Madrid bolsters cybersecurity for Aldea del Fresno and Berzosa del Lozoya

The Cybersecurity Agency of the Community of Madrid has signed collaboration agreements with the city councils of Aldea del Fresno and Berzosa del Lozoya to reinforce the protection of their electronic administration. The agreements, signed on August 28 and September 8, 2026, are published in the BOCM no. 245, of October 14, 2026, section I (D) Announcements, with references BOCM-20261014-36 and BOCM-20261014-37. Both municipalities have a population of fewer than 20,000 inhabitants, the threshold set by law to receive this support.

The agreements are based on article 2.3 of Law 14/2023, of December 20, which creates the Cybersecurity Agency of the Community of Madrid, establishing that the Agency shall provide its services to local entities with fewer than 20,000 inhabitants in the field of electronic administration. The legal framework is completed by Law 40/2015, of October 1, on the Legal Regime of the Public Sector; Law 7/1985, of April 2, Regulating the Bases of the Local Regime; Law 2/2003, of March 11, on Local Administration of the Community of Madrid, and Decree 48/2019, of June 10, which regulates regional conventional activity.

On behalf of the Community of Madrid, Miguel López-Valverde Argüeso, Councilor for Digitalization and President of the Agency, appointed by Decree 42/2023, of June 23, signs the agreements. On behalf of the city councils, their mayors sign: Alberto Plaza Martín, of Aldea del Fresno, and Antonio del Pozo González, of Berzosa del Lozoya.

What the collaboration protects

The material scope covers the services, systems, infrastructures, and information assets linked to the municipal electronic administration. These include, among others:

• The municipal electronic office and digital services made available to citizens.
• The electronic registry and systems for submitting applications, documents, and communications.
• The electronic processing of procedures, including file management, signature folders, and electronic signing and sealing.
• Electronic notifications and communications.
• Identification, authentication, authorization, and access control systems.
• Platforms and interoperability mechanisms with other public administrations.
• Infrastructures, networks, servers, cloud services, and backups.
• Organizational and technical measures derived from the National Security Framework.

Planned actions

The Agency may carry out risk identification and treatment tasks, technical advice and guidance, security status diagnosis, support in adapting to the National Security Framework, surveillance and early warning, incident management and response, coordination with providers and specialized bodies, incorporation into common cybersecurity platforms, and training for municipal personnel.

As a general rule, actions will be initiated at the request of the city council and will be subject to the availability of the Agency’s personal, technical, and budgetary resources and its prioritization among the set of entities served. The agreement does not imply that the Agency assumes the ordinary management of municipal systems, nor does it displace the city council’s responsibility for its own services.

Validity, monitoring, and cost

• Validity of four years from its entry into force, extendable for up to four additional years by express agreement.
• Joint monitoring commission, with two representatives from the Agency and two from each city council, which will meet at least once a year.
• No financial consideration or transfer of funds between the parties; each assumes its own ordinary expenses.
• The agreement is terminated if the municipality exceeds 20,000 inhabitants according to official census figures.

The agreements do not replace municipal responsibility for its systems nor are they equivalent to a certification, homologation, or favorable audit, but they extend the Agency’s technical capabilities to two small municipalities in the region in the face of a growing risk: the digital dependence of local administrations. Publication in the BOCM activates a cooperation framework aimed at guaranteeing the continuity of electronic public services and the protection of citizens’ information.

Source: BOCM, no. 245, October 14, 2026, section I (D) Announcements, pp. 168-203 (official references: BOCM-20261014-36 and BOCM-20261014-37).