SpainAnteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting Obligations
Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad text approved by the Consejo de Ministros on (transposing Directive (EU) 2022/2555)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.interior.gob.es/opencms/pdf/servicios-al-ciudadano/participacion-ciudadana/Participacion-publica-en-proyectos-normativos/Audienc…Approved by the executive for transmission to the legislature, dated , as of .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
Where it has got to
The text described here is Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad text approved by the Consejo de Ministros for the audiencia e informacion publica consultation, published .
Locally, this stage is approval of the Anteproyecto de Ley by the Consejo de Ministros in its first round (primera vuelta), with tramitacion de urgencia (urgent processing) ordered so a second-round approval and remission to the Cortes Generales as a Proyecto de Ley can follow.
The stage above is recorded at www.interior.gob.es.
Spain notified this same text to the European Commission on under Directive (EU) 2015/1535 (TRIS notification 2025/0104/ES). No later Consejo de Ministros second-round approval or Boletin Oficial de las Cortes Generales entry is recorded. Real Decreto 806/2026 of dissolved the Congreso de los Diputados and the Senate and called elections for ; the Congreso de los Diputados records no initiative under the Anteproyecto's title in the XV Legislature.
What it requires
- As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
- As drafted, the Anteproyecto would require you to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.NIST CSF 2.0RS.CO-02
- As drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference computer security incident response team (CSIRT), stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)).NIST CSF 2.0RS.CO-02
- As drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)).NIST CSF 2.0RS.CO-02
- As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).NIST CSF 2.0RS.CO-03
- As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text. Also read by: Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Anteproyecto's own Capitulo VII (arts. 35 to 50) would create an administrative infringement and sanction regime classifying infractions as muy graves, graves or leves, with no criminal offence created by an infringement of this duty.
Who enforces it
Enforcement body
One of the sector control authorities the Anteproyecto would designate: the Ministerio del Interior through the Oficina de Coordinacion de Ciberseguridad, the Ministerio de Defensa through the Centro Criptologico Nacional, and the Ministerio para la Transformacion Digital y de la Funcion Publica; the Centro Nacional de Ciberseguridad would coordinate incident response nationally.
Settledness
- As of
- Guidance link
- https://www.dsn.gob.es/en/node/24160
- Guidance body
- Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno
- Open questions
- Will the Government formed after the elections of take the Anteproyecto forward, and will its incident-notification clock and thresholds, once enacted, replace Real Decreto 43/2021's severity-tiered national instruction, or will the existing instruction continue in a modified form under the new Act?
What this law does
The Anteproyecto would require an essential or important entity to notify a significant incident affecting the provision of its service, on its own networks or a third party's, to the competent authority, and to communicate to the recipients of its service, as soon as possible, a significant cyberthreat that could affect them along with any mitigating measures available to them, mirroring NIS2 Article 23.
The information security officer the Anteproyecto would create manages an entity's cybersecurity incidents as one of its named functions. The Consejo de Ministros approved only the Anteproyecto's first round on and ordered urgent processing for a second round and parliamentary debate to follow. Real Decreto 806/2026, de 5 de octubre, then dissolved the Congreso de los Diputados and the Senate and called elections for .
The Congreso de los Diputados records no Proyecto de Ley under the Anteproyecto's title in the XV Legislature, so the text was not introduced there before the dissolution.
When LexLint raises it
When your app profile says your app operates a social platform, runs an essential service, is a bank, is a securities firm or handles health records.
Back to the example · Lint your app
Page updated .