NIS2 scope to be validated : applicability, category, obligations and dates are checked against current official rules based on activity, size, country and supply-chain role; the legal or compliance team owns the legal determination.
How to prepare an IT decision in the public sector
A useful assessment starts with an operational map: sites, users, applications, equipment, vendors, change windows and owners. In the public sector, the priority is to understand traceability, procurement, accessibility and security; a product list without that context cannot support a comparable option or a realistic scope.
Scope starts from the system, information processed, accountable body, contract and third parties involved. ENS category, accessibility, retention and procurement procedure are checked against current sources rather than inferred from a generic public-sector label.
A pilot uses a representative service or procedure with roles, logging, change evidence and continuity testing. Acceptance includes both the technical result and the documentation the owner needs for the file, audit or support.
Handover separates implemented measures, outstanding evidence and decisions owned by the authority, legal counsel or contractor. This prevents technical assistance from being presented as certification or a compliance guarantee. Recommended controls are prioritised by service impact, procurement constraints and available evidence, with unresolved legal interpretation recorded for the accountable body.
Documentation remains useful through a visible date, version and owner. Assumptions that have not yet been verified stay marked as assumptions and do not become commercial commitments.
Handover records results, exceptions, relevant configuration, tests and subsequent controls. This lets the internal team distinguish a completed improvement from an outstanding dependency and measure the service against data agreed for its environment.
ENS by system and contract : category, measures and certification needs are checked against the current framework and each procurement requirement. Technical assessment supplies evidence without replacing legal or accountable-body judgement.
Typical challenges in the public sector
- Mandatory procurement without flexibility: minor contracts (≤ €40k), open procedure, negotiated without publication — each form has timelines, publicity requirements and specific obligations.
- Transparency + mandatory portals: Law 19/2013 requires publishing contracts, salaries, organization charts. Portals must stay active and updated.
- Reinforced personal data: citizen data has specific legal basis, specific retention periods, extended subject rights.
- Legacy systems and slow migration: inherited municipal ERPs, obsolete document managers, intranets 15 years old.
How we tackle it at Impulso
- Procurement support: drafting unbiased technical specs, evaluating technical bids, handling Q&A, managing the tender process.
- Transparency compliance: integration with public procurement platforms, automated transparency portals.
- Defined coverage and escalation: service hours, priorities, response targets and third-party escalation are agreed per engagement; permanent availability or a fixed nationwide response is not assumed.
- Orderly legacy migration: phased plan, pilot tests, user training, change management.
Spanish public sector regulatory framework
- Law 9/2017 LCSP: Public Sector Contracts. Procedures, timelines, publicity, award criteria.
- Law 19/2013 on Transparency: obligation to publish economic, contractual and organizational information.
- GDPR + LOPDGDD: citizen data with specific legal basis (public interest).
- Law 39/2015 LPACAP: common administrative procedure. Digital identity, electronic notifications, registry.
Why Impulso for the public sector
- Procurement know-how: we know how to write a technical spec that passes Audit and how not to fall into clauses TACRC will overturn.
- Iberian coverage: technicians in Madrid and Lisbon with experience in Spanish and Portuguese bodies.
- Documented compliance, not marketing: evidence ready for CCN, AEPD, Court of Auditors, IGAE.