Spain ENS Art. 2: Apply the ENS to public sector systems and to private providers' systems serving them

What does Art. 2 require?

Articles 1 to 3: the ENS sets the basic principles and minimum requirements to protect information and services handled electronically by the whole public sector (Law 40/2015 Article 2), also systems handling classified information, and the systems of private entities that under contract provide services or solutions to public bodies for their administrative functions, which must have a security policy approved by their top executive body; public contract specifications must require ENS conformity declarations or certifications, extended to contractors' supply chains as risk requires; personal data systems also follow the GDPR and LOPDGDD, with a DPO-advised risk analysis and DPIA where required, and the stricter measures prevail.