Cybersecurity

We reaffirm our commitment to achieving and maintaining the highest levels of cybersecurity.

At ENAIRE, safety, quality and efficiency are fundamental pillars of our work. We are therefore firmly committed to achieving and maintaining the highest levels of cyber security in both our Operational Systems, which are key to providing our essential services, and our corporate Information Systems, which are vital for Business Management and Operational Support. We are working continuously to supervise and monitor all our technological infrastructure, the services we provide and the information we manage — from office environments to the most critical operational systems.

To this end, at a technical level we have effective incident alert, investigation and response mechanisms in place through our 24/7 Security Operations Centre (SOC H24), operated by the Systems Directorate and coordinated with SYSRED H24, as well as with the various Regional Directorates.

In addition, our Cybersecurity Office, part of the Security Division, coordinates corporate resources, maintains and develops our Information Security Management System (ISMS) and ensures regulatory compliance. It also represents us before leading external bodies in this field.

Thanks to the collaboration between our different units, we have a highly skilled technical team capable of managing, administering and implementing initiatives to strengthen our cybersecurity.

We know that technology alone is not enough without a well-prepared team. That is why we also focus on the human factor, promoting training and awareness activities that help us to be better prepared against any information-security threat.

Cybersecurity vision, mission and strategy

As a key player in the air transport sector, ENAIRE works every day to ensure the safety and efficiency of its operations. Given the constant increase in cyberattacks, cybersecurity is an absolute priority for us.

Our Cybersecurity Strategic Plan sets the direction for reducing risks and strengthening cyber-resilience — not only in our own services and operations but also across the sector, both nationally and in Europe.

Vision

To be an organisation of very high cyber-resilience in Air Navigation Services, with strong resistance and recovery capabilities in the face of an ever-evolving global threat landscape.
Mission

To strengthen the efficiency, availability and security of air navigation services in Spain and Europe by deploying cybersecurity capabilities, experience and knowledge, collaborating and sharing of information with the different agents in the sector, and continuously improving its processes, technologies and awareness.
Strategic lines
- Strengthen ENAIRE’s cybersecurity capabilities as an enabling factor for the provision of Air Navigation Services in an increasingly interconnected environment.
- Enhance collaboration with key ecosystem partners (operators, regulators, state security agencies, vendors and clients) to promote resilience and to reduce and contain the frequency and severity of security breaches and incidents.
- Establish, promote and improve cybersecurity standards across all areas of the company and among ENAIRE personnel, with the aim of achieving excellence in security management.

Regulatory framework

The framework within which these activities take place is heavily regulated. Directives, decrees, laws, regulations, and strategies continue to add to an increasingly comprehensive and complex regulatory landscape.
At the international level, the key reference is Implementing Regulation (EU) 2023/203 (PART-IS), concerning the management of information security risks that may affect aviation safety.

At the national level, Royal Decree 311/2022 of 3 May, which regulates the National Security Framework (ENS), stands out as the main regulatory benchmark. It essentially consists of a set of basic principles and minimum requirements designed to ensure an adequate level of protection for services, systems, data, and communications, with the degree of rigour and compliance varying according to the criticality of the assets and information systems assessed. This evaluation ultimately determines their classification.

In this context, ENAIRE holds two certifications of conformity with the ENS in distinct areas:

A first-ever Medium Category certification covers Business Management Information Systems and Operational Support.
In the High Category, critical Operational Systems that are directly involved in providing our Essential Services are covered. Elements such as systems for flight plan processing and management, air traffic, communications, navigation, surveillance, meteorology, aeronautical information, supervision, and technical operations fall under this certification — the most comprehensive and demanding in the field.

Beyond the inherent benefits of complying with such a standard, this certification also represents a unique achievement for ENAIRE, as it became the first Critical Operator and Essential Services Provider in Spain to obtain it, a milestone that underscores our ongoing commitment to achieving and maintaining the highest level of safety in all our operations.

Certification of conformity with the National Security Framework (ENS), Medium Category

Certification of conformity with the National Security Framework (ENS), High Category

Technology

Technology is an inherent and crucial aspect of Air Navigation Services provision, especially in the context of cybersecurity. At ENAIRE, through our Technical Security Programme, we further strengthen the already robust architecture of our ICT infrastructure — the backbone of air transport operations. This essential initiative is designed to ensure service continuity and an adequate level of protection for our information, systems, and communications.

The programme encompasses various dimensions — people, processes, tools, and technology — all focused on the proactive and reactive management of threats, vulnerabilities, and any security incident.

Its ultimate aim is to minimise their impact on our networks and services, taking into account the rapid evolution of such threats in both number and complexity.

The human factor

Alongside tools, equipment, and resources, people remain the cornerstone of cybersecurity. None of this would be possible without the support of a multidisciplinary, skilled, agile, and effective team.

Initiatives such as training, awareness, and engagement are key to achieving and maintaining the highest levels of security. At ENAIRE, we take this principle very much to heart and approach it by bringing out the more human and approachable side of cybersecurity for everyone in our workforce. We aim to make these initiatives relatable to their daily activities — both professional and personal — so that they can easily understand the content and fully absorb the recommendations.

As a result of this effort, ENAIRE has received several awards and recognitions for its leadership in cybersecurity awareness and for successful collaboration between technical, communications, and people-focused areas, through our Cybersecurity Office, Systems Directorate, and ENAIRE Campus.

These acknowledgements reaffirm one of ENAIRE’s core values — one that goes beyond technical matters and complex technological architectures, and underpins every aspect of safety, whether operational, physical, or cyber: safety and security are everyone's responsibility.

Cybersecurity

Cybersecurity vision, mission and strategy

Vision

Mission

Strategic lines

Regulatory framework

Technology

The human factor