Spain has a national CERT, CCN-CERT (Spanish Government National Cryptologic Center - Computer Security Incident Response Team) (and 1 more team in our list), and our daily collector sees it publishing. On the Bloch Index it ranks 21st of 191; its context pillars score Economy 49.4, Governance 80.8, Education 92.0.
The Cyber Risk Barometer rates countries on protection in practice, not on paper: each indicator is a public, checkable fact or something we measure ourselves. The seven pillars, their fixed weights and the A to E bands are set out in the methodology before any country is scored. This page shows every indicator we hold for Spain, with the evidence behind it.
Each pillar is scored 0 to 100 from its indicators. The rating is the weighted mean of the pillars scored so far, on the fixed weights published in the methodology. The 4 pillars not yet scored are left out and the weights renormalised, so this is a preview, 3 of 7 pillars.
| Pillar | Weight | Score | Points |
|---|---|---|---|
| Gold-standard data protection | 20 | 100.0 | 40.0 |
| National CERT in action | 15 | 100.0 | 30.0 |
| Government cyber hygiene, measured | 15 | 77.8 | 23.3 |
| Weighted mean | 93.3 | ||
| Cyber resilience rating | 93.3 · A Strong | ||
Is the country bound by Convention 108/108+, or recognised by the EU or UK as giving equivalent protection?
| Indicator | Evidence | Points |
|---|---|---|
| ✓ EU member state or EEA: the GDPR applies directlyP1.EU | EU member state checked 2026-10-08 | 20 / 20 |
Is there a national CERT, and is it visibly working? Three of the six indicators are measured today from our own list and collector; the other three are still to be measured. Our daily collector reads every working feed, so "publishing" is observed, not declared.
| Indicator | Evidence | Points |
|---|---|---|
| ✓ A national (government-designated) CERT/CSIRT existsP2.EXISTS | CCN-CERT (Spanish Government National Cryptologic Center - Computer Security Incident Response Team) | 4 / 4 |
| ✓ It is publishing: our daily collector sees a working feedP2.ACTIVE90 | Feed working | 4 / 4 |
| ✓ Machine-readable feed (RSS, Atom or JSON) or public advisoriesP2.FEED | Feed published | 1 / 1 |
| · It is a FIRST memberP2.FIRST | Not yet measured | – / 2 |
| · It publishes regularly (12 or more items in the last 12 months)P2.REGULAR | Not yet measured | – / 2 |
| · It publishes an annual report or statisticsP2.REPORT | Not yet measured | – / 2 |
Do the country's own government websites and email domains follow basic security practice? First-pass sample: the national CERT's and the data protection authority's websites.
| Indicator | Evidence | Points |
|---|---|---|
| ✓ DMARC at p=quarantine or p=rejectP6.DMARC | 3 of 3 domains pass: www.ccn-cert.cni.es, www.incibe.es, www.aepd.es checked 2026-10-26 | 4 / 4 |
| ✓ SPF record present and not +allP6.SPF | 3 of 3 domains pass: www.ccn-cert.cni.es, www.incibe.es, www.aepd.es checked 2026-10-26 | 2 / 2 |
| ½ DNSSEC: zone signed (DS record)P6.DNSSEC | 2 of 3 domains pass: www.incibe.es, www.aepd.es checked 2026-10-26 | 2 / 3 |
| ✓ HTTPS front page with a valid certificateP6.HTTPS | 3 of 3 domains pass: www.ccn-cert.cni.es, www.incibe.es, www.aepd.es checked 2026-10-26 | 3 / 3 |
| ½ Strict-Transport-Security headerP6.HSTS | 2 of 3 domains pass: www.incibe.es, www.aepd.es checked 2026-10-26 | 0.67 / 1 |
| ✗ security.txt with a contactP6.SECTXT | 0 of 3 domains pass: none checked 2026-10-26 | 0 / 2 |
| Domain | DMARC | SPF | DNSSEC | HTTPS | HSTS | security.txt |
|---|---|---|---|---|---|---|
| www.ccn-cert.cni.esCCN-CERT (Spanish Government National Cryptologic Center - Computer Security Incident Response Team) · national CERT | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ |
| www.incibe.esINCIBE-CERT (Spanish National Cybersecurity Institute - National CSIRT) · national CERT | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ |
| www.aepd.esAgencia Española de Protección de Datos (AEPD) · data protection authority | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ |
A first-pass sample of the two government bodies most responsible for cyber and privacy. Passive lookups only: DNS records and the HTTPS front page.
These pillars are defined in the methodology with fixed weights and yes / partial / no indicators against a fixed standard. They appear here, with every indicator and its evidence, as each is scored.
| Pillar | Weight | Main sources |
|---|---|---|
| Citizens' rights protectedDoes a GDPR-grade law give people enforceable rights, and does an independent authority use its powers? | 20 | Statutes; regulator sites; our fines data |
| Incident reporting and transparencyMust serious cyber incidents and personal-data breaches be reported, quickly, and does the public get to know? | 10 | Statutes and regulator rules |
| Cybercrime law and cooperationCan the country prosecute cybercrime and work across borders? | 10 | Council of Europe Treaty Office (Budapest Convention); UN cybercrime convention status; FIRST membership |
| AI and emerging-tech safeguardsAre there binding rules for high-risk AI and for connected-product security? | 10 | Statutes |
Table: Cyber Risk Barometer · WLD-CRB-57 · Source: Cyber Risk Barometer national-CERT list (FIRST teams directory plus hand-added teams) and daily feed collector, status 2026-10-26; data/ratings.json v0.1 first pass
Three of the Bloch Index's seven pillars, reused as it publishes them: the economy, institutions and education that shape a country's cyber capacity. Every indicator is ranked against every other country the Bloch Index scores (191) and turned into a percentile score from 0 to 100; a pillar is the average of its indicators. Snapshot of 2026-10-05; these numbers do not enter the cyber rating.
Economic strength, stability and growth, measured by GDP per head, inflation, unemployment, growth rate and debt sustainability.
| Indicator | Value | Year | Percentile score |
|---|---|---|---|
| Inflation% · lower is better · FP.CPI.TOTL.ZG | 2.7 | 2025 | |
| Unemployment% of labour force · lower is better · SL.UEM.TOTL.ZS | 10.4 | 2025 | |
| GDP per headUS$ (PPP) · higher is better · NY.GDP.PCAP.PP.CD | 59,868 | 2025 | |
| GDP growth% · higher is better · NY.GDP.MKTP.KD.ZG | 2.8 | 2025 | |
| Central government debt% of GDP, IMF GFS consolidated · lower is better · GC.DOD.TOTL.GD.ZS | 106 | 2024 |
World Bank fundamentals (41.4) are blended 80/20 with a market signal: the 10-year government bond yield of 3.92% (2026-09, OECD) scores 81.5, giving 49.4.
Institutional quality and accountability: rule of law, control of corruption, voice and accountability, and government effectiveness (World Bank Worldwide Governance Indicators).
| Indicator | Value | Year | Percentile score |
|---|---|---|---|
| Rule of lawWGI score, 0 to 100 · higher is better · GOV_WGI_RL.SC | 72.96 | 2025 | |
| Control of corruptionWGI score, 0 to 100 · higher is better · GOV_WGI_CC.SC | 61.21 | 2025 | |
| Voice & accountabilityWGI score, 0 to 100 · higher is better · GOV_WGI_VA.SC | 78.22 | 2025 | |
| Govt effectivenessWGI score, 0 to 100 · higher is better · GOV_WGI_GE.SC | 75.48 | 2025 |
Educational access and attainment: secondary and tertiary enrolment.
| Indicator | Value | Year | Percentile score |
|---|---|---|---|
| Tertiary enrolment% (gross) · higher is better · SE.TER.ENRR | 93.8 | 2024 | |
| Secondary enrolment% (net) · higher is better | no recent data | ||
Table: Cyber Risk Barometer · WLD-CRB-58 · Source: Bloch Index (blochindex.web.app) snapshot 2026-10-05; World Bank World Development Indicators and Worldwide Governance Indicators; OECD long-term government bond yields
Full Bloch Index profile for Spain → (all seven pillars, nineteen indicators and the wider evidence).
The connectivity and economic columns shown for Spain in the league table. Fixed broadband is fetched live from the World Bank; the rest come from the Bloch Index's World Bank snapshot.
| Indicator | Value | Year |
|---|---|---|
| Fixed broadband per 100 people | 39.2 | 2024 |
| Internet users (% of population) | 96% | 2024 |
| GDP per head (PPP, int$) | $59,868 | 2025 |
| Central government debt (% of GDP, World Bank/IMF GFS) | 106% | 2024 |
| Tertiary enrolment (% gross) | 94% | 2024 |
Table: Cyber Risk Barometer · WLD-CRB-59 · Source: World Bank World Development Indicators (IT.NET.BBND.P2 live; IT.NET.USER.ZS, NY.GDP.PCAP.PP.CD, GC.DOD.TOTL.GD.ZS, SE.TER.ENRR via the Bloch Index snapshot 2026-10-05)
Bloc and treaty memberships exactly as the Bloch Index records them (list updated 2026-08-30), so the two sites group countries the same way. The league table filters by them and the super league compares the EU, China and the United States.