1. Core Legal Framework

A. Ley 8/2011, de 28 de abril, de Protección de Infraestructuras Críticas (LPIC) + Real Decreto 704/2011
This is the foundation.

• Defines critical infrastructure as: strategic infrastructures whose operation is indispensable and does not allow alternative solutions, so its destruction would have serious impact on essential services.
• Sectors designated: Administration, water, food, energy, space, chemical industry, nuclear industry, research facilities, health, financial and tax system, ICT and transport.
• Obligations for Operadores Críticos:
  1. Elaborate Plan de Seguridad del Operador (PSO)
  2. Elaborate Plan de Protección Específico (PPE) per infrastructure
  3. Cooperate with CNPIC - Centro Nacional de Protección de Infraestructuras Críticas
  4. Appoint a security liaison and report incidents

It does not mention insurance explicitly, but Art.13 says operators must elaborate security plans while bearing all costs - interpreted by CNPIC as including risk-transfer measures.

B. NIS1 transposition: Real Decreto-ley 12/2018 + Real Decreto 43/2021
Spain transposed EU Directive 2016/1148 (NIS). This introduced for Operators of Essential Services (OES) and Digital Service Providers:

• Risk management measures: business continuity, supply chain security, cyber risk assessment including third party vendors
• Incident notification within 72h to CCN-CERT / INCIBE
• Audits and fines

C. Esquema Nacional de Seguridad (ENS) - Real Decreto 311/2022
Mandatory for all public sector and for private companies that provide services to public sector. Requires:

• Categorization of systems (Básica, Media, Alta)
• Continuous risk analysis
• Contractual obligation to have cyber insurance in many public tenders for critical services

D. NIS2 Directive (EU) 2022/2555 - Pending transposition in Spain
Deadline was 17 Oct 2024. Spain missed it.

Four EU member states — Ireland, Spain, France, and the Netherlands — are now before the bloc's top court after missing a nearly two-year-old deadline to write Europe's primary cybersecurity law for critical infrastructure into national legislation

On 7 May 2025, Commission sent reasoned opinion to Spain. The Commission formally referred Spain to CJEU on 8 July 2026 for failing to notify complete transposition measures.

Spain's draft: Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by Council of Ministers 14 January 2025. It is expected to enter into force during 2026.

What the draft will do:

• Replaces OES with Entidades Esenciales vs Entidades Importantes (Annex I and II of NIS2)
• Risk management system is mandatory, covering risk analysis, incident response, continuity planning, lifecycle management, supply chain security
• Encryption and MFA mandatory
• Incident reporting: 24h early warning, 72h notification, 24h after mitigation, final report 30 days
• Personal liability of management for intentional misconduct or gross negligence
• Fines: up to €10M or 2% global turnover for essential, €7M or 1.4% for important

2. Where Does Cyber Insurance Become Required?

Spain follows indirect mandatory model:

1. Not directly in LPIC, but through contractual and regulatory pressure:

• Public procurement: Under Ley 9/2017 de Contratos del Sector Público, any tender for critical infrastructure operation (AENA, ADIF, Red Eléctrica, Canal de Isabel II) requires civil liability policy that expressly covers cyber risks. ENS High category requires proof of risk transfer.
• Financial sector - DORA (Regulation 2022/2554): From Jan 2025, operators of payment systems must comply with DORA ICT risk management. DORA Art.15 expects cyber insurance as part of residual risk strategy.
• Insurance Contract Law - Ley 50/1980: Cyber policies are treated as daños policies. Insurers must cover business interruption, data restoration, extortion, and third-party liability if contracted.