{"id":60917,"date":"2025-09-26T11:12:55","date_gmt":"2025-09-26T11:12:55","guid":{"rendered":"https:\/\/becolve.com\/blog\/8-key-aspects-for-developing-operator-security-plans-pso-and-specific-protection-plans-ppe\/"},"modified":"2025-09-26T11:12:55","modified_gmt":"2025-09-26T11:12:55","slug":"8-key-aspects-for-developing-operator-security-plans-pso-and-specific-protection-plans-ppe","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/8-key-aspects-for-developing-operator-security-plans-pso-and-specific-protection-plans-ppe\/","title":{"rendered":"8 Key Aspects for Developing Operator Security Plans (PSO) and Specific Protection Plans (PPE)"},"content":{"rendered":"

As mentioned in previous entries, within the regulatory framework associated with industrial cybersecurity,<\/strong> the Law on the Protection of Critical Infrastructure (PIC Law 8\/2011)<\/a>, complemented by Royal Decree 704\/2011 and successive additional provisions (the latest of September 18, 2015)<\/a>, is of particular importance in Spain.<\/p>\n

The two main objectives of this standard<\/strong> are to catalog the set of infrastructures that provide essential services to our society and to design a plan that contains effective prevention and protection measures against possible threats to such infrastructures, both in terms of physical security and in terms of the security of information and communication technologies.<\/p>\n

There is no doubt that, following the latest news reported by a national newspaper, which described that 63 ‘cyberattacks’ have occurred so far this year against critical state infrastructures<\/a>, this Law is becoming a mandatory framework for action for companies<\/strong> designated as critical operators and a set of best practices to be deployed for any company that is concerned about protecting its assets.<\/p>\n

As is known, those companies that are designated as critical operators are obliged to submit an Operator Security Plan (PSO)<\/strong> within six months and, after its approval by the Secretary of State or delegated body after a report from the CNPIC, a Specific Protection Plan (PPE).<\/p>\n

The development of PSOs and PPEs is a complex task<\/strong> that requires the coordination and involvement of different areas of an organization. In addition, although the time provided to submit these plans (6 months for PSOs and 4 months for PPEs) seems reasonable, the daily tasks linked to the critical operator may mean that these plans are not carried out in the determined time or with the most complete and appropriate scope. <\/p>\n

For this reason, in this entry, we want to collect eight key aspects<\/strong> that, from our point of view, must be taken into account when a critical operator carries out the process of developing and delivering the Operator Security Plan (PSO) and the Specific Protection Plan (PPE).<\/p>\n