https://protisec.com/tags/incibe/Recent content in INCIBE on PROTISEC — AI-Powered Enterprise CybersecurityHugoenTue, 10 Mar 2026 00:00:00 +0000https://protisec.com/blog/nis2-spanish-smes-2026/Tue, 10 Mar 2026 00:00:00 +0000https://protisec.com/blog/nis2-spanish-smes-2026/<p>The EU Network and Information Security Directive (NIS2) entered into force across EU member states in October 2024. Spain transposed it via the <strong>Ley de Seguridad de las Redes y Sistemas de Información</strong> (LSSI-NIS2). For Spanish SMBs in affected sectors, the clock is running.</p> <h2 id="who-is-actually-affected">Who Is Actually Affected</h2> <p>NIS2 expanded the scope dramatically compared to its predecessor. In Spain, the following sectors are now covered:</p> <ul> <li>Energy (electricity, oil &amp; gas, district heating)</li> <li>Transport (road, rail, air, maritime)</li> <li>Banking and financial market infrastructure</li> <li>Health (hospitals, pharma manufacturing, R&amp;D)</li> <li>Drinking water and wastewater</li> <li>Digital infrastructure (DNS, cloud, data centres, CDN providers)</li> <li>ICT service management (MSPs, MSSPs)</li> <li>Public administration</li> <li>Space</li> </ul> <p>The <strong>size threshold matters</strong>: medium enterprises (50+ employees or €10M+ revenue) in essential sectors fall under NIS2. Some critical entities regardless of size are also in scope. If you are an MSP or MSSP, you are almost certainly in scope.</p>