Early elections in Spain put NIS2 on hold: what should companies do?
The early general election in Spain has put several legislative initiatives relating to cybersecurity and digital transformation on hold. These include the regulations designed to complete the transposition of the NIS2 Directive in Spain. The parliamentary process has stalled, but the risks and obligations facing businesses continue to mount.
The early calling of an election and the subsequent dissolution of Parliament have affected various legislative initiatives relating to cybersecurity and digital transformation. One of the most significant of these is the development of the national framework required to complete the transposition of the NIS2 Directive.
Spain has yet to complete this process. The deadline set by the Directive expired on 17th October 2024 and, in July 2026, the European Commission decided to refer Spain to the Court of Justice of the European Union for failing to notify the measures necessary to complete its transposition.
The new political landscape is prolonging the uncertainty surrounding the future national framework. However, this does not alter one obvious fact: the legislative timetable may come to a standstill, but organisations’ cybersecurity needs do not.
Threats continue to evolve, and businesses are increasingly reliant on digital systems, technology services and external providers. For this reason, waiting for the regulatory process to be completed before starting to prepare could mean wasting valuable time.
NIS2 continues to lead the way
The NIS2 Directive aims to raise the overall standard of cybersecurity in the European Union. To this end, it strengthens areas such as risk management, incident response, business continuity, governance and supply chain security.
Although the Spanish transposition is still pending, organisations can make progress in these areas without needing to anticipate what the final content of the future national legislation will be.
Cybersecurity is a key factor in resilience, trust and competitiveness
Furthermore, this preparation is not merely a matter of regulation. Organisations may already be subject to security requirements arising from their contractual relationships, certification processes or third-party management systems.
Cybersecurity is thus no longer merely a matter of compliance. It also becomes a factor in resilience, confidence and competitiveness, particularly for companies that work with major clients or operate in international markets.
What can organisations do now?
The current situation offers businesses an opportunity to prepare in a gradual, organised and proportionate manner.
The first step is to determine the extent to which the organisation may be affected by NIS2. Next, it is advisable to carry out a gap analysis to establish the current situation, assess existing capabilities and identify the main areas for improvement.
Based on this assessment, the company can draw up a risk-based roadmap focusing on four priority areas:
- Analysing the scope and applicability. It is necessary to examine the sector in which the organisation operates, its size and its critical interconnections in order to determine whether it can be regarded as an essential or important entity.
- Strengthening supply chain security. Risk management must be extended to technology suppliers and managed service providers. This involves reviewing the contractual requirements, the monitoring mechanisms and, where necessary, the technical audits.
- Review the management and reporting of incidents. Organisations must adapt their response procedures to comply with the tiered approach set out in NIS2: early warning within 24 hours, incident notification within 72 hours and a final report within one month.
- Involving senior management. Cybersecurity must form part of corporate governance. Senior management needs to receive appropriate training and effectively take responsibility for overseeing strategy, risks and security measures.
Organisations that already work to ISO/IEC 27001 or the National Security Scheme (ENS) have a foundation in place that can facilitate this process. However, these frameworks should not be interpreted as automatically equivalent to NIS2.
Prepare today so you don’t have to react tomorrow
Regulatory uncertainty should not lead to inaction. Using this period to identify the starting point, pinpoint gaps and prioritise actions will enable companies to move forward in a measured way. It will also help them retain the flexibility needed to adapt to the future Spanish framework.
Preparing now does not mean getting ahead of the legislator. It means strengthening the organisation’s ability to manage its risks, respond to potential incidents and tackle the forthcoming regulatory landscape with greater maturity and scope for action.
Because the political calendar can come to a standstill. Cybersecurity? No.
This article was co-authored by Lucía Pedrosa, Offering Manager and GRC PMO, and Cristina Muñoz, Standardisation and Compliance Lead at Izertis.