behind schedule in transposing it into national law, and that's what's creating the sense of uncertainty.
17 OCT 2024
The deadline for transposition passes and Spain has still not adapted the regulation into its legal system.
JAN 2025
The Council of Ministers approves the preliminary draft of the Cybersecurity Coordination and Governance Law. It remains in progress, with no set date.
IN PROGRESS
The CCN withdrew the CCN-STIC 892 guide (PCE-NIS2 profile) in order to renew it and align it with the new Implementing Regulation (EU) 2024/2690.
8 JUL 2026
The European Commission takes Spain, Ireland, France, and the Netherlands to the Court of Justice for failing to transpose the regulation.
WHAT IS SOLID GROUND
The definitive national roadmap is missing. The foundations to build on are not.
The National Cryptologic Center itself has pointed out that an organization certified under ENS High category, with an adequate scope, already meets NIS2's cybersecurity requirements.
ENS Profile
The Specific Compliance Profile (PCE) CCN-STIC 892 is the reference framework recognized by the CCN as equivalent to NIS2's cybersecurity requirements when the scope is adequate. Currently under review.
ISO 27001
A certified information security management system covers a good part of the substantive obligations that NIS2 requires.
Regulation (EU) 2024/2690
It develops NIS2's technical and methodological requirements for certain sectors and is already directly applicable throughout the Union.
Scope diagnosis
We determine whether your organization will fall under NIS2 as an essential entity, an important entity, or outside its scope.
Asset and risk inventory
Without an inventory or risk analysis, there's no way to prioritize, and it's the foundation of any framework that ends up being applied.
Leadership governance
NIS2 makes leadership responsible for cybersecurity. The sooner they get involved, the less rushed things will be later.
Article 21 measures
Incident management, business continuity, supply chain, encryption, access control, and training.
Incident notification plan
The notification deadlines will be demanding. We define now who reports, how, and when.
Progress toward ENS
Given its recognized relationship with NIS2, starting to comply with ENS is one of the investments with the lowest risk of becoming obsolete.
What we don't sell yet
While the transposition is still in progress, we don't offer "NIS2 compliance," nor do we promise compliance that Spanish law doesn't yet define precisely. That would be a promise we can't keep.
- We don't overinvest in your infrastructure before knowing whether you're an essential or important entity.
- We don't scope the effort based on a legal text whose details may still change.
- We don't close out a "NIS2 compliance" service as a finished product until there's a law to comply with.
NEXT STEP
Let's start by finding out whether NIS2 will apply to you.
It's the decision that shapes everything else. In an initial conversation, we'll review your sector, your size, and your starting point with ENS or ISO 27001.
- Tell us about your case: sector, size, current compliance status.
- We'll tell you whether you're likely to be classified as an essential or important entity.
- We'll design your preparation plan based on ENS or ISO 27001.
.png?width=262&height=150&name=accio-10-negre%20(1).png)
.jpg?width=1150&height=64&name=ADHESIVO%20P%C3%81GINA%20WEB%20(1).jpg)