Most Spanish companies that will have to comply with NIS2 do not think of themselves as critical infrastructure. That is the point. Directive (EU) 2022/2555, known as NIS2, widens the earlier scheme to many more sectors and sizes, and it reaches smaller companies through the supply chains of the organisations it names. The first question is not how to comply, but whether you are in scope at all.
Essential and important entities: the two categories
NIS2 splits covered organisations into essential and important entities. Both face the same core security obligations; the difference is supervision and penalties. Essential entities are supervised proactively and face higher maximum fines; important entities are supervised mainly after an incident. Which category an organisation falls into depends on its sector and its size.
The sectors and the size threshold
Scope is set by sector (the directive's annexes) and size. Annex I covers high-criticality sectors (energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space). Annex II covers other critical sectors (postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers and research). As a rule, medium-sized entities and above are in scope: from 50 employees or 10 million euros of turnover for important entities, and from 250 employees or 50 million euros for essential entities, with some entities covered regardless of size.
How NIS2 reaches companies not directly listed: the supply chain
Even if your company is not in the annexes, NIS2 can still reach you. Article 21 requires covered entities to manage the security of their supply chain, so they pass security requirements to their suppliers through contracts. For much of the Spanish mid-market, the first encounter with NIS2 is a customer's questionnaire or a new clause rather than a letter from a regulator, much like a public tender that suddenly requires the ENS.
What NIS2 requires: risk-management measures and incident reporting
Article 21 sets a baseline of risk-management measures: risk analysis and security policies, incident handling, business continuity and backups, supply-chain security, secure acquisition and development, vulnerability handling, policies to test effectiveness, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. Article 23 sets the reporting timeline for a significant incident: an early warning within 24 hours of becoming aware of it, a full notification within 72 hours, and a final report within one month.
Management accountability: the board is responsible
NIS2 makes cybersecurity a board-level duty. Article 20 requires an entity's management body to approve the risk-management measures, oversee their implementation, and makes it liable for failures to comply. Managers must also follow training. Security stops being something delegated entirely to IT.
NIS2 in Spain: transposition status and who supervises
The directive has applied across the EU since 17 October 2024, the deadline for member states to transpose it. Spain missed that deadline. The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025, remains in parliamentary process and has not been published in the BOE as of late 2026; the European Commission has opened infringement proceedings over the delay. The draft spreads supervision across several bodies and keeps Spain's three-CSIRT model: INCIBE-CERT for the private sector and citizens, CCN-CERT for the public sector and ESPDEF-CERT for defence. Once the law is published, the adaptation windows are expected to be short.
How to prepare without running NIS2 as a separate project
NIS2's measures overlap heavily with frameworks many Spanish companies already run, above all ISO 27001 and the ENS. The risk analysis, incident handling, access control and supply-chain requirements map closely onto controls those frameworks already define. A platform reuses those controls and their evidence for NIS2, so preparation is an extension of an existing programme rather than a new one. Qalea operates this on its platform, with guided support from its team and alongside the company's own team. For how the compliance side sits next to operated security, see how a compliance platform fits with operated security.
