Spain ENS Art. 13: Separate the information, service, security and system owner roles, with a security POC for outsourced services

What does Art. 13 require?

Articles 11 and 13: the policy identifies the information owner (sets information requirements), service owner (sets service requirements), security officer (decides how to meet them, supervises implementation, reports) and system owner (implements and runs security, may delegate to administrators); the security officer must be distinct from and not subordinate to the system owner, with compensating measures where resources force otherwise; outsourced providers designate a security point of contact backed by management that oversees the service's compliance, security communications and incident handling, final responsibility remaining with the public body.