NIS2 in Spain: Everything Your Company Needs to Know to Comply with the Cybersecurity Directive

The NIS2 Directive: the biggest change in European cybersecurity since 2016

Directive (EU) 2022/2555, known as NIS2, replaces the original NIS Directive of 2016 and represents the most ambitious revision of the European cybersecurity framework to date. Its objective is to raise the common level of cybersecurity across the European Union, reduce divergences between member states, and significantly expand the scope of entities subject to security obligations.

The scale of change is considerable. The original NIS Directive affected a limited number of Operators of Essential Services and Digital Service Providers. NIS2 extends that scope to all sectors in Annex I and II of the Directive — including waste management, chemical production, food industry, and machinery manufacturing that were previously unregulated from a cybersecurity standpoint — and applies to companies above size thresholds, which translates to approximately 40,000 affected entities in Spain.

Essential entities vs. important entities: practical differences

NIS2 distinguishes two categories of affected entities with different levels of obligation and sanction:

Essential entities (Annex I): Energy (electricity, gas, oil, hydrogen), transport (air, rail, maritime, road), banking, financial market infrastructure, healthcare, drinking water and wastewater, digital infrastructure (IXPs, DNS, TLD registries, cloud computing, data centres, CDNs, trust service providers), and ICT service management. Essential entities are subject to ex ante supervision and sanctions of up to €10M or 2% of global turnover.

Important entities (Annex II): Postal and courier services, waste management, chemical manufacturing, food production, manufacturing (medical devices, electronics, machinery, motor vehicles), and digital service providers (online marketplaces, search engines, social networking platforms). Important entities are subject to ex post supervision and sanctions of up to €7M or 1.4% of global turnover.

The risk management measures NIS2 requires

Article 21 of NIS2 establishes the minimum measures that affected entities must adopt. These measures must be “appropriate and proportionate” to the entity’s level of risk, considering its size, the state of the art in technology, and sector-specific vulnerabilities:

Risk analysis and information system security policies: The entity must have formal cybersecurity risk management policies, approved by the management body.

Incident handling: Procedures to detect, analyse, contain, and communicate cybersecurity incidents, within the notification timeframes established in the directive.

Business continuity and crisis management: Continuity plans covering cyberattack scenarios, including system recovery and crisis procedures.

Supply chain security: Risk assessment of suppliers with access to critical systems and contractual security clauses.

Security in systems development, acquisition, and maintenance: Security practices in the software and systems lifecycle, including vulnerability management.

Policies to assess the effectiveness of measures: Regular evaluation and audit of implemented measures.

Basic cyber hygiene practices and training: Cybersecurity training for staff and management bodies.

Cryptography and encryption: Use of encryption for data in transit and at rest where necessary.

Multi-factor authentication and secure communications: MFA for critical systems and encrypted communications.

Our NIS2 compliance team helps companies implement these measures in a documented and auditable manner, establishing the evidence record that the supervisory authority may require during an inspection.

The management training dimension of NIS2

NIS2 introduces a people-management dimension that should not be underestimated. The directive requires management bodies to receive regular cybersecurity training sufficient to understand risks and supervise risk management decisions. The objective is not to turn executives into security technicians, but to ensure they can exercise their supervisory function with adequate knowledge.

For staff generally, the directive requires cybersecurity training and awareness programmes covering recognition of social engineering threats (phishing, vishing), secure use of systems and data, and internal incident reporting procedures.

BMC offers NIS2 training programmes for boards of directors and audit committees, tailored to participants’ level of technical knowledge and focused on the supervisory responsibilities the directive assigns to them.

NIS2 and Virtual CISO: when you do not need a full-time security director

Many NIS2-affected entities — particularly mid-sized companies — do not have a Chief Information Security Officer (CISO), nor do they need one full-time. For these companies, BMC’s Virtual CISO service provides the information security management function on an outsourced basis: security programme management, technology supplier oversight, liaison with the supervisory authority, and representation before the management body in periodic cybersecurity reviews.

The Virtual CISO is practically responsible for the entity’s NIS2 function, with the level of dedication and accountability that the company’s size and complexity requires, backed by BMC’s legal team for regulatory and notification matters.

NIS2 and ISO 27001: building on existing frameworks

For companies already operating under ISO 27001, the path to NIS2 compliance is shorter but not automatic. The ISO 27001 framework provides a strong foundation — particularly its risk assessment methodology, information security policy structure, and controls catalogue — but there are NIS2-specific requirements that go beyond what ISO 27001 demands.

The most significant gaps for ISO 27001-certified companies typically relate to: the specific NIS2 incident notification timelines and procedures (which are more prescriptive than ISO 27001 requires), the supply chain security assessment obligations, the management body training and formal approval requirements, and the registration and self-identification obligations with the national competent authority.

BMC conducts NIS2-specific gap analyses for ISO 27001-certified companies, identifying the incremental steps needed to achieve NIS2 compliance while building on the existing management system.