SpainAnteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Cybersecurity Risk-Management Measures
Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad text approved by the Consejo de Ministros on (transposing Directive (EU) 2022/2555)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.interior.gob.es/opencms/pdf/servicios-al-ciudadano/participacion-ciudadana/Participacion-publica-en-proyectos-normativos/Audienc…Approved by the executive for transmission to the legislature, dated , as of .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
Where it has got to
The text described here is Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad text approved by the Consejo de Ministros for the audiencia e informacion publica consultation, published .
Locally, this stage is approval of the Anteproyecto de Ley by the Consejo de Ministros in its first round (primera vuelta), with tramitacion de urgencia (urgent processing) ordered so a second-round approval and remission to the Cortes Generales as a Proyecto de Ley can follow.
The stage above is recorded at www.interior.gob.es.
Spain notified this same text to the European Commission on under Directive (EU) 2015/1535 (TRIS notification 2025/0104/ES). No later Consejo de Ministros second-round approval or Boletin Oficial de las Cortes Generales entry is recorded. Real Decreto 806/2026 of dissolved the Congreso de los Diputados and the Senate and called elections for ; the Congreso de los Diputados records no initiative under the Anteproyecto's title in the XV Legislature.
What it requires
- As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria, which track NIS2's own classification of an online marketplace, online search engine and cloud computing service among the digital providers it names; the wider sector classes the Anteproyecto also reaches (energy, transport, banking, health, water, digital infrastructure, public administration and others) are reached too, by declaring that you are an essential or important entity.
- As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.NIST CSF 2.0ID.RA-05NIST CSF 2.0ID.RA-06
- As drafted, the Anteproyecto would require you to designate a responsable de la seguridad de la informacion (information security officer) as your point of contact and technical coordinator, with accredited personnel in that role where your entity is classified as essential.NIST CSF 2.0GV.RR-02
These lines are LexLint's reading of the law's text. Also read by: Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Anteproyecto's own Capitulo VII (arts. 35 to 50) would create an administrative infringement and sanction regime classifying infractions as muy graves, graves or leves, with no criminal offence created by an infringement of this duty.
Who enforces it
Enforcement body
One of the sector control authorities the Anteproyecto would designate: the Ministerio del Interior through the Oficina de Coordinacion de Ciberseguridad, the Ministerio de Defensa through the Centro Criptologico Nacional, and the Ministerio para la Transformacion Digital y de la Funcion Publica through its Secretaria de Estado de Telecomunicaciones e Infraestructuras Digitales y de Digitalizacion e Inteligencia Artificial, coordinated by the proposed Centro Nacional de Ciberseguridad as single national competent authority.
Settledness
- As of
- Guidance link
- https://www.dsn.gob.es/en/node/24160
- Guidance body
- Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno
- Open questions
- Will the Government formed after the elections of approve the Anteproyecto in a second round and send it to the newly elected Cortes Generales, and will its sector list, penalty tiers and information-security-officer regime survive unchanged, given the European Commission's open infringement procedure over Spain's transposition of Directive (EU) 2022/2555?
What this law does
The Anteproyecto, jointly proposed by the Interior, Defence and Digital Transformation ministries, would require an entity classified as essential or important under the future Act's sector list to carry out an individualised risk assessment and put in place technical, operational and organisational measures to secure the networks and information systems it uses and to prevent or minimise the impact of an incident, transposing NIS2 Article 21.
It would create the figure of the responsable de la seguridad de la informacion (information security officer) as the entity's point of contact and technical coordinator. In an essential entity, the officer, the natural person representing a collegiate officer, and the substitute would have to be personnel accredited by the Ministerio del Interior. It would create a single national competent authority, the Centro Nacional de Ciberseguridad.
The Centro Nacional de Ciberseguridad would be attached to the Cabinet of the Presidency of Government. It would also name three sector control authorities, at the Ministerio de Defensa, the Ministerio para la Transformacion Digital y de la Funcion Publica and the Ministerio del Interior. The Consejo de Ministros approved only the Anteproyecto's first round on and ordered urgent processing for a second round and parliamentary debate to follow.
Real Decreto 806/2026, de 5 de octubre, then dissolved the Congreso de los Diputados and the Senate and called elections for . The Congreso de los Diputados records no Proyecto de Ley under the Anteproyecto's title in the XV Legislature, so the text was not introduced there before the dissolution.
When LexLint raises it
When your app profile says your app operates a social platform, handles health records, is a bank, is a securities firm or runs an essential service.
Back to the example · Lint your app
Page updated .