The bill would protect and strengthen companies providing essential services

Automatic summary, not yet reviewed

1. The bill would identify critical entities (public or private bodies providing essential services such as energy, water, transport or health) and require them to improve their ability to withstand and recover from incidents.
2. Entities identified as critical would have to carry out a risk assessment and draw up a Resilience Plan with physical protection, incident response and service recovery measures. They would also have to appoint a security and resilience officer.
3. Critical entities would have to notify the Secretaría de Estado de Seguridad of incidents that significantly disrupt or could disrupt an essential service within a maximum of 24 hours, and submit a detailed report within one month.
4. A National Catalog of Critical and Strategic Entities would be created. Information on specific critical infrastructure would be classified as secret, so that only a small number of people would know it.
5. The bill would allow critical entities to install biometric recognition systems to control access to their facilities and anti-drone systems for their protection, in both cases through a royal decree approved by the Council of Ministers.
6. Breaches would be punished with fines from €10,000 (minor offenses) up to €10,000,000 or 2% of total worldwide annual turnover (very serious offenses), whichever amount is higher.
7. Entities under the Ministry of Defense, the state law enforcement agencies, the Bank of Spain and matters governed by the cybersecurity law transposing Directive (EU) 2022/2555 would fall outside the scope of the bill.
8. The bill would incorporate into Spanish law Directive (EU) 2022/2557 of December 14, 2022 on the resilience of critical entities, and repeal Law 8/2011 of April 28 on the protection of critical infrastructure.

Who it affects

• Companies and bodies providing essential services (energy, transport, water, health, banking, etc.): If identified as critical entities, they would have to assess their risks, draw up a Resilience Plan, report incidents within 24 hours and face fines if they fail to comply.
• Workers at these entities: They could undergo suitability checks (identity and criminal record checks) if they perform sensitive tasks or access critical facilities.
• The general public: The goal is that essential services are not interrupted by incidents, disasters or attacks, and that the public is informed when an incident is of general interest.
• Certification bodies: They could certify the resilience of critical entities if accredited by ENAC; providing false data to obtain certification would be a very serious offense.

Words worth knowing

Entidad crítica (critical entity)

A public or private company or body providing an essential service (such as electricity, water or transport) whose disruption would seriously affect society or the economy.

Resiliencia (resilience)

An entity's ability to prevent, withstand and recover from an incident affecting its services.

Servicio esencial (essential service)

A service crucial to social life, the economy, health, security or the environment.

Efecto perturbador significativo (significant disruptive effect)

A major impact on the provision of an essential service, measured by criteria such as the number of people affected or economic losses.

Comprobación de idoneidad (suitability check)

Verification of a person's identity and criminal record before accessing sensitive tasks or facilities.

It summarizes the text as it was introduced. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries