Publicaciones Publications
Publication of the new Good Governance and Compliance series
The risk matrix presented in the first document must be prepared by each organization based on its own circumstances and structure, because this is the way to adopt prevention measures more efficiently, applying economic and human resources in the right measure to each risk based on its importance and probability of materialization.
The catalog of crimes that must be analyzed will be made up of those that may entail corporate criminal responsibility according to the Penal Code (not all of them).
Once the use case scenario has been presented in the second document, the applicable criminal Compliance crimes are identified, specifically considering technological crimes and including examples of possible crimes.
These documents are available to active CCI subscription members on the knowledge platform.
The document can also be purchased by requesting it from info@cci-es.org
Title
15/04/2026
This document analyzes OT cybersecurity risks in the railway sector, considered an essential infrastructure. Through expert assessment, it models two key attacks: traffic management intrusion and “trackside” system manipulation. The report details the phases of these incidents, from initial access to systemic impact on operations. Finally, it proposes strategic solutions under the IEC 62443 standard […]
24/11/2025
The new Industrial CRA Position Paper from the Industrial Cybersecurity Center highlights a critical need: adapting the European Cyber Resilience Regulation to the reality of OT environments. Critical infrastructures, legacy systems, decades-long life cycles, and the absolute priority of availability make it impossible to apply the CRA as currently designed. The document proposes a multisectoral […]
22/10/2025
This document, titled “Pocket Guide: Questions to Ask Your Industrial Technology and Service Providers About Their Cybersecurity Capabilities,” developed by the Industrial Cybersecurity Center (CCI), provides a structured set of questions designed to help organizations assess the level of maturity and commitment to cybersecurity among their industrial suppliers.
