NIS2 compliance in Spain

NIS2 compliance in Spain at a glance

A decision of the European Commission on 8 July 2026 to refer Spain to the Court of Justice recorded that full transposition of NIS2 had not been notified, even though the Council of Ministers approved a draft Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025. The draft would give three control authorities supervisory roles and put a National Cybersecurity Centre at the Presidency; until it becomes law, Real Decreto-ley 12/2018 remains the national instrument for essential-service operators and digital service providers. There is no NIS2 certificate, so preparation means scoping, governance, risk assessment, incident procedures and evidence a supervisor could examine. Sterling's Enschede office helps clients in Spain work out whether they are likely to be in scope, runs the gap analysis against the draft and current rules, and builds the evidence, with Effivity and Sterling Academy included with the engagement.

Who needs NIS2 in Spain, and what happens without it

These are the organisations in Spain that most often need to show NIS2.

• Energy, transport, finance, healthcare, water, digital infrastructure and nuclear entitiesThe Interior Ministry's summary of the draft law lists these critical sectors and the duties of risk assessment, incident notification and information security officers.
• Operators of essential services and digital service providers already under Real Decreto-ley 12/2018The earlier NIS rules apply today and supply the competent authorities and incident-notification routes.
• Public entities and the private suppliers bound by the Esquema Nacional de SeguridadENS conformity is already a contract requirement and overlaps with the security work NIS2 asks for.
• Banks, insurers and investment firmsDORA applies to them directly, so their NIS2 position needs mapping against it.

NIS2 requirements in Spain

Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.

In Spain these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →

How to achieve NIS2 compliance in Spain

One team from the Enschede office carries the work from scoping to sign-off. Clients in Spain are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.

1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
2. Gap assessment against NIS2 and the Spanish requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
5. Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

How long does NIS2 compliance take in Spain?

There is no standard duration: it depends on your scope and on how much of the system already runs. In Spain these are the factors that set the timeline.

• Whether the entity is essential or important once the law is published
• Number of networks, systems and suppliers in scope
• Maturity of incident handling and notification
• Alignment with existing ENS or ISO work

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

• Scope and timeline estimator

How much does NIS2 compliance cost in Spain?

The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Spain these factors move both.

• Scope of entities and sites
• Technical measures to close after the gap analysis
• Supply chain assessments
• Optional certification to an accredited standard

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

NIS2 consultants and assessors in Spain

Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

• Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
• Ask the consultant how the local requirements in Spain are mapped into the same system, so nothing runs twice.
• Ask for client references in your sector; Sterling’s client letters are available on request.
• Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

NIS2 in Spain: questions clients ask

More on NIS2 for Spanish organisations

• NIS2: the complete guide
• Watch: How to comply with the NIS2 Directive
• NIS2 compliance in Spain and every other standard Sterling delivers there

Other standards Spanish businesses ask Sterling for

Organisations in Spain often combine NIS2 with one of these, under one management system where the scopes allow.

All 22 standards Sterling delivers in Spain →