The legislation applicable to the railway sector in terms of cybersecurity is that relating to the security and protection of critical infrastructures, which encompasses the transport sector. And given the interoperability between states and the scope of the matter, it is regulated by the European Union.
NIS DIRECTIVE
Currently, the legislation in force in Spain is based on the NIS Directive (Security of Network and Information Systems), Directive (EU) 2016/1148 of the European Parliament and of the Council, on measures to ensure a high common level of security of network and information systems in the Union, incorporated into Spanish national legislation in September 2018. This directive was repealed in the European Parliament and replaced by what is known as NIS2, pending integration into Spanish legislation.
For the first time, the NIS directive focuses on improving the protection of infrastructures on which many services dedicated to serving a society (Essential Services) operate. These are network infrastructures and information systems, whose alteration through the network could have enormous consequences on the population both economically and in terms of safety, health, and social welfare.
It also specifies which will be the competent authority that exercises both the functions of surveillance and sanctioning and the figure of the Reference Computer Security Incident Response Teams (CSIRTs), responsible for analysing risks and supervising incidents at national level in order to mitigate their effects.
The National Platform for Notification and Monitoring of Cyber incidents is also created as a tool for CSIRTs.
Given the meteoric evolution of both the number of cyberthreats and its own operability, the EU has continued to legislate to adapt this directive to current requirements and has done so with the CER and NIS2 directives.
