The Canary Islands strengthens the cybersecurity of four municipalities through cooperation agreements

The Official Gazette of the Canary Islands No. 164, published on Monday, August 17, 2026, contains four resolutions of the General Secretariat of the Presidency of the Canary Islands Government announcing respective cooperation agreements for the provision of a cybersecurity incident response service. The four agreements, signed on July 10, 2025, and ordered to be published by Resolution of July 31, 2026, establish collaboration between the Public Administration of the Autonomous Community of the Canary Islands and the city councils of Santa María de Guía de Gran Canaria (ref. 2946), Tijarafe (ref. 2947), Valverde (ref. 2948), and Vilaflor de Chasna (ref. 2949).

A regional cybersecurity framework for local government

The initiative falls within the framework of the CSIRT-CAN project (Computer Security Incident Response Team), implemented by the Government of the Canary Islands through the Vice-Ministry of the Presidency and fully funded with European funds from the Recovery and Resilience mechanism (Next Generation EU). Its design is aligned with the National Security Scheme and with Royal Decree 43/2021, of January 26, which regulates the security of networks and information systems.

The project places the Canary Islands among the communities that already have their own incident response capabilities, alongside Valencia (CSIRT-CV), Catalonia (CESICAT CERT), Andalusia (AndalucíaCERT), the Basque Country (Basque Cybersecurity Centre), Galicia (CSIRT.gal), and Murcia (CSIRT-CARM). Supervision of the service falls to the Directorate General for Digital Transformation of Public Services (DGTDSP).

Services offered by CSIRT-CAN to municipalities

The agreements articulate cooperation to make available to the adhering city councils a catalogue of advanced cybersecurity services, both reactive and preventive. The services are detailed in the annexes of each agreement, and each municipality may subscribe to those it deems appropriate.

• Reactive services: generation of alerts and warnings about attacks, vulnerabilities, or threats; incident management (reception, analysis, classification, and recovery coordination); and vulnerability management through system diagnostics and audits.
• Preventive and training services: deployment of risk detection probes in local entities; preparation, training, and awareness-raising of public staff to integrate cybersecurity into corporate culture; and advisory support for compliance with the National Security Scheme (ENS).

Additionally, the CSIRT-CAN will provide each city council with a cybersecurity package detailed in Annex II of the agreements, aimed at strengthening the digital protection systems of each locality. Each municipality will nominate two technical officers as daily liaisons with the regional team.

Commitments, funding and duration of the agreements

The four agreements were signed on behalf of the regional administration by Alfonso Cabello Mesa, Deputy Minister of the Presidency, acting under the delegation of the President set out in Decree 159/2019 of 30 August. Signed on behalf of the municipalities:

• Alfredo Gonçalves Ferreira, Mayor of Santa María de Guía de Gran Canaria.
• Yaiza Cáceres Lorenzo, Mayoress of Tijarafe.
• Carlos Brito Brito, Mayor of Valverde.
• Agustina Beltrán Cano, Mayoress of Vilaflor de Chasna.

The publication of the agreements was ordered by Ceferino José Marrero Fariña, Secretary General, through the four resolutions of 31 July 2026. The agreements are in force from their signing until 31 December 2027, with the possibility of unilateral extension of up to four additional years. Clause eight expressly establishes that the agreement does not entail an increase in public expenditure for any of the parties. At the end of the warranty period, the equipment provided will become the property of the corresponding local corporation.

A step towards secure digital administration

The extension of the CSIRT-CAN to these four municipalities represents progress in the digital protection of the Canary Islands’ local administration, particularly relevant in a context of growing cyber threats targeting public entities. The legal obligation of municipalities — set out in Article 70.bis.3 of Law 7/1985 — to promote information technologies for communication with citizens makes it essential to have mechanisms for prevention, surveillance and threat detection in their systems. With these agreements, the Government of the Canary Islands strengthens inter-administrative coordination to ensure a more resilient digital ecosystem across the archipelago.

Source: Official Gazette of the Canary Islands, No. 164, 17 August 2026, section III. Other Resolutions, Presidency of the Government, pp. 31810–31822, 31829–31841, 31848–31860 and 31867–31879 (official references: BOC-A-2026-164-2946, BOC-A-2026-164-2947, BOC-A-2026-164-2948, BOC-A-2026-164-2949).