News

Cybersecurity is now a management issue

NIS 2 and Andorra’s Llei 22/2022 make management responsible for cybersecurity. What this means for SMEs that are in scope and for their suppliers.

Published By BDR Group11 min read

European and Andorran cybersecurity rules place responsibility on management bodies: they must approve the measures, oversee their implementation and undergo training. SMEs that are not in scope feel it too, because customers that are in scope demand it from their suppliers. Cybersecurity has to be decided at the top of the company, with the support of the technical staff.

What the rules say about management

Directive (EU) 2022/2555, known as NIS 2, says that the management bodies of essential and important entities must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable if the entity fails to comply (Article 20(1)). The members of those bodies must follow training (Article 20(2)). Member States had to apply the directive from 18 October 2024 (Article 41).

In Andorra, Llei 22/2022 of 9 June on measures for the security of networks and information systems (BOPA no. 76, 22 June 2022) follows the same scheme. Article 17 provides that management bodies approve the measures, oversee their implementation and answer for non-compliance, and that their members must undergo regular training.

In Spain, the law that must transpose the directive is still going through the legislative process. The Council of Ministers approved the preliminary draft (anteproyecto) on 14 January 2025 and, as at 25 October 2026, we have not found it published in the BOE, Spain’s official gazette. That is no reason to wait: the European text already sets the direction.

What can happen if you do not comply

NIS 2 lets each country decide how liability is made specific, but it sets a minimum. Essential entities face fines of up to 10 million euros or 2% of worldwide turnover, and important entities 7 million or 1.4% (Article 34). For essential entities, if enforcement measures do not work and the entity does not remedy the deficiencies within the set time limit, the authority may request that the chief executive or legal representative be temporarily prohibited from exercising management functions (Article 32(5)(b)). In essential entities, the people who lead, represent or control the entity must be able to be held liable for failing to ensure compliance (Article 32(6)).

In Andorra, Article 36 of Llei 22/2022 provides for fines of 30,001 to 100,000 euros for very serious infringements, 15,001 to 30,000 for serious ones and, for minor ones, a warning or a fine of 500 to 15,000 euros. Article 31 attributes liability for infringements to the entity, while Article 17 says that management must answer for them. How the two fit together is a question for a legal adviser, but the message is clear: the decision cannot be delegated to the technical department and then forgotten.

Bear in mind that the Government of Andorra announced on 23 June 2026 that the Council of Ministers had approved a bill amending Llei 22/2022. Among other changes, it extends the obligation to notify incidents to all entities and makes a security operations centre (SOC) mandatory for critical entities. As at 25 October 2026 we have not found the amended text published, so we rely on the 2022 text; it will need to be revisited when the reform comes into force.

The deadlines leave no time to improvise

NIS 2 requires the affected entity to send an early warning within twenty-four hours of becoming aware of a significant incident, a notification within seventy-two hours and a final report within one month (Article 23(4)). The Andorran law sets notification to CSIRT-AD (Andorra’s computer security incident response team) without delay and, in any case, within seventy-two hours of detection (Article 15).

If the incident affects personal data, there is another clock running in parallel: seventy-two hours to notify the supervisory authority, under the GDPR (Article 33) in Catalonia and under Llei 29/2021 (Article 36) in Andorra, where the authority is the Andorran Data Protection Agency (APDA).

On a Friday afternoon, the accounts mailbox of a distributor in Lleida starts sending fake invoices to customers. If nobody has decided beforehand who warns whom and who speaks to customers, the first hours are lost arguing. That is why an incident plan is a management decision before it is a tool.

If you are not covered, it still reaches you

NIS 2 applies, in general, to medium-sized and large companies in the sectors listed in its annexes (Article 2). The Andorran law applies to entities in those sectors with fifty or more employees or with turnover or a balance sheet above ten million euros (Article 2). A small shop, professional practice or workshop is probably not directly covered.

But the directive asks covered entities to take care of supply chain security, including relationships with their direct suppliers (Article 21(2)(d)). In practice, this means security questionnaires, new contract clauses and questions about backups, access and multi-factor authentication. A maintenance company with remote access to an energy distributor’s facilities, or a software company serving a hospital group, will notice before the Spanish law is published.

Companies that work for the Spanish public administration have another framework already in force: the National Security Scheme (Esquema Nacional de Seguridad, ENS; Royal Decree 311/2022) applies to private-sector systems that provide services or supply solutions to public sector entities, including the obligation to have a security policy (Article 2(3)).

Budget and governance: putting it into practice

Of the ten minimum measures listed in NIS 2 (Article 21(2)), most are organisational: risk analysis, incident handling, continuity and backups, supply chain, training, access control. Without someone setting priorities, the tools end up being licences that nobody reviews.

Neither law sets a percentage of budget. NIS 2 asks for measures proportionate to the entity’s size, exposure and cost (Article 21(1)), and the Andorran law to its dependence on critical systems and the availability of alternatives (Article 13(2)). Approving measures without resources to apply them makes no sense, and this is where management has a concrete job to do. We recommend:

  • A named owner for each critical system. The Andorran law asks for an Information Security Delegate (Delegat de la Seguretat de la Informació) to be appointed, with resources and effective communication with senior management (Article 18).
  • A fixed item on the agenda, once a quarter, with few indicators: incidents, open critical vulnerabilities, the result of the last restore test.
  • A written record of decisions: what is approved, what is postponed and what risk is accepted, with date and signature.
  • An annual amount set aside for security, which does not depend on having an incident.

The directive itself allows measures to be proportionate: the point is not to build a bank’s structure, but to be clear about the minimum.

Training for management

Article 20(2) of NIS 2 and Article 17(2) of Llei 22/2022 agree on the objective: that members of management have sufficient knowledge and skills to understand and assess risks and management practices, and their impact on the entity’s operations. Training should not be limited to the technical team.

A long course is not needed. An annual session of a few hours, with an incident simulation exercise (what do we do if tomorrow we cannot open any file), covers what the rule asks for and makes clear who decides. This is our recommendation; neither rule sets a duration or format.

What to ask the head of IT

Six questions that management should be able to ask, and get answered in writing:

  1. Which five systems would stop the company if they failed, and who is responsible for each?
  2. When was the last backup restore tested, and how long did it take?
  3. Who has administrator access and when was it last reviewed?
  4. Where do we have multi-factor authentication and where not?
  5. Which critical vulnerabilities are open and since when?
  6. Which suppliers have access to our systems or data, and what do the contracts say about security and incidents?

If the answer is "I don’t know", putting resources into it or accepting the risk in writing is already a management decision.

What we do about it

We declare our interest: at BDR Group we work on cybersecurity through TutumSec, our specialist business line, with vCISO (virtual chief information security officer) consulting, audits, penetration testing, incident response and a technical office that supports NIS 2 compliance. If you want some initial guidance, TutumSec offers a free diagnosis based on what can be observed of your domain on the internet and on a short questionnaire. It does not replace an audit, but it helps you know where to start.

What to do now

  1. Find out which framework applies to you (NIS 2 or the future Spanish law, Llei 22/2022, the ENS, or only data protection) and whether any customer drags you in as a supplier.
  2. Make a list of critical systems with an owner for each.
  3. Write a one-page incident plan: who decides, who is warned (CSIRT-AD in Andorra, INCIBE’s 017 line in Spain, the data protection authority) and within what time limits.
  4. Enable multi-factor authentication on external access and check a backup restore.
  5. Schedule annual training for management, not only for the technical team.

Frequently asked questions

Does my SME have to comply with NIS 2?

It depends on the sector and size. In general it affects medium-sized and large companies in the sectors in the directive’s annexes, with some cases that are covered whatever their size. If you work for a covered entity, you will notice it anyway.

If the Spanish law has not been approved yet, can I wait?

We do not recommend it. Requirements already arrive by contract from covered customers, and the basic measures are useful with or without a law.

Does an Andorran company have to follow NIS 2?

The directive is addressed to EU Member States and does not apply directly to Andorra, which has its own Llei 22/2022. An Andorran company may be affected if it supplies covered EU entities, and some digital providers that offer services in the Union without being established there must designate a representative in it (Article 26(3)).

Whom do I call if I have an incident?

In Andorra, CSIRT-AD is the reference team established by Llei 22/2022. In Spain, INCIBE (the national cybersecurity institute) offers the free helpline 017, every day from 8:00 to 23:00. If personal data is affected, also consider notifying the APDA or the AEPD (the Spanish Data Protection Agency).

Sources

Let’s talk about your company’s security

If you want to know where to start and what your framework requires of you, see the service page: Cybersecurity for businesses with TutumSec

Back to News

News

Related articles