Spain ENS Art. 31: Audit every system at least every two years, and extraordinarily after substantial changes

What does Art. 31 require?

Article 31: systems undergo a regular audit at least every two years (extendable three months for force majeure) and an extraordinary audit after substantial changes affecting required measures, which resets the two-year count; audits follow the category, any compliance profile, Annexes I and III and the audit technical instruction, and the report states compliance and non-compliance findings, method, scope and evidence; it goes to the system owner and security officer, who analyses it and proposes corrective actions; for ALTA systems serious deficiencies may justify suspending processing or services; the CCN may request reports.