Centro Criptológico Nacional (CCN)

The National Cryptologic Centre (CCN) is an Organisation, within the National Intelligence Centre (CNI), set up in 2002 to guarantee ICT security in different public administration entities and security for systems that process, store or send out classified information.

Its sphere of competence is defined by the following standard framework:

• Law 11/2002, dated 6th May, regulating the National Intelligence Centre (CNI).

• Royal Decree 421/2004, 12th March, regulating and defining the sphere and functions of the National Cryptologic Centre (CCN).

• Presidential Ministerial Order PRE/2740/2007, dated 19th September, that regulates the National Evaluation Frame work and Information Technology Security Certification giving the CCN the capacity to act as a Certification Body (OC) for this Framework.

• Royal Decree 03/2010, dated 8th January, developing the National Security Framework (update RD 951/2015, de 23 de octubre), establishing basic principles and mínimum requirements, as well as protection measures to be implanted in Administration systems.

• Government Delegate Commission for Intelligence Matters, that annually defines CNI objectives using the Intelligence Directive setting out the Centre’s work.

The functions of the National Cryptologic Centre, set out in Royal Decree 421/2004, of 12 March, are:

1. Regulations. Develop and disseminate standards, instructions, guidelines and recommendations to ensure the security of ICT systems (CCN-STIC Guidelines).

2. Formation: To train public sector personnel specialized in the field of security.

3. Keep an eye out. Ensure compliance with the regulations on the protection of classified information in its field of competence.

4. Development. Coordinate the promotion, development, procurement, acquisition and operation and use of security technologies.

5. Evaluation. Assess and accredit the ability of encryption products and systems to handle information securely.

6. Certification. To set up the Certification Body for the National Security Evaluation and Certification Framework, for application to products and systems within its scope.

7. Cybersecurity. Contribute to the improvement of Spanish cybersecurity through CCN-CERT, actively addressing threats affecting public sector systems, companies and organizations of strategic interest to the country, in coordination with the National Center for Critical Infrastructure Protection (CNPIC) and any ICT system that processes classified information.

8. Relationships. Establish the necessary relations and sign the relevant agreements with similar organizations in other countries for the development of the aforementioned functions.