Critical Infrastructure Resilience Measurement in Spain's Financial Sector: Detailed Legal, Regulatory and Financial Analysis with Case Laws

1. Introduction

Critical Infrastructure Resilience Measurement in Spain's financial sector refers to the systematic assessment of the ability of banks, payment systems, financial market infrastructures and supporting services to prevent, withstand, respond to, recover from and adapt to operational disruptions.

These disruptions may arise from cyberattacks, electricity failures, telecommunications outages, natural disasters, financial instability, technological failures, physical sabotage or disruptions affecting important third-party service providers.

In Spain, resilience measurement is particularly significant because banking and financial services depend upon interconnected infrastructures, including:

Banking and payment infrastructure.

Electricity generation and distribution.

Telecommunications and digital networks.

Data centres and cloud computing services.

Securities clearing and settlement systems.

Payment card networks and electronic banking platforms.

The Spanish regulatory system combines national critical-infrastructure protection legislation with European Union rules on financial regulation, digital operational resilience, cyber-risk management and financial stability.

The central legal principle is that financial institutions must not only protect themselves against disruption but must also demonstrate, through evidence and testing, that they can maintain or restore essential services.

However, a crucial legal distinction must be made: designation as a critical infrastructure operator under Spanish law is not identical to classification as a critical entity under EU resilience legislation or as a financial entity subject to the Digital Operational Resilience Act (DORA).

2. Meaning and Scope of Critical Infrastructure Resilience

2.1 Critical infrastructure under Spanish law

Article 2 of Spain's Law 8/2011 of 28 April, establishing measures for the protection of critical infrastructure (Ley 8/2011, por la que se establecen medidas para la protección de las infraestructuras críticas) defines the relevant framework.

In general terms, critical infrastructure consists of strategic infrastructure whose operation is indispensable and for which no alternative solution is readily available, such that disruption or destruction would seriously affect essential services.

The law distinguishes between strategic infrastructure and infrastructure formally classified as critical.

Consequently, not every bank branch, data centre or financial technology provider is legally classified as critical infrastructure.

Official designation depends upon the applicable assessment and classification procedures.

2.2 Resilience and protection

Traditional critical infrastructure protection concentrates on preventing incidents.

Resilience is broader.

It asks whether essential financial functions remain available during a disruption and how effectively they recover afterward.

A financial institution may comply with important preventive security requirements yet still exhibit poor resilience if its payment-processing capability cannot recover after a major outage.

2.3 Financial-sector application

Consider a Spanish bank whose digital payment-processing infrastructure suffers a telecommunications failure.

Three separate questions arise:

Criticality: Is the affected system essential to the delivery of a legally relevant service?

Resilience: Can the bank continue delivering that service through alternative infrastructure?

Regulatory compliance: Did the bank implement the risk management, continuity, testing, reporting and recovery arrangements legally applicable to it?

Resilience measurement connects all three questions.

3. Spanish and European Legal Framework

Financial-sector resilience in Spain is governed by multiple overlapping legal regimes.

Legal status note: DORA has applied since 17 January 2025. The CER Directive and NIS2 required national transposition, with deadlines in October 2024. The precise status and interaction of Spain's implementing measures as of October 2026 require verification against the consolidated BOE and EUR-Lex texts; live verification is unavailable here.

3.1 Spanish Law 8/2011

Spain's Law 8/2011 provides the principal national framework for protecting critical infrastructure.

It establishes an institutional mechanism involving the Ministry of the Interior and competent authorities, including the Centro Nacional de Protección de Infraestructuras Críticas (CNPIC).

Its objectives include the identification of critical infrastructure, assessment of threats, coordination between public authorities and infrastructure operators, and preparation of security measures.

In the banking context, infrastructure potentially relevant to this framework includes major payment-processing facilities, financial communications infrastructure and key operational facilities, depending on formal designation.

Measurement implications

For an operator subject to the critical-infrastructure regime, relevant evidence may include:

Risk assessments identifying physical, technological and operational threats.

Security plans and implementation records.

Results of continuity and incident-response exercises.

Assessments of important infrastructure dependencies.

Corrective measures following identified weaknesses.

These are sensible indicators of resilience, although the legislation does not establish one universal numerical resilience score for all Spanish banks.

3.2 Royal Decree 704/2011

Royal Decree 704/2011 develops the infrastructure-protection framework established by Law 8/2011.

It addresses planning instruments and the responsibilities of relevant public authorities and operators.

Among its important elements are the Planes de Seguridad del Operador (Operator Security Plans) and Planes de Protección Específicos (Specific Protection Plans), as applicable.

A financial operator may assess the effectiveness of such plans through:

Percentage of important protective controls implemented.

Completion of scheduled security reviews.

Results of emergency exercises.

Time required to activate contingency procedures.

Percentage of identified deficiencies corrected.

These are proposed management indicators, not a uniform statutory scoring formula.

3.3 Directive (EU) 2022/2557: Critical Entities Resilience

The Critical Entities Resilience Directive (CER) shifts the European approach toward an all-hazards model.

It considers threats including natural hazards, accidents, public-health emergencies and malicious conduct.

It requires Member States to identify critical entities and establishes resilience-related obligations for entities within its scope.

A particularly important qualification concerns financial institutions: the directive's treatment of banking and financial-market infrastructure is subject to sector-specific exclusions and arrangements, especially where EU financial-sector legislation already regulates resilience.

It would therefore be inaccurate to assume that every CER resilience duty automatically applies to every Spanish bank.

3.4 Regulation (EU) 2022/2554: DORA

DORA is central to digital operational resilience measurement in Spanish finance.

Its provisions cover:

ICT risk management.

ICT-related incident management and reporting.

Digital operational resilience testing.

ICT third-party risk management.

Information-sharing arrangements concerning cyber threats, under applicable conditions.

Article 6 establishes the ICT risk management framework, while Article 11 concerns response and recovery.

Article 12 addresses backup policies, procedures, restoration and recovery arrangements.

Articles 24–27 provide the testing framework, including advanced threat-led penetration testing for institutions meeting the relevant criteria.

Article 28 establishes general principles for managing ICT third-party risk.

Financial significance: DORA makes operational resilience an important subject of governance, supervision, operational expenditure, contractual management and investment.

For instance, a bank may need to invest in alternative communications networks, redundant cloud services, recovery environments or more sophisticated testing.

But DORA does not prescribe a single aggregate resilience score comparable across every financial institution.

3.5 BRRD and banking continuity

The Bank Recovery and Resolution Directive addresses a related but distinct problem: the continuity of critical financial functions when an institution experiences severe financial distress or failure.

Critical functions may include particular deposit-taking, lending, payment, clearing or settlement services, depending on the relevant analysis.

Spain's bank resolution framework includes Law 11/2015 on the recovery and resolution of credit institutions and investment firms, together with its implementing measures.

Thus, banks may face two complementary resilience challenges:

Operational resilience: Can essential services continue despite an operational incident?

Resolution continuity: Can critical functions be preserved or transferred when the financial institution itself fails?

Both are relevant to financial stability, but they are governed by different legal tests and supervisory mechanisms.

4. Measuring Critical Infrastructure Resilience in Spanish Finance

Resilience measurement requires converting broad legal duties into measurable indicators.

A comprehensive financial-sector assessment should examine six dimensions:

Six dimensions of financial infrastructure resilience

01

Availability

Can essential financial services remain accessible?

02

Recovery

How quickly can interrupted services be restored?

03

Cybersecurity

Can systems resist and contain digital incidents?

04

Interdependency

Can services withstand supplier and infrastructure failures?

05

Financial capacity

Are resources sufficient to sustain and restore operations?

06

Governance

Are controls tested, documented and corrected?

4.1 Service availability measurement

Service availability evaluates how consistently a bank or financial infrastructure provides essential functions.

Typical monitored services include ATM networks, online banking, electronic fund transfers, payment processing and securities-settlement connectivity.

The basic availability formula is:

\[ A=\frac{T-D}{T}\times100 \]

Where:

\(A\) = service availability percentage.

\(T\) = total scheduled operating time.

\(D\) = unplanned service downtime.

Illustration: Suppose a Spanish bank operates a critical payment gateway continuously for a 30-day period and experiences a total outage of 90 minutes.

\[ T=30\times24\times60=43,200\text{ minutes} \]

\[ A=\frac{43,200-90}{43,200}\times100 \]

\[ \boxed{A=99.79\%} \]

Although 99.79% availability may appear satisfactory, the legal and financial significance depends on which service was disrupted, when the interruption occurred, how many customers were affected, and whether transaction settlement deadlines were missed.

A short outage affecting a systemically important payment service may be much more significant than a longer outage affecting a nonessential administrative system.

4.2 Recovery Time Objective (RTO)

RTO measures the targeted maximum time for restoring a disrupted service.

Suppose a Spanish credit institution establishes an internal RTO of 30 minutes for an important payment-processing service.

A practical measurement is:

\[ \text{RTO compliance}= \frac{\text{Tests meeting RTO}}{\text{Total relevant tests}} \times100 \]

If 18 of 20 recovery tests meet the target:

\[ \text{RTO compliance}=90\% \]

The bank should investigate the two failures and consider the potential consequences for essential financial services.

RTOs must be defined with reference to the nature of the service, risk analysis and applicable requirements. Thirty minutes here is an example, not a universal Spanish legal threshold.

4.3 Recovery Point Objective (RPO)

RPO measures the acceptable period of potential data loss when restoring a service.

For example, if a bank sets an RPO of five minutes, its backup and recovery architecture should be designed to avoid losing more than the specified period of transaction data under the scenarios covered by that objective.

A useful measure is:

\[ \text{RPO breach rate}= \frac{\text{Recovery exercises exceeding RPO}}{\text{Total exercises}} \times100 \]

Financial institutions must additionally assess transaction integrity, reconciliation and consistency.

This matters because a recovered payment system that contains incorrect account balances or duplicate transactions cannot necessarily be regarded as operationally resilient.

4.4 Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR)

MTTD measures how quickly the institution identifies incidents.

MTTR measures how quickly services are restored.

\[ MTTD=\frac{\sum \text{Incident detection delays}}{N} \]

\[ MTTR=\frac{\sum \text{Service restoration durations}}{N} \]

Lower figures generally indicate stronger capabilities, although incident severity and service criticality must also be considered.

For supervisory purposes, banks should not rely exclusively on averages, because a small number of very long outages may be concealed by many minor incidents.

4.5 Interdependency resilience

A bank may possess robust internal technology yet remain highly vulnerable to electricity suppliers, telecommunications operators or cloud service providers.

Interdependency measurement should assess:

Dependence upon individual technology suppliers.

Existence and independence of alternative telecommunications routes.

Availability of backup power.

Geographic concentration of data-processing facilities.

Service continuity if a third-party provider fails.

Feasibility of transferring functions to alternative providers.

An institution can measure its single-provider dependency ratio as:

\[ SPD=\frac{\text{Critical services dependent on one provider without a viable alternative}}{\text{Total critical services}}\times100 \]

This is an analytical management indicator, not a metric prescribed by DORA.

A particularly important consideration is whether apparent redundancy is genuinely independent. Two telecommunications contracts do not provide adequate diversification if both depend on the same physical network route.

5. Interactive Example: Financial Resilience Assessment

The following example demonstrates how a Spanish bank might construct an internal resilience score.

It is an illustrative management model, not an officially prescribed Banco de España, ECB or DORA calculation.

Illustrative Bank Resilience Index

Change the six assessment scores to see the effect.

82.3

out of 100

Service availability

25% weight

95/100

Recovery capability

20% weight

80/100

Cybersecurity controls

20% weight

85/100

Third-party independence

15% weight

60/100

Financial preparedness

10% weight

75/100

Governance and testing

10% weight

90/100

Assessment interpretation

Moderate composite result; examine weak components and concentration risks.

Reset

The weighted score is calculated as:

\[ RI=\sum_{i=1}^{n}w_i s_i \]

Where \(w_i\) represents the weight allocated to each dimension, expressed as a proportion, and \(s_i\) represents the dimension's score.

Important limitation: A composite score should never conceal a failure of a mandatory legal requirement or an unacceptable failure of a critical service. Banks should use minimum thresholds and mandatory escalation criteria alongside any weighted index.

6. Financial Measurement of Resilience

Resilience is not simply a technical concern. It also has important financial consequences.

6.1 Expected financial loss from infrastructure disruption

An institution can estimate operational disruption exposure using:

\[ EAL=\sum_{i=1}^{n}P_iL_i \]

Where:

\(EAL\) = expected annual loss.

\(P_i\) = estimated annual probability of event \(i\).

\(L_i\) = financial loss associated with event \(i\).

Loss estimates may include restoration expenditure, compensation, contractual liabilities, fraud exposure, lost fee income, legal costs and regulatory consequences, where applicable.

For example:

This is a simplified scenario illustration. It assumes suitable probability estimates and does not model correlations or simultaneous events.

6.2 Resilience Investment Efficiency

Banks must determine whether expenditure on redundancy, backup systems, recovery facilities and testing produces an appropriate reduction in risk.

An indicative formula is:

\[ RIE=\frac{EAL_{\text{before}}-EAL_{\text{after}}}{C} \]

Where \(C\) is the relevant annualized cost of the investment.

For example, if an infrastructure upgrade reduces modeled expected annual loss from €1.6 million to €600,000 at an annualized cost of €400,000:

\[ RIE=\frac{1,600,000-600,000}{400,000}=2.5 \]

The modeled annual loss reduction is 2.5 times the annualized cost.

Nevertheless, a positive financial return does not replace regulatory compliance. A bank may be required to implement certain protections even where its internal cost-benefit analysis appears unfavorable.

6.3 Resilience and bank capital

Operational failures can create losses affecting profitability and capital resources.

Under applicable prudential rules, operational risk is relevant to regulatory capital requirements, governance and internal risk assessment.

But an important distinction remains: operational resilience indicators under DORA are not themselves a direct formula for reducing Pillar 1 capital requirements.

A regulator may consider operational vulnerabilities in the wider supervisory assessment, but banks should not assume that better system availability automatically produces a specified reduction in regulatory capital.

6.4 Financial liquidity and payment continuity

A payment-system disruption can affect the timing of liquidity flows.

Relevant measures include:

Value of delayed settlement obligations.

Number and value of unsettled transactions.

Liquidity held against foreseeable operational disruptions.

Intraday liquidity usage.

Time required to restore payment connectivity.

Effect of disruption on collateral movements.

For a bank participating in major euro payment systems, operational resilience may be essential to meeting financial obligations even when the institution remains solvent.

7. Important Case Laws and Judicial Principles

There is no single body of Spanish or EU case law establishing a universal quantitative methodology for measuring critical infrastructure resilience in banking.

Instead, relevant judicial principles arise from cybersecurity, data protection, banking resolution, financial supervision and the continuity of critical financial functions.

The following cases illustrate how courts have approached closely related obligations.

Case 1: Natsionalna agentsia za prihodite (Case C-340/21) — CJEU, 14 December 2023

Subject: Cybersecurity, risk management and institutional accountability.

Facts

The case concerned a cyberattack against Bulgaria's National Revenue Agency, resulting in unauthorized disclosure of personal data.

Proceedings raised questions concerning the security obligations of the data controller under the General Data Protection Regulation (GDPR).

Legal issues

The Court considered whether unauthorized disclosure of data necessarily demonstrated that an organization had implemented inappropriate technical and organizational security measures.

The Court also considered the burden of proof and potential compensation for non-material damage.

Judgment

The Court held, among other things, that unauthorized access or disclosure by a third party does not, by itself, prove that security measures were inappropriate.

The appropriateness of the measures must be assessed in light of the circumstances and relevant risks.

The controller bears the burden of proving that its implemented security measures were appropriate under Article 32 GDPR.

Application to Spanish financial infrastructure

This judgment provides a useful principle for measuring cyber resilience:

A cybersecurity incident does not automatically prove regulatory noncompliance, but an institution must be able to demonstrate that its security arrangements were appropriate.

A Spanish bank should therefore maintain credible documentation of:

Cybersecurity risk assessments.

Security controls and control testing.

Vulnerability management.

Incident-detection and response measures.

Remediation following previous incidents.

Legal significance: The judgment directly interprets GDPR security obligations, not DORA's resilience metrics. Its reasoning is relevant by analogy, and directly where financial institutions are subject to GDPR.

Case 2: Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18) — CJEU, 16 July 2020 (Schrems II)

Subject: International data transfers and third-country safeguards.

Facts

The case concerned transfers of personal data from the European Union to the United States, including the legal safeguards required for such transfers.

Judgment

The Court invalidated the EU–US Privacy Shield adequacy decision then in force.

It upheld the validity of the standard contractual clauses decision examined in the proceedings, subject to ensuring adequate protection in the circumstances of transfers.

Application to Spanish finance

Spanish banks may rely on international cloud computing, outsourced data processing and global technology infrastructure.

An institution's ability to move data and operations between jurisdictions is affected by privacy and data-transfer law.

Accordingly, a bank's resilience planning should examine whether alternative recovery arrangements can be operated lawfully.

A disaster-recovery site cannot be evaluated solely for technical readiness if its use would violate applicable data-protection requirements.

Legal significance: Operational redundancy must be assessed together with applicable legal restrictions. This case concerns international data protection, not an independent duty to geographically diversify financial infrastructure.

Case 3: Banco Santander SA v J.A.C. and M.C.P.R. (Case C-410/20) — CJEU, 5 May 2022

Subject: Banking resolution and the legal consequences of preserving financial stability.

Facts

The dispute concerned claims associated with investments in Banco Popular Español following the bank's resolution and acquisition by Banco Santander.

It raised questions about the relationship between securities-law investor protection and the legal consequences of resolution measures under the EU banking resolution framework.

Judgment

The CJEU held, in the circumstances addressed, that the relevant provisions of the BRRD precluded certain claims seeking liability or restitution associated with shares that had been written down in the resolution.

Application to resilience measurement

The Banco Popular experience illustrates an important distinction between:

Maintaining the financial stability and continuity of relevant banking functions.

Protecting every shareholder or creditor from financial loss.

Financial-sector resilience does not necessarily mean that an institution survives independently or that all investors avoid losses.

It may instead mean that important financial functions remain available through resolution, transfer or restructuring.

Spanish significance

This case is especially relevant because it arose from the resolution of a Spanish bank within the European banking-union framework.

It supports the need to distinguish operational continuity metrics from solvency, investor protection and resolution outcomes.

Case 4: United Kingdom v European Parliament and Council (Case C-270/12) — CJEU, 22 January 2014

Subject: Financial supervisory powers and EU regulatory authority.

Facts

The United Kingdom challenged powers conferred on the European Securities and Markets Authority (ESMA) in connection with restrictions on short selling under Regulation (EU) No 236/2012.

Judgment

The CJEU rejected the challenge and upheld the relevant EU framework conferring intervention powers on ESMA.

Application to resilience governance

The judgment illustrates the importance of a legally defined EU supervisory framework for responding to risks affecting financial markets.

It is relevant to understanding the broader institutional structure through which European authorities exercise financial stability and supervisory responsibilities.

However, it does not itself establish operational resilience testing standards or numerical infrastructure performance indicators.

Case 5: Peter Puškár v Finančné riaditeľstvo Slovenskej republiky (Case C-73/16) — CJEU, 27 September 2017

Subject: Data processing, administrative procedures and effective judicial protection.

Facts

The proceedings concerned the processing of personal data by financial and tax authorities, including the legality of administrative data processing and the available means of judicial redress.

Judgment

The Court examined the interplay between data-protection requirements, administrative procedures and effective judicial protection.

Application to resilience

Financial-sector resilience programs frequently involve extensive logging, monitoring, incident investigation and processing of employee and customer information.

In Spain, those activities must be undertaken consistently with applicable privacy and procedural requirements.

The case is therefore relevant to the lawful governance of information used for security and resilience monitoring, rather than to a technical resilience score.

Comparative case-law table

These cases establish important legal principles but should not be cited as judicial approval of a particular resilience index, weighting scheme or Spanish critical-infrastructure score.

8. Institutional Responsibilities in Spain

Several authorities have responsibilities that may intersect when evaluating financial-sector resilience.

An important governance problem arises when the same failure creates several different forms of regulatory concern.

For example, a cyberattack against a bank might involve DORA incident reporting, personal-data breach obligations under GDPR, critical-infrastructure reporting requirements where applicable, and prudential supervisory engagement.

These regimes may interact, but reporting under one framework should not automatically be assumed to satisfy every other applicable obligation.

9. DORA-Based Operational Resilience Measurement

DORA provides one of the strongest legal foundations for formalized resilience assessment in European finance.

Its requirements can be translated into an internal performance-monitoring framework.

Regulatory technical standards supplement DORA's general requirements. Institutions must consider the standards applicable to their category and activities, including proportionality and any simplified-framework provisions.

Example: ICT third-party concentration risk

Assume a Spanish banking group depends upon one major cloud services provider for:

Digital account access.

Customer authentication.

Mobile payment processing.

Fraud detection.

Even if the cloud provider reports high service availability, the bank might still have a substantial concentration risk.

A meaningful resilience test could simulate loss of access to that provider and evaluate whether alternative systems can maintain services within the bank's approved recovery objectives.

The resulting evidence would be more informative than merely recording that the provider possesses security certifications.

10. Resilience Measurement Across Financial Infrastructure Dependencies

Illustrative dependency network for a Spanish bank

Conceptual dependency diagram. Connections represent potential operational dependencies, not a map of any particular institution's actual infrastructure.

10.1 Electricity dependency

Financial institutions depend on reliable electricity for processing systems, physical facilities, ATMs and communications equipment.

Relevant resilience measures include backup-power activation success, tested backup duration, recovery performance after utility restoration and availability of independently supplied facilities.

10.2 Telecommunications dependency

Banking services depend on connectivity between branches, customers, data centres, counterparties and payment infrastructure.

Useful indicators include communications-path diversity, failover success rate, network recovery time and the proportion of important sites with independently routed backup connectivity.

10.3 Cloud dependency

Cloud services create efficiencies but may also produce systemic concentration vulnerabilities.

A financial institution should evaluate geographic risk, contractual recovery guarantees, portability, incident-notification arrangements, subcontracting chains and tested exit capabilities.

The appropriate assessment is not simply whether the bank has multiple vendors, but whether important financial services can actually survive the loss of a vendor or service.

11. Proposed Regulatory and Supervisory Resilience Dashboard

A Spanish financial institution can establish an internal dashboard to track its resilience and demonstrate oversight.

The following targets are illustrative; they should not be mistaken for universal statutory requirements.

For each indicator, a bank should identify an accountable owner, data source, verification method, escalation threshold and remediation process.

A stronger dashboard also records actual incident outcomes, because successfully completing a controlled exercise does not establish that a bank can withstand every real-world disruption.

12. Hypothetical Case Study: Major Payment Infrastructure Failure in Spain

Facts

Assume a Spanish bank, Banco Alfa, operates an important electronic payments platform.

A regional electricity disruption causes the loss of its principal data-processing facility. The bank's backup facility is operational, but its telecommunications connections depend on the same routing infrastructure.

The bank experiences a three-hour interruption of its payments service.

This is a hypothetical case, not a reported judicial decision.

Legal analysis

First: Critical-infrastructure law

If the relevant infrastructure is formally designated under Spain's critical-infrastructure regime, the operator must consider its applicable protection-planning and notification obligations.

The mere fact that a payment system is important does not automatically establish formal designation under Law 8/2011.

Second: DORA

The bank must examine whether its ICT risk management, continuity planning, backup arrangements, testing and third-party controls satisfied the applicable DORA requirements.

It must also assess whether the incident meets the criteria for regulatory reporting.

Third: Prudential governance

The responsible supervisors may examine whether weaknesses in governance or operational risk management contributed to the disruption.

Fourth: Financial consequences

The bank may incur restoration costs, contractual liabilities, customer remediation costs or other financial losses, depending on the circumstances.

Proposed measurement

Assume the following evidence:

Findings

The bank met its RPO and backup-power objectives but failed its recovery-time and communications-failover objectives.

The key weakness was not necessarily inadequate electricity redundancy alone.

Instead, it involved correlated infrastructure dependency, where principal and alternative processing arrangements shared a vulnerable telecommunications component.

Potential legal conclusions

Regulatory noncompliance cannot be inferred automatically from the duration of the outage.

A proper investigation must consider the applicable obligations, adequacy of controls, testing history, incident response, reporting and evidence of prior identified risks.

However, the failure could justify increased supervisory scrutiny, remediation requirements or other measures where the relevant legal conditions are satisfied.

This illustrates why a multidimensional resilience assessment is more informative than a single availability percentage.

13. Major Legal and Financial Challenges in Spain

13.1 Absence of one unified legal resilience score

Spain does not have a single universal numerical score that conclusively determines compliance with all national infrastructure-protection, EU digital resilience and banking prudential requirements.

Different regimes measure different risks.

A bank must therefore distinguish internal management indicators from statutory duties and supervisory expectations.

13.2 Fragmented regulatory responsibilities

Banks may be answerable to several supervisory or public authorities for different aspects of a disruption.

This makes coordinated incident management and accurate regulatory mapping particularly important.

13.3 Concentration of technology services

The increasing use of major cloud and technology providers can create correlated vulnerabilities across multiple financial institutions.

A failure affecting one shared provider may affect numerous banks simultaneously.

13.4 Cost of resilience investment

Redundant infrastructure, testing and specialized personnel impose costs, particularly on smaller institutions.

Proportionality can affect how applicable regulatory requirements are implemented, but it does not eliminate obligations merely because compliance is costly.

13.5 Measuring systemic consequences

A bank's internally measured recovery performance may not adequately capture its impact on the wider financial system.

For example, a short interruption in a major settlement service can create knock-on effects that exceed the direct operational loss experienced by the affected institution.

System-wide analysis therefore requires network dependency mapping, concentration assessments and stress testing across institutions.

14. Recommendations for Strengthening Financial Infrastructure Resilience in Spain

A sound Spanish financial-sector resilience measurement system should combine legal compliance, technical testing, financial analysis and supervisory oversight.

The following priorities are particularly important:

1. Establish a unified internal resilience inventory. Identify important business services, supporting infrastructure, legal obligations and accountable owners.

2. Map cross-sector dependencies. Assess electricity, telecommunications, cloud services and payment infrastructure, including common points of failure.

3. Use service-based indicators. Measure the continuity of important customer and market functions rather than focusing exclusively on IT equipment uptime.

4. Conduct severe but plausible stress tests. Include concurrent outages involving multiple services or suppliers, with scenarios proportionate to the institution's risks.

5. Link operational metrics to financial exposure. Estimate loss severity, liquidity effects, remediation costs and potential consequences for critical functions.

6. Strengthen third-party oversight. Verify contractual arrangements, supplier concentration, subcontracting visibility and practical recovery alternatives.

7. Maintain reliable supervisory evidence. Preserve test outcomes, incident timelines, governance decisions, remediation records and supporting risk assessments.

8. Review resilience metrics after real incidents. Update recovery objectives, threat scenarios and internal risk assumptions based on observed failures.

15. Conclusion

Critical Infrastructure Resilience Measurement in Spain's financial sector lies at the intersection of critical-infrastructure law, banking regulation, cybersecurity, operational risk, financial stability and EU digital resilience legislation.

Spanish Law 8/2011 and Royal Decree 704/2011 provide a national infrastructure-protection framework. DORA establishes detailed digital operational resilience obligations for financial entities within its scope. Banking prudential and resolution laws address complementary dimensions of operational risk and continuity of critical financial functions.

Effective measurement should assess not only whether individual banking systems remain operational but also whether essential financial services can withstand serious, interconnected disruptions.

The most important indicators include availability, recovery objectives, incident management, third-party concentration, dependency resilience, governance effectiveness and financial loss exposure.

The relevant CJEU decisions demonstrate that cybersecurity accountability, lawful data management, financial supervision and banking-resolution continuity operate within defined legal frameworks. None of the cited judgments independently establishes a universal resilience measurement formula.

Ultimately, the strongest resilience framework is one that can demonstrate, using tested and reliable evidence, that an institution can preserve or restore its essential financial functions under severe but plausible conditions.

16. Primary Legislation and Case-Law References

Spanish legislation

European Union legislation

Judicial decisions

These official sources provide the foundation for deeper legal research. The explanations above reflect established legal provisions and case-law principles, while current consolidated legislation and post-2024 Spanish implementing developments should be checked before relying on them in a formal legal opinion.