GMV has provided twenty-three options for improvement in the transposition of the European NIS Directive into Spanish legislation, in such fields as penalizing mechanisms, the approach to security improvement of penalizing organizations, the CISO’s law-abidance role within organizations, the auditing right of organizations subject to the law, communications between organizations and government authorities, the security incident information retention period or the incident reporting method and arrangements.

Security and reliability and security of network communications and information systems are essential for the common activities in our Information Society. Several examples (Wannacry, Petya, DyN, for example) have shown significant impacts on security incidents and how they can affect different Member States and the Union as a whole, influencing economic and social activities. They can also generate considerable financial losses, altering the routines of citizens and the services that are used on a daily basis, undermining user confidence and causing major damages to the economy of the Union.

For that reason the European Union has been promoting a series of actions to guarantee higher security in information systems and networks, such as the “European Union Cybersecurity Strategy” and the “NIS Directive” (European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union), Directive (UE) 2016/1148). They continue and extend other nearby and ongoing actions as, for instance, GDPR.

As it is a European Directive, its adoption in the legislative body of the Member States requires a process of transposition in each one of them. Therefore, Spain initiated this process and submitted the text prepared by the legislator to a process of public consultation by Industry and citizens, prior to its processing and approval by Parliament. GMV has offered its knowledge and experience to the Spanish government, participating in the public enquiry for bringing the Directive into line with Spanish legislation, both individually and in collaboration with other organizations and associations of which it is a member or with which it collaborates.