- Companies providing essential services and providers of certain digital services will have to manage IT risk.
- They must assess risks, adopt appropriate measures and notify the authorities of incidents they suffer.
- Even if not obliged, the rule sets the level of diligence that customers and suppliers will start to expect of any company.
On 7 September 2018 the Council of Ministers approved Royal Decree-law 12/2018 on the security of network and information systems, published in the Official State Gazette the next day. The rule transposes into Spanish law Directive (EU) 2016/1148 of 6 July 2016, known as the NIS Directive, whose transposition deadline had expired in May 2018.
It applies to entities that provide essential services to the community and depend on network and information systems for their activity, as well as to providers of certain digital services. It provides that these entities must carry out a prior risk assessment, adopt appropriate measures to manage the risks that arise and notify the incidents they suffer.
Who is affected
The decree identifies the sectors in which the protection of networks and information systems must be guaranteed and sets procedures for determining which services are essential and who the main operators are. The authorities must designate the essential operators specifically using the directive’s criteria, so not every company in a sector will be included automatically. The European directive covers sectors such as energy, transport, banking, financial market infrastructure, health, drinking water and digital infrastructure.
The digital services covered are online marketplaces, search engines and cloud computing. This reaches both large operators and smaller technology firms offering those services to customers in the Union. Micro and small digital service providers are, in general, outside the scope, but any company may be affected indirectly as a supplier or subcontractor of an essential operator.
What obligations it introduces
The first obligation is risk management: knowing which systems are critical, what threats affect them and which technical and organisational measures protect them. The second is notification: incidents with significant effects on the continuity of the service must be reported to the competent authorities. These requirements complement those of the General Data Protection Regulation, which already requires notifying security breaches involving personal data, but they have a different object: the continuity of the service.
For companies, it means moving from cybersecurity seen as a technical matter to one treated as a business risk, with defined responsibilities and documented procedures. It also introduces a regime of supervision and penalties for those who do not comply, so that cybersecurity becomes part of regulatory compliance.
What to review
A first step is to check whether the company provides services that could be considered essential or digital within the meaning of the rule, or whether it depends on customers or suppliers that do. Then it is worth making an inventory of critical systems, assessing risks and verifying that backups, incident response plans and a clear person responsible exist. It is also worth reviewing insurance, which does not always cover cyber incidents, and the security clauses with external IT suppliers.
Even if the rule does not oblige a particular company, its larger customers may ask it for guarantees by contract. Having written security policies, staff training and an incident notification procedure is a competitive advantage, and preparing them can draw on a legal adviser and a technical specialist.
Cybersecurity stops being optional for essential services, and begins to be a market requirement for the rest.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
