Law / Spain

Ley 8/2011 and Real Decreto 704/2011 on Critical Infrastructure Protection, Duties of Critical Operators

Ley 8/2011, art. 13, y Real Decreto 704/2011, título III, infraestructuras críticas

In force since 22 May 2011.

A sector security regimes rule binding public and private bodies.

Obligation class: Security, Governance

What it requires

If you are a public or private operator designated as a critical operator because you manage at least one infrastructure classed as critical in a strategic sector, this binds you (Ley 8/2011 Article 13).
Within six months of being notified of your designation, submit an Operator Security Plan to the CNPIC, with a risk analysis methodology that covers physical and logical threats to your assets, and review it every two years (Real Decreto 704/2011 Articles 22 and 24).
Within four months of the approval of that plan, draw up and submit a Specific Protection Plan for each of your critical infrastructures, and review it every two years (Real Decreto 704/2011 Articles 25 and 27).
Designate a Security and Liaison Officer and a Security Delegate for each critical infrastructure, facilitate the authorities' inspections and update the CNPIC's data on your infrastructures each year (Ley 8/2011 Article 13 and Real Decreto 704/2011 Articles 13, 34 and 35).

These lines are LexLint's reading of the law's text.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 13 of Ley 8/2011 requires critical operators, whether public or private, to produce an Operator Security Plan and a Specific Protection Plan for each infrastructure the Catalogue lists as critical, and to certify the implementation of the measures the competent authority requires. Critical operators must also designate a Security and Liaison Officer and a Security Delegate for each critical infrastructure, and facilitate the inspections of the competent authorities.

Real Decreto 704/2011 requires a critical operator to submit its Operator Security Plan to the CNPIC within six months of notification of its designation. The Operator Security Plan must set out a risk analysis methodology that guarantees the continuity of the services the operator provides, covering the physical and logical threats to each type of asset. Operators must review their Operator Security Plans every two years, and the CNPIC approves the reviews.

A critical operator must produce a Specific Protection Plan for each critical infrastructure within four months of the approval of its Operator Security Plan. Critical operators are the public or private operators that meet the conditions of article 13 of Ley 8/2011.

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example · Lint your app

Page updated 6 November 2026.