LexLint.ioBeta

Know the law your code answers to.

Law / Spain

Real Decreto 311/2022 National Security Scheme, Application to Private-Sector Providers to Public Bodies

Real Decreto 311/2022, art. 2.3, Esquema Nacional de Seguridad

In force since .

A sector security regimes rule binding private bodies.

Obligation class
Security, Governance

What it requires

  • If you provide services or supply solutions to a Spanish public-sector entity under a contract, for that entity's exercise of its administrative competences and powers, the Scheme applies to the information systems behind what you provide (Article 2.3).
  • Have a security policy approved by the body that holds your highest executive competences (Articles 2.3 and 12).
  • Expect the public body's tender specifications to require a declaration or certification of conformity with the Scheme for the systems behind your service, and to reach your own suppliers as far as the risk analysis requires (Article 2.3).
  • Have the systems within the Scheme audited at least every two years, and again after substantial modifications that may affect the required security measures (Article 31.1).

These lines are LexLint's reading of the law's text.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2.3 applies the National Security Scheme to the information systems of private-sector entities, including the duty to have the security policy that article 12 describes, where they provide services or supply solutions to public-sector entities for those entities' exercise of their administrative competences and powers under a contractual relationship.

The tender specifications of public-sector contracts must contain the requirements needed to ensure conformity with the Scheme, such as the filing of declarations or certifications of conformity, and the requirement extends to the contractors' supply chain as far as necessary under the risk analysis. A private-sector entity's security policy is approved by the body that holds the highest executive competences.

Information systems within the scope of the royal decree undergo a regular audit at least every two years, and an extraordinary audit after substantial modifications that may affect the required security measures.

When LexLint raises it

When your app profile says your app distributes a software product or provides cloud services.

Back to the example  ·  Lint your app

Page updated .