We were told NIS2 applies to us — are we legally liable in Spain, and what do we need to do?

The biggest technical hurdle on that questionnaire is usually network segmentation and access control. If you supply parts or remote maintenance to an energy distributor, you must prove that your OT production network is completely isolated from the standard office LAN and public-facing servers.

First thing tomorrow, sit down with the form and split it into three buckets: what you already do, what you can fix in two weeks with simple config tweaks, and what requires CapEx. Fill out and return the first two right away, and provide a clear timeline for the rest. That approach is usually more than enough to protect the contract.

Last month, a logistics client of ours in Barcelona sent us a similar document. An external consultant quoted 12,000 EUR for the audit. We sat down with the client's security lead and realized all they actually wanted was basic cyber awareness training for staff and mandatory password managers; we sorted it out internally for 600 EUR.

Even if you are legally exempt, a corporate client's procurement spec might as well be the law; fail to meet the requirements and you're out of the tender.

Does the document you received only ask for a self-assessment questionnaire or do they require an independent third-party audit report or Esquema Nacional de Seguridad (ENS) compliance certificate? That single detail will completely change your budget.

Even though NIS2 transposition into national law hasn't even fully settled in Spain yet, big corps are dumping boilerplate audit forms onto every single vendor. It's just a knee-jerk reaction to cover their own backs by squeezing small businesses; you can actually negotiate most of those items.

The 3 critical security areas you need to address immediately are: 1) Mandatory multi-factor authentication on all remote connections and email, 2) Encrypted, air-gapped backup routines, 3) A written offboarding procedure to instantly revoke access rights when vendor personnel leave.

It gets exhausting when small shops of 30-40 people like us get treated like were running a nuclear power plant. I mean but once you get these procedures in place, it actually turns into a huge selling point against your competitors, look at it that way.

I completely agree. An untested backup is not a backup.

Everything goes well for the first three months; problems arise in the fourth. If you post the result here, it will help others too.

we've heard this a lot, but it never happened like that for us. any unwrittten clause becomes a point of disagreement later as both sides remember it differently.

proven by experience.

Timely topic.

To get into the details: Most time waste accumulates in tasks waiting for approval.

Of course it varies if your situation is different.

This is exactly what we experienced. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Of course, it varies if your situation is different.

Correct. Taking measures without an inventory leaves doors you haven't seen open.

If you post the result here, it will help others too.

Let me speak from the other side; I'm on the supplier side. If 2FA is on, a stolen password alone is useless.

This is my opinion, I'm not claiming it's absolute truth.

Let me speak from the other side; I'm on the supplier side. An automated scan report is not the same as a penetration test.

If you post the result here, it will help others too.

This approach has a cost which isn't discussed... People defend habits, not processes. Resistance comes from there.

Just leaving this note, it might be useful.

There is something to watch out for. Don't hesitate to ask; those who don't ask always pay more.

If I were you Id go this route.