Spain ENS Art. 40: Categorise each system BÁSICA, MEDIA or ALTA from impact on five security dimensions and review yearly

What does Art. 40 require?

Articles 40 and 41 with Annex I: the information and service owners value the impact of an incident on confidentiality, integrity, traceability, authenticity and availability as BAJO (limited harm), MEDIO (serious harm) or ALTO (very serious harm) using the Annex I criteria (capacity to perform functions, damage to assets, legal non-compliance, harm to individuals); the system takes the highest level across its information and services, and its category is ALTA if any dimension is ALTO, MEDIA if any is MEDIO and none higher, otherwise BÁSICA, determined by the security officer; the category is re-evaluated yearly or on significant change.