Enagás Becomes the First Spanish Company AENOR-Certified Under Industrial Cybersecurity Standard IEC 62443-2-1
Enagás Becomes the First Spanish Company AENOR-Certified Under Industrial Cybersecurity Standard IEC 62443-2-1
Enagás has become the first Spanish company to obtain AENOR certification under the international industrial cybersecurity standard UNE-EN IEC 62443-2-1:2024. The certificate covers the industrial cybersecurity management programme implemented to protect operations at the company’s underground gas storage facility in Yela, Guadalajara—an asset that forms part of Spain’s gas system. The recognition confirms that Enagás’s systems for operational support, access management, information protection and industrial process control meet a widely accepted framework designed for critical energy, transport and water infrastructure.
What IEC 62443-2-1 Requires
IEC 62443-2-1 is a core part of the IEC 62443 series that addresses cybersecurity for industrial automation and control systems. The 2-1 portion focuses on the establishment of a cybersecurity management system for the asset owner or operator. It sets expectations for risk assessment, policy, organisation, personnel competence, continuous improvement and the protection of systems that directly support industrial processes. Certification against the standard provides independent verification that these elements are in place and operating as intended.
Scope of the Enagás Certification
The certified programme applies to two related domains at Yela. The first is the operational support and cybersecurity system, which covers essential services including access management, information protection and supervision of technological systems. The second is the industrial control system of the underground storage itself, which monitors and controls the processes required for gas injection and extraction. Together these systems underpin the safe, continuous operation of a strategic storage asset within the Spanish gas network.
Why Yela Matters
Underground gas storage plays a balancing and security-of-supply role in national energy systems. Disruption—whether physical or cyber—can affect deliverability at times of peak demand or supply stress. By subjecting the cybersecurity arrangements at Yela to formal certification, Enagás signals that the digital and control layers protecting this asset have been assessed against an international benchmark rather than solely against internal standards.
Broader Context for Critical Energy Infrastructure
Energy companies across Europe face rising expectations on operational technology (OT) security. Regulatory frameworks, insurance requirements and customer due diligence increasingly reference standards such as IEC 62443. Being first in Spain to achieve AENOR certification under the 2-1 edition positions Enagás as a reference point for peers in gas, electricity and other industrial sectors that are building or upgrading their own OT cybersecurity programmes.
Benefits Cited by the Company
Enagás states that the certification strengthens its ability to identify, manage and mitigate cybersecurity risks that could affect its infrastructures, with the objective of maintaining safe, reliable and continuous operation. Independent certification also provides external stakeholders—regulators, partners and the market—with transparent evidence of the maturity of the company’s industrial cybersecurity posture at a key site.
Implications for the Sector
As more operators pursue formal certification, common language and baselines for OT security will spread. Suppliers of control systems, integrators and service providers will face clearer expectations when bidding for work on certified sites. For the wider Spanish and European energy sector, early movers such as Enagás help establish practical pathways that others can follow when preparing their own assets for similar scrutiny.
Outlook
Enagás’s AENOR certification under IEC 62443-2-1 for the Yela underground storage cybersecurity programme marks a concrete milestone in the professionalisation of industrial cybersecurity within Spain’s energy infrastructure. The next tests will be sustained performance against the standard, potential extension of the same approach to other Enagás assets, and whether peer companies accelerate their own certification efforts. For operators of critical gas and energy facilities, the message is clear: independent verification of OT cybersecurity management is becoming a measurable element of operational excellence and regulatory readiness.
Sources
Aluminium Nitrate
Found this useful?
