Cybersecurity rules for essential and digital services

Automatic summary, not yet reviewed

1. The rule governs the security of networks and information systems used to provide essential services and digital services, and creates a system for reporting incidents. It also sets up an institutional framework and coordination between authorities.
2. It applies to operators of essential services established in Spain and to digital service providers based in Spain, such as online markets, search engines and cloud services. Micro and small businesses providing digital services are excluded.
3. Operators and providers must take security measures proportionate to the risk and designate an information security officer. They must also report incidents with significant disruptive effects, through an initial report, interim reports and a final report.
4. Anyone who reports incidents is protected: they cannot suffer negative consequences at work unless they acted in bad faith, and the reporting entity takes on no extra liability for reporting.
5. Violations are classified as very serious, serious and minor, with fines of up to €1,000,000 in the most serious case. The rule prefers pushing for correction: in some cases a warning can replace a penalty.
6. Oversight falls to the competent authorities depending on the type of operator, such as the CNPIC, the Secretaría de Estado para el Avance Digital or the Centro Criptológico Nacional, supported by the reference incident response teams (CSIRTs).

Who it affects

• Operators of essential services (energy, transport, health, water, finance, among other strategic sectors): They must adopt security measures, designate a security officer and report significant incidents.
• Digital service providers (online markets, search engines and cloud computing) based in Spain: They must report their activity within three months, apply security measures and report significant incidents.
• Workers who report incidents: They are protected against negative consequences at work.
• Competent public authorities and reference CSIRTs: They oversee compliance, receive the reports and can impose penalties.

Words worth knowing

Servicio esencial (essential service)

A service needed for basic social functions, health, safety or citizens' well-being, which depends on networks and information systems.

CSIRT

A team that analyzes risks, monitors computer security incidents, issues alerts and helps resolve them.

Servicio de computación en nube (cloud computing service)

A service that lets users access shared, scalable computing resources over the Internet.

Real decreto-ley (royal decree-law)

A rule with the force of law that the Government can pass urgently in extraordinary situations.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries