what has happened
The BOE includes Royal Decree 43/2021, of January 26, which develops Royal Decree-Law 12/2018 on network security and information systems. It is a key piece of the Spanish framework prior to full adaptation to NIS2.
Why it matters
For many organizations, regulated cybersecurity doesn't start with NIS2. This royal decree already orders aspects of security, notification and coordination for operators of essential services and providers of digital services.
What to check now
If a company provides critical, digital services or support to regulated clients, it is advisable to review whether its continuity processes, incidents and suppliers are documented and if there is traceability to justify decisions.
Relationship with ENS and ISO 27001
ENS, ISO 27001 and this framework share one idea: identify risks, apply proportionate controls and preserve evidence. The difference is in scope, legal obligation and supervisory authority.
Checklist for companies
- Identification of essential or digital services.
- Map of those responsible and incident channels.
- Continuity and recovery plan.
- Record of controls and reviews.
- Alignment with ENS, ISO 27001 and NIS2 when applicable.
Do you want to check if this affects your company?
We can help you translate the news or standard into concrete actions: scope, gaps, evidence and priorities.
Request diagnosis