INTRODUCTION
Directive (EU) 2022/2555 —commonly referred to as NIS2— is the cornerstone of the EU’s renewed cybersecurity framework. Adopted in January 2023, its objective is to significantly strengthen the resilience of the Union’s essential systems in the face of an increasingly complex, hostile, and geopolitically sensitive cyber threat landscape. In Spain, its transposition will take place through the upcoming Law on Cybersecurity Coordination and Governance.
Compared to its predecessor, NIS2 considerably expands the directive’s scope, extending cybersecurity obligations to a broader set of strategic sectors and entities — such as public administrations, manufacturers of critical products, and digital social platforms. It includes new requirements on governance, risk management, and incident reporting, and introduces a paradigm shift in accountability by making the top management of firms explicitly responsible for non-compliance.
This shift comes at a time when many organizations in Spain still face deep operational cybersecurity challenges, including lack of leadership literacy and ownership of cyber risks, supply chain vulnerabilities, and the limited technological readiness of current cybersecurity systems in the face of generative AI and other emerging technologies. Addressing these challenges will be key not only to comply with the new directive but to enhance the country’s security and competitiveness in an evolving landscape.
- FINAL REPORT
The Center for the Governance of Change (CGC) at IE University, in partnership with ISMS Forum, has developped a systemic diagnosis of the gaps between the current cybersecurity maturity of organizations newly subject to the NIS2 Directive and the requirements imposed by the regulation by providing a rigorous, actionable model that assesses and strengthens the structural resilience of Spanish organizations.Â
By focusing on structural readiness rather than mere compliance status, the research identifies the key organizational, technological, procedural, and governance barriers that must be addressed through targeted reforms and strategic support — ultimately enabling a more secure, resilient, and future-ready national cybersecurity landscape.
Our goal is twofold:
- To empower subject organizations to elevate the strategic role of their CISOs, enabling better alignment between cybersecurity, governance, and business objectives.
- To support national competitiveness and compliance by generating evidence-based insights that guide organizations, regulators, and policymakers in strengthening cyber resilience.
The project takes an applied-research approach combining desk research, expert validation, and field data collection. It takes place in four phases:
- Foundational Research & Model Design:Â Development of a validated framework of organizational resilience enabling entities to assess their structural and strategic readiness, benchmark performance, and identify clear pathways for improvement.
- Data Collection:Â A survey with cybersecurity and business leaders across key NIS2 sectors to understand the state of governance, responsibilities, and reporting of technological risk.
- Analysis & Benchmarking:Â Collected data is analyzed to produce the first national baseline of cybersecurity maturity and resilience in Spain, identifying sectoral patterns and critical gaps in NIS2 preparedness, highlighting key barriers to strategic resilience, and benchmarking Spanish organizations against the broader EU implementation landscape.
- Stakeholder Engagement & Dissemination:Â Organization of a series of private and public roundtables, convening policymakers, sectoral leaders, and CISOs to discuss results, validate findings, and co-design next steps for implementation.
KEY INSIGHTS FROM THE PROJECT
CERTIFICATION HELPS, BUT IT IS NOT ENOUGH
Organizations certified to ISO/IEC 27001 or ENS show higher scores across all five dimensions of the model, yet on average they remain at level 2, below the basic-compliance threshold. Their advantage is smallest exactly where the gap is widest: integrating cyber risk into enterprise risk management.
HIGH AMBITION, WIDE DISTANCE
Essential entities in the study know where they need to be. 93% aim to reach level 4, the robust compliance NIS2 expects of them, within two years; only 12% of them are there today (n=72). Closing that distance means building governance capacity, not adding more controls.
THE CHALLENGE GOES BEYOND NIS2
The report reads this shortfall as broader than NIS2. Management bodies face NIS2, the critical entities resilience rules, the AI Act, the Cyber Resilience Act and, in finance, DORA, all at once. In substance, each asks the same of senior management: to assess technology risk with method, oversee it with evidence, and answer for that oversight. Organizations that build this capacity for cyber risk will have it for the rest; those that treat each regulation as a separate project risk piling up compliance frameworks without building real capability.
