How to report to INCIBE-CERT under the CRA

1. Who receives your notification: INCIBE-CERT and CCN-CERT

Spain divides by type of entity: the Instituto Nacional de Ciberseguridad (INCIBE) with INCIBE-CERT for businesses and citizens, CCN-CERT for the public sector. INCIBE is based in León rather than Madrid, a decentralisation choice with few parallels elsewhere in Europe.

The chain is exactly this: the authority as the institution, INCIBE-CERT as the operational team that reads your notification and, together with ENISA, forms the recipient set out in Art. 14.

INCIBE is Spain's public cybersecurity body, based in León, and INCIBE-CERT is its response team for businesses and citizens. The public sector is served instead by CCN-CERT, which sits under the National Intelligence Centre; defence by ESPDEF-CERT.

2. The national channel, in practice

The language of the notification is Spanish. INCIBE publishes advisories and technical material in Spanish and keeps separate channels for company reports and citizen reports: a manufacturer uses the first.

The Spanish split by type of entity — business, administration, defence — is sharper than elsewhere. A private manufacturer that also supplies the administration may end up dealing with two different teams about the same product.

INCIBE-CERT · official website

3. The landscape around it

Spain transposed NIS2 confirming this split and strengthening INCIBE's role as the reference point for industry. The model stays multi-team: coordinated but distinct.

For the CRA, the designation of the CSIRT receiving manufacturers' notifications follows the national implementation of the Regulation and does not automatically flow from that split. Check the designation in force before you file.

One last practical point: INCIBE also runs support programmes for companies on vulnerability handling and maintains its own coordinated disclosure scheme. If you do not have a disclosure policy yet, that material is a starting point aligned with what the authority expects to receive.

4. How filing works, in short

Filing is not an email to the authority: it goes through the single reporting platform established by Art. 16, and access requires EU Login credentials validated beforehand.

The chain of deadlines — 24 hours, 72 hours, final report — is the same across the Union and is set out in full on the Art. 14 page. For the article’s other trigger the final deadline changes: it is on the severe incident page.

5. What to prepare before an incident

Five things, arranged calmly, make the difference between a report filed in time and one filed too late. The first is the contact point to INCIBE-CERT, designated and validated, with a named substitute: on the day of the case you do not go looking for whoever holds the credentials.

In Spain it pays to clarify early which team is yours, especially if you also sell to public administration: the answer does not depend on the product but on who you are, and it should be written down before it is needed.

And a note on time: Spain runs on CET/CEST on the mainland and WET/WEST in the Canaries, with holidays that change from one autonomous community to the next. Art. 14's twenty-four hours are the same everywhere. If your rota is distributed, fix one reference time zone and write it into the procedure.

This guide describes our reading of the regulatory text and the public procedures; it does not constitute legal advice, and the platform's operational details may evolve.