CNPIC and critical infrastructure
In the last few years, certain areas of activity or infrastructure which provide essential services, of vital relevance for the continuity of state functioning, have become the target of numerous attacks. It is hard to miss that there is a strong dependency over certain infrastructures whose interruption or destruction would have a huge impact on the health, security and economic wellbeing of the citizens. Such infrastructures have become a high-priority target for state security strategies, materializing the concept of ”critical infrastructure”.
The development and application of different national and European legislations moved Spain to set in motion a National Plan for the protection of Critical Infrastructures (PNPIC), which causes the creation of the National Center for the Protection of Critical Infrastructures (CNPIC). The CNPIC is in charge of encouraging and coordinating the necessary mechanisms to grant the security of critical infrastructure. It was accompanied by the creation of the National Catalogue of Critical Infrastructure, which contains an updated and contrasted list of every strategical infrastructure within the national territory: location, ownership, granted services, level of security, etc. This list is categorized as secret, given the high sensibility of the information held in the catalogue.
The catalogue comprises more than 3.500 sensitive installations and infrastructures within several strategic areas. Initially, the Catalogue only included infrastructure related to sectors of energy and transport, although the set of sectors that are included has been widened since its creation.
IT Infrastructures and NIS Directive
At a European level, the EU has been taking steps towards grating a higher level of security on networks and information systems. In February 2013, the Strategy of Cybersecurity of the European Union was published (Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace). This document comprises the aspects of interior market, justice and foreign affairs in relation to the cyberspace. The cybersecurity strategy and the Directive proposal back the European Digital Agenda, whose purpose is to help European citizens and companies to make the best out of digital technologies.
This strategy is complemented with the “Directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union” (Directive (EU) 2016/1148), known as NIS Directive, which was enacted on the 6th of July 2016.
According to the NIS Directive, the existing capabilities are not enough to guarantee a high level of security on networks and information systems within the European Union. The levels of preparation among different member states are very different, entailing unequal levels of protection of consumers and companies and compromising the general level of security on networks and information systems in the Union. For this reason, it establishes common minimum requirements in terms of development of capabilities and planification, exchange of information, cooperation and common security requirements for the operators of essential services and the providers of digital services. As a part of this strategy, the service providers are encouraged to adopt the necessary measures to manage the security risks and notify the incidents that could entail a significant perturbing effect to the National Authorities, proposing the creation of a cooperation network among different Member States.
Transposition of the NIS Directive in Spain
On 7th September 2018, the Royal Decree-Law for the transposition of the European NIS Directive on cybersecurity was enacted. It will be applied to entities who provide essential services to the community and who depend on networks and information systems to develop their activity. Its application field is widened to sectors which are not explicitly included in the directive in order to give this law a global scope, although it preserves its specific legislation. The new regulation will apply to the providers of certain digital services too.
The main impact of the transposition of the NIS directive is that it includes additional areas to the National Catalogue of Critical Infrastructure. Currently, the areas included within the Catalogue are the following:
- Energy
- Nuclear industry
- IT
- Water
- Food supply
- Health
- Financial System
- Transport
- Chemical Industry
- Space
- Research
- Administration
On the other hand, the Royal Decree-Law demands the operators of essential services and the providers of digital services to notify the significant incidents that they might suffer on the networks and information services used to provide essential and digital services. The law protects the identity of the notifier and the personnel who notifies such incidents, remaining this information confidential to the public and authorities other than the notifier.
NIS directive and Spanish National Security Scheme (ENS)
The transposition of the NIS Directive aims for encouraging the development of interior markets through the improvement of the level of security on networks and information systems which uphold the provision of essential and digital services. On this way, efforts are being made to align the measures imposed by the NIS Directive with the general strategy adopted with the development and application of the Spanish National Security Scheme (ENS) which has started to be adopted in the last years by public administrations and the private companies which provide them with IT services.
This alignment of efforts between the NIS Directive and ENS will be reflected in the future publication of a package of ENS additional measures oriented to the fulfilment of the NIS Directive, as was announced at the CCN-CERT event talk, Convergence of the NIS norm with PIC, by Fernando Sánchez, head of the CNPIC. Thanks to this NIS-ENS package, it will be easier to meet the requirements of both regulations through the incorporation of a series of additional measures to the existing on the ENS which, once established, will be valid for the compliance with NIS Directive.
