Introduction

Cybersecurity workforce governance has become a central element of banking law in Spain because financial institutions increasingly depend on digital systems, cloud providers, artificial intelligence, payment platforms, and interconnected financial networks. A cyber risk is no longer treated only as a technical problem; it is considered a governance, operational resilience, and regulatory compliance issue.

Spanish banks and financial institutions must ensure that employees, executives, cybersecurity teams, contractors, and technology providers possess adequate skills, responsibilities, and accountability mechanisms to prevent cyber incidents. The regulatory approach requires cybersecurity awareness throughout the organisation, with the board and senior management ultimately responsible for digital resilience. The EU Digital Operational Resilience Act (DORA), implemented from 17 January 2025, strengthens these obligations by requiring financial entities to establish governance frameworks, employee training, ICT risk responsibilities, and security awareness programmes.

Legal And Regulatory Framework

1. Digital Operational Resilience Act (DORA) And Workforce Governance

The primary legal framework for cybersecurity workforce governance in Spanish banking is Regulation (EU) 2022/2554 on Digital Operational Resilience Act (DORA).

DORA requires financial institutions to create an internal governance structure where:

• The management body has ultimate responsibility for ICT risk.
• Cybersecurity duties are clearly assigned.
• Employees understand security policies.
• Staff receive continuous cybersecurity training.
• Human errors are reduced through awareness programmes.
• Third-party ICT workers follow equivalent security requirements.

The regulation recognises that cybersecurity resilience depends not only on technology but also on people and organisational culture.

2. Role Of Board And Senior Management

Spanish banking governance principles require boards of directors to supervise cybersecurity risks.

Responsibilities include:

• Approving cybersecurity strategies.
• Allocating cybersecurity budgets.
• Reviewing cyber risk reports.
• Ensuring qualified cybersecurity leadership.
• Monitoring compliance failures.

Under DORA, the management body must actively supervise ICT risk management and ensure that employees maintain sufficient knowledge and capabilities regarding cybersecurity risks.

3. Cybersecurity Roles And Responsibilities

Banks must establish clear cybersecurity workforce structures, including:

Chief Information Security Officer (CISO)

The CISO generally manages:

• Cybersecurity strategy.
• Incident response planning.
• Security monitoring.
• Employee awareness programmes.
• Regulatory reporting.

Information Technology Employees

IT personnel must:

• Maintain secure systems.
• Apply security controls.
• Manage vulnerabilities.
• Protect customer data.

Business Employees

Non-technical employees also have obligations because many cyber incidents involve:

• Phishing attacks.
• Weak authentication practices.
• Improper handling of customer information.

4. Employee Training And Cyber Awareness Obligations

Cybersecurity training has become a legal compliance requirement rather than merely an internal policy.

Spanish financial institutions must provide:

• Regular cybersecurity education.
• Training on phishing and social engineering.
• Data protection awareness.
• Incident reporting procedures.
• Secure technology usage practices.

DORA technical standards require financial entities to include ICT security responsibilities within human resource policies and ensure employees understand security procedures.

Key Issues And Legal Principles

1. Human Risk As A Banking Cybersecurity Issue

Cybersecurity workforce governance recognises employees as both:

• A potential vulnerability.
• A critical defence mechanism.

Banks must balance employee access with security controls through:

• Role-based access.
• Separation of duties.
• Monitoring.
• Continuous training.

2. Third-Party Workforce And Outsourcing Risks

Spanish banks frequently depend on:

• Cloud providers.
• Cybersecurity contractors.
• Software vendors.
• Technology consultants.

DORA requires financial institutions to maintain oversight over ICT service providers and ensure that external personnel comply with security requirements.

3. Cybersecurity Culture And Accountability

A strong cybersecurity culture requires:

• Leadership commitment.
• Employee participation.
• Clear disciplinary procedures.
• Internal reporting channels.

Banks may face regulatory consequences when poor workforce governance contributes to cyber failures.

4. Workforce Governance And Data Protection

Cybersecurity employees handle sensitive financial information. Their responsibilities overlap with:

• General Data Protection Regulation (GDPR).
• Spanish data protection law.
• Banking secrecy obligations.

Improper employee handling of customer data may create regulatory liability.

Case Laws

1. Banco Popular Español Cybersecurity And Governance Principles (European Banking Supervision Context)

The resolution and supervision issues surrounding Banco Popular demonstrated the importance of effective governance, internal controls, and risk management structures within banking institutions.

Legal Principle:

Bank management must maintain adequate internal governance systems to identify and control operational risks.

2. Banco Santander Consumer Finance Data Protection Case (Spanish Data Protection Authority)

Spanish supervisory actions involving financial institutions have emphasised the obligation to maintain adequate organisational security measures.

Legal Principle:

Cybersecurity responsibility extends beyond technical systems to employee procedures, access management, and organisational controls.

3. Google Spain SL v Agencia Española de Protección de Datos (CJEU, Case C-131/12)

Although not a banking case, this landmark Spanish data protection decision established important principles regarding personal data responsibility.

Legal Principle:

Organisations processing personal information must maintain responsible governance over data handling.

Banking Impact:

Banks must ensure employees handling customer data follow lawful processing standards.

4. Wirtschaftsakademie Schleswig-Holstein (CJEU, Case C-210/16)

The Court emphasised responsibility for organisational control over data processing environments.

Legal Principle:

Entities exercising influence over processing activities may bear responsibility for compliance.

Banking Impact:

Banks must supervise internal teams and external technology providers handling financial data.

5. Österreichischer Rundfunk Case (CJEU, Case C-465/00)

The case developed principles concerning proportionality and protection of personal information.

Legal Principle:

Security measures must balance operational needs with fundamental rights.

Banking Impact:

Employee monitoring and cybersecurity controls must remain proportionate.

6. Schrems II (CJEU, Case C-311/18)

The Court examined international transfers of personal data and security safeguards.

Legal Principle:

Organisations must ensure adequate protection when personal data is processed through external systems.

Banking Impact:

Banks using international technology providers must ensure cybersecurity governance among external workforce participants.

Conclusion

Cybersecurity workforce governance in Spanish banking law has evolved from a technical compliance matter into a major corporate governance obligation. Banks must ensure that cybersecurity responsibilities are clearly allocated, employees are continuously trained, third-party workers are supervised, and senior management remains accountable.

Through DORA, GDPR, Spanish banking supervision standards, and European case law, cybersecurity workforce governance has become an essential element of financial stability. A bank with strong technology but weak workforce governance remains vulnerable; therefore, Spanish banking regulation increasingly treats cybersecurity competence, awareness, and accountability as core requirements of responsible financial management.