The NIS2 Directive (EU 2022/2555) widens cybersecurity obligations across the EU. If your company is based in or serves customers in Spain, this guide explains who it will cover, what Article 21 requires, Spain's real transposition status as of October 2026, and how to prepare without expensive hardware.

Status in Spain (October 2026)

NIS2 is not yet transposed in Spain. The draft Cybersecurity Coordination and Governance Act was approved by the Council of Ministers on 14 January 2025 but never reached Parliament as a bill. When the Cortes were dissolved in October 2026 the procedure lapsed; a law is unlikely before 2027. The EU transposition deadline was 17 October 2024 and, on 8 July 2026, the European Commission referred Spain to the Court of Justice for failing to notify full transposition. Meanwhile, Royal Decree-Law 12/2018 (the first NIS) and the Spanish National Security Framework (ENS) still apply. Even so, many large organisations already require NIS2-aligned controls from their suppliers by contract.

What is the NIS2 Directive?

NIS2 is the evolution of the 2016 NIS Directive. Its goal is to raise the common level of cybersecurity in the EU by imposing technical and organisational obligations on a much broader set of entities.

Key differences from NIS1:

Covers medium and large companies in essential and important sectors.
Introduces direct board-level responsibility.
Imposes strict incident reporting deadlines (24 h early warning, 72 h full notification).
Sets fines up to €10 M or 2 % of global turnover.

Who will NIS2 cover in Spain?

Once Spanish law is enacted, NIS2 will apply to organisations with 50+ employees or €10 M+ revenue operating in essential or important sectors:

Essential sectors	Important sectors
Energy, transport, banking	Postal services
Health, water	Waste management
Digital infrastructure, public administration	Manufacturing (chemicals, food, medical devices)
Space	Digital providers

Many tech SMEs, MSPs, private clinics, local utilities and public bodies will fall within scope even when they don't expect to.

If you are a supplier to an essential or important entity, your contract probably already requires NIS2-aligned controls, even though the directive is not yet transposed in Spain and your company is below the threshold.

Key technical requirements

Article 21 requires, among others:

Risk analysis and information security policies.
Incident handling with detection, response and notification.
Business continuity and disaster recovery.
Supply chain security.
Secure development and maintenance.
Encryption where appropriate.
Access control and identity management, with mandatory MFA on remote and privileged access.
Training and awareness.

How Zero Trust helps you align with NIS2

Many of the above are covered by replacing the traditional VPN with a Zero Trust Network Access (ZTNA) model:

Granular access control by identity + device.
Per-application segmentation limiting incident blast radius.
Full session logging as the basis for 24/72 h reporting.
MFA required on every access, with no exceptions (a general Zero Trust principle).
No public-facing attack surface (no exposed VPN ports).

If you still depend on a classic VPN, read our VPN → ZTNA migration guide.

Deadlines and penalties

National transposition: pending. The draft Act lapsed when the Cortes were dissolved in October 2026; the Commission referred Spain to the CJEU on 8 July 2026.
Practical preparation: many essential and important entities already ask suppliers for NIS2-style controls by contract; Spanish statutory enforcement is not yet live.
Directive-level fines: up to €10 M or 2 % of turnover for essential entities; €7 M or 1.4 % for important ones (once Spanish law exists).
Personal liability of the management body (when the law enters into force).

Quick checklist for SMEs

Confirm whether you will be in scope, or whether a customer already requires controls.
Appoint a cybersecurity lead.
Inventory of assets and critical suppliers.
Incident management policy with NIS2-style timings.
MFA on all remote and privileged access.
Network segmentation per application (ZTNA).
Business continuity plan and tested backups.
Annual staff training.

FAQ

Does NIS2 already apply to my SME with fewer than 50 employees? As Spanish law, not yet. As a contractual requirement, it may: if you provide critical services to an essential or important entity, or if your sector removes the threshold, many customers already ask for it.

How does it differ from ENS? ENS applies to the Spanish public sector and its suppliers and is already in force. NIS2 will cover strategic private and public sectors once transposed. They overlap and reinforce each other.

How much does preparation cost? It depends on your starting point. Replacing VPN with ZTNA like ConnectaSec starts at €40/month and covers several key controls without hardware. (excl. VAT)

Want to validate your NIS2 readiness? Request a demo and estimate savings with our ZTNA ROI calculator.