Cybersecurity compliance in Spain for international companies: NIS2, ENS, DORA and GDPR with one English-speaking provider

Your group's security policies don't carry over to Spanish regulation on their own. If you have a subsidiary, a branch or public-sector contracts in Spain, we help you work out which frameworks apply, which authority you answer to and what you need to be able to prove in Spanish, with a single team that works in English and Spanish.

Meeting group policy isn't the same as complying in Spain

An international group usually arrives in Spain with its own security framework: a corporate ISMS, headquarters policies, a global SOC. That framework covers a lot, but it doesn't answer three local questions. First, which rules apply to the Spanish entity: as a general rule, the NIS2 Directive applies in the Member State where the entity is established, so the Spanish subsidiary will be subject to Spain's transposition law. As of October 2026 that law has still not been published in the BOE (Spain's Official State Gazette), the European Commission referred Spain to the Court of Justice of the EU in July 2026, and in the meantime Royal Decree-Law 12/2018 remains in force. If you sell technology to the public sector, the ENS (Spain's National Security Framework, Royal Decree 311/2022) extends to your systems and, for MEDIUM or HIGH category systems, requires a certification audit. If you are a financial entity, DORA has applied directly since January 17, 2025. Second, who you answer to: INCIBE-CERT and CCN-CERT as the reference incident response teams for the private and public sectors, the AEPD (Spanish Data Protection Agency) for data protection, and the Banco de España, the CNMV or the DGSFP in the financial sector. Third, which language: proceedings before Spain's central government administration are conducted in Spanish, and so are tender documents and much of what auditors and public-sector clients ask for. The risk is rarely a lack of controls. It's the gap between what the group already has and what the Spanish entity must be able to prove, to the right authority and in the right language.

What the service covers

  • Applicability map for the Spanish entity: NIS2 (Spanish transposition), ENS, DORA, GDPR/LOPDGDD and, if you manufacture digital products, the Cyber Resilience Act
  • Competent authority and reference incident response team for each framework, and incident reporting channels in Spain
  • Gap analysis between group policies and controls and each Spanish requirement, so you reuse what already exists instead of duplicating it
  • ENS certification readiness with an accredited certification body when you sell to the Spanish public sector
  • GDPR/LOPDGDD review of the Spanish entity: local processing activities, processors and data transfers within the group
  • Penetration testing of the Spanish entity's systems as technical evidence of its risk-management measures
  • Spanish-language documentation for tenders, auditors and authorities, with an English version for headquarters

How we work

  1. Scoping meeting, in English or Spanish: We map the structure: which entity operates in Spain, what services it provides, who it sells to and which systems it shares with the group.
  2. Applicability map: We determine which frameworks apply to the Spanish entity, who the competent authority is for each one and which obligations are in force or pending Spain's NIS2 law.
  3. Gap analysis against group policies: We compare corporate controls with each Spanish requirement and flag what can be reused, what needs adapting and what is missing.
  4. Technical testing: Penetration testing of the in-scope systems to provide real evidence of the measures, not just paperwork.
  5. Action plan and bilingual documentation: A prioritized plan with owners at the subsidiary and at group level, and Spanish-language documentation for auditors, tenders and authorities, with an English summary for headquarters.
  6. Ongoing support: Support through the ENS certification audit, public-sector client reviews and requests from the authorities.

What you get

  • Regulatory applicability map for the Spanish entity, with the competent authority and obligations for each framework
  • Group-vs-Spain gap analysis report, identifying the corporate controls that can be reused
  • Penetration test report with findings prioritized by risk and a retest of the fixes
  • Prioritized action plan, with owners at the subsidiary and at group level
  • Spanish-language documentation ready for tenders, auditors and authorities, with an executive summary in English
  • A single point of contact for every framework, in English and Spanish

Who is this for?

  • International groups opening or acquiring a subsidiary in Spain that need to know which local rules apply
  • Foreign technology suppliers that want to sell to the Spanish public sector and find the ENS listed as a requirement in tender documents
  • Financial entities with a presence in Spain that need to fit DORA with Spanish supervision and the group's ICT services
  • Companies whose security team sits outside Spain and needs a local provider that works in English
  • Spanish subsidiaries that must answer security questionnaires from Spanish clients with documentation in Spanish
  • Groups that prefer a single provider for NIS2, ENS, GDPR and penetration testing instead of one per framework

Frequently asked questions

Does Spain's NIS2 law apply to us if the group already complies with NIS2 in another EU country?

As a general rule, yes: NIS2 applies in the Member State where the entity is established, so a Spanish subsidiary answers to Spanish rules and authorities even if headquarters complies elsewhere. There are exceptions: DNS, cloud, data center, content delivery network, managed service and managed security service providers, as well as certain digital platforms, fall under the Member State of their main establishment in the EU. We assess this case by case in the applicability map.

Where does Spain's NIS2 transposition law stand?

The Council of Ministers approved the draft Law on the Coordination and Governance of Cybersecurity in January 2025, but as of October 2026 it has not been published in the BOE, and the European Commission referred Spain to the Court of Justice of the EU in July 2026. In the meantime, Royal Decree-Law 12/2018 remains in force. Obligations and penalties are covered in detail on our NIS2 consulting page.

Do we need ENS certification if we are only a supplier to a Spanish public body?

If you provide services or solutions to a Spanish public-sector entity, Royal Decree 311/2022 extends to your systems and tender documents usually require conformity. For MEDIUM or HIGH category systems, conformity is demonstrated through a certification audit by an accredited certification body (in Spain, accredited by ENAC); for BASIC category, a self-assessment is enough. A group-level ISO 27001 certification helps, but it does not replace the ENS.

Is our data protection authority the AEPD or the one in our headquarters country?

It depends on where the group's main establishment in the EU is. If it is in another Member State, that country's authority can act as lead supervisory authority for cross-border processing (the GDPR one-stop shop), but the AEPD remains competent for local matters and the LOPDGDD adds Spain-specific requirements. If the group has no main establishment in the EU, there is no one-stop shop and the Spanish subsidiary deals directly with the AEPD.

How does DORA work if our ICT services come from headquarters?

DORA has applied directly to EU financial entities since January 17, 2025, with no transposition law. ICT services provided by another company in the same group also fall under the regulation's ICT third-party risk management, so the group's service center must appear in the register of information and in the contracts. In Spain, supervision sits with the Banco de España, the CNMV or the DGSFP depending on the type of entity.

Do you work in English?

Yes. Meetings, technical reports and executive summaries can be in English for the group's security team, and the documentation submitted in Spain (tenders, auditors, authorities) is delivered in Spanish. That way the same work serves both headquarters and the subsidiary with no translation afterward.

Can we engage you for just one piece, such as the pentest or the ENS?

Yes. The service is designed so one provider can cover several frameworks, but each piece can be contracted separately. If you already know you only need the ENS or NIS2, it's quicker to start with those pages or with the ENS scoping form.

Related resources

Sources

Talk to the team