National Centre for the Protection of Critical Infrastructure
Español (España)  English (United Kingdom)
CNPIC - What is the critical infrastructure protection planning system?

The CIP Planning System is based on Law 8/2011, 28 April, in which CIP measures are established, and on Royal Decree 704/2011, 20 May, which develops the Law. The Secretariat of State for Security of the Ministry of the Interior is the organism responsible for the System for the Protection of National Critical Infrastructure. The CNPIC is the highest supervising, coordinating and stimulating organism in the whole process.

The instruments of this planning system are a number of plans. They start with the National CIP Plan and the Sectoral Strategic Plans (strategic and responsibility of the State), go on the Operational Security Plans and the Specific Protection Plans (with a more limited scope and responsibility of the owners/operators of critical infrastructures) and close the circle with the Operational Support Plans (operational and responsibility of law enforcement, that is, of the Administration).

These regulatory texts define a series of CIP countermeasures which are concreted in actions that must be undertaken by the components of the Critical Infrastructure Protection System, and are articulated in a mechanism of interdepartmental character in which organisms and entities from both the Administration and private sector take part.

The planning instruments are:

  • National Critical Infrastructure Protection (PNPIC).

  • Secotral Strategic Plans (PES).

  • Operational Security Plans (PSO). Minimum Contents

  • Specific Protection Plans (PPE). Minimum Contents

  • Operational Support Plans (PAO).

The National Critical Infrastructure Protection Plan (PNPIC),  elaborated by the Secretariat of State for Security, aims at establishing the necessary criteria and precise guidelines in order to mobilize operational capabilities at public Administrations in coordination with critical operators, and at putting in place the necessary preventive countermeasures in order to ensure the permanent, updated and homogeneous protection of the strategic infrastructure system against threats posed by deliberate attacks.

Sectoral Strategic Plans (PES), to be elaborated by the Interdepartmental Working Group for CIP, have national scope and will allow to know, in each of the 12 strategic CIP sectors, which are the essential services supplied to society, their general functioning, the system vulnerabilities, the potential consequences of their unavailability and the strategic countermeasures needed to maintain them. Critical operators will be able to take part in the elaboration of PES of their sector of assignment through working groups that will be created in each sector, giving their support and technical advice.

Operational Security Plans (PSO) and Specific Protection Plans (PPE) are planning instruments through which critical operators assume their responsibility to collaborate in identifying their critical infrastructures, specify the policies to be implemented in them in security-related matters, both permanent and temporary, the latter to be adopted to prevent, protect and react against deliberate attacks against them.

In this way, the PSO will establish the owners/operators´ general security policy, the list of essential services supplied, a description of the risk analysis methodology applicable to their critical infrastructures and the criteria they use to implement and manage security.

On the PPE, they will mark the identification of the corresponding infrastructure/s and the organization of its/their security, as well as the results of the risk analysis/es and action plan/s proposed for that/those infrastructure/s.

An Order by the Secretary of State for Security establishing the Minimum Contents of Operational Security Plans and Specific Protection Plans was published in November 2011. It establishes the guidelines for the elaboration of these planning instruments by owners/operators who will be designated as being critical by the National Infrastructure Commission. In this same line, the CNPIC is nowadays working in the elaboration of good practice guides with a view to orientate owners/operators on how to correctly draft Operational Security Plans and Specific Protection Plans.

Operational Support Plans (PAO) will be developed by each competent Administration for each and every infrastructure for which a Specific Protection Plan has been designed. An operational support plan that will include the planned surveillance, prevention, protection and reaction countermeasures for each public Administration in case either of activation of the National CIP Plan or of the existence of the existence of an imminent threat against that infrastructure will be established by the competent Administration, through law enforcement competent in each geographical area. These countermeasures will be complementary to those to be implemented step by step foreseen in the PPE by the critical operator.

In this way, the circle is closed and all the plans are intertwined.