Does NIS2 affect me if the Spanish law isn’t approved yet?

The directive has been in force since January 2023 and the transposition deadline passed in October 2024; the Spanish law is going through the legislative process. It is worth preparing now, because management is accountable for the measures and adaptation periods may be short.

What’s the difference between an essential and an important entity?

It depends on sector and size. Security obligations are very similar; what mainly changes is supervision (proactive for essential, ex post for important) and the maximum fines.

Is management training mandatory?

Yes. Article 20 requires members of management bodies to follow cybersecurity training. We offer it as an annual service, together with DORA training.

What do I have to report and when?

Significant incidents: early warning within 24 hours, notification within 72 hours and a final report within one month. The incidents module tracks those deadlines for you.

Directive (EU) 2022/2555

Find out if NIS2 applies to you and prepare before you’re asked

Your sector appears in the directive and you don’t know whether you are in scope. First, whether it applies to you and as what type of entity; then the measures, management training and incident notifications within 24 and 72 hours.

Request the NIS2 assessment Request information

Who is in scope

NIS2 greatly widens the scope of the first NIS directive: it applies to medium and large entities in highly critical and other critical sectors, classified as essential or important. The directive has been in force since January 2023 and the transposition deadline ended in October 2024; in Spain, the transposition law is still going through the legislative process.

Highly critical sectors: energy, transport, banking, health, water, digital infrastructure, public administration…
Other critical sectors: postal services, waste management, chemicals, food, manufacturing, digital providers…
As a general rule, entities in those sectors with 50 or more employees or a turnover of €10 million or more

If this sounds familiar

You don’t know whether NIS2 applies to you.

In the platform

Article 21 measures in Compliance and the 24- and 72-hour deadlines in Incidents.

What NIS2 requires

The directive focuses on management accountability and fast reporting:

Art. 20Governance and management training: Management bodies approve cybersecurity measures, oversee their implementation, can be held liable for infringements and must follow training.
Art. 21Risk management measures: Risk analysis, incident handling, business continuity, supply chain security, encryption, access control and training, among others.
Art. 21.2.dSupply chain: Security in relationships with direct suppliers and service providers.
Art. 23Incident reporting: Early warning within 24 hours, incident notification within 72 hours and a final report within one month.

Platform · modules

How Almenara helps with NIS2

The modules that save you the most work, in order.

ComplianceRisk analysis, Art. 21 measures and evidence for management.
IncidentsThe 24-hour, 72-hour and one-month deadlines of Art. 23, with the reports prepared.
Third partiesSupply chain security under Art. 21.2.d.
ContinuityBusiness continuity, backups and crisis management.

Framework catalogue

What you prove for NIS2 counts for the next framework

Every NIS2 requirement is mapped to Almenara’s common controls, like the rest of the catalogue. When you are asked for another framework or a customer’s questionnaire, you start from what you have already proven.

See NIS2 in the catalogue See every framework

Service · where to start

Applicability assessment and management training

We analyse whether your organisation falls within NIS2 and as what type of entity, measure your position against Art. 21 and train management on their obligations.

Request the NIS2 assessment

Recommended services

Service · Once
Gap analysis against a framework
We measure where you stand against ISO 27001, the ENS or DORA and what you still need to comply.
Service · Every year
NIS2 and DORA board training
A session so your board understands what it has to decide and oversee in security, adapted to your sector.
Service · Once
Incident response playbooks
Five response playbooks for the most likely incidents in your organisation.

Our boundary: Almenara does not issue certificates (accredited certification bodies do) and does not carry out the internal audit of a system it has implemented or manages.

NIS2 FAQ

Does NIS2 affect me if the Spanish law isn’t approved yet?: The directive has been in force since January 2023 and the transposition deadline passed in October 2024; the Spanish law is going through the legislative process. It is worth preparing now, because management is accountable for the measures and adaptation periods may be short.
What’s the difference between an essential and an important entity?: It depends on sector and size. Security obligations are very similar; what mainly changes is supervision (proactive for essential, ex post for important) and the maximum fines.
Is management training mandatory?: Yes. Article 20 requires members of management bodies to follow cybersecurity training. We offer it as an annual service, together with DORA training.
What do I have to report and when?: Significant incidents: early warning within 24 hours, notification within 72 hours and a final report within one month. The incidents module tracks those deadlines for you.

Shall we prepare for NIS2 together?

We’ll show you what your system would look like in Almenara, with your own data.

Request information Request the NIS2 assessment