Spain ENS Art. 28: Select the Annex II measures by category and sign a Statement of Applicability

What does Art. 28 require?

Article 28: entities apply the Annex II measures and reinforcements according to the assets, the system category (Article 40 and Annex I) and risk decisions; they are minimums that the security officer may extend; the selected measures are formalised in a Statement of Applicability signed by the security officer; measures may be replaced by compensating measures only where documented to protect equally or better, with the correspondence shown in the Statement and formally approved. CCN may publish specific compliance profiles for sectors or entities (Article 30).