The ENS is regulated by Royal Decree 311/2022, of 3 May, which replaced Royal Decree 3/2010 to bring the framework up to date. It establishes basic principles, minimum requirements and security measures for the information systems used to deliver public services, from city councils and ministries to the cloud platforms and software they rely on.
For private companies, the ENS is often a commercial question as much as a legal one: public tenders can require a Declaration or a Certification of Conformity, depending on the category of the system. Done properly, adapting to the ENS also leaves you with a mature, auditable security model that strengthens everything else you do.
Who it applies to
Public sector entities
Public administrations and bodies at state, regional and local level, including public universities.
Private suppliers to the public sector
Companies providing services or solutions to public entities, whose tender specifications must include the ENS requirements that apply.
Their supply chain
Subcontractors of those suppliers, where the risk analysis determines that they should also comply.
Cloud and security providers
Cloud services used by the public sector must conform to the ENS, and security products and services are selected, where possible, from the CCN's CPSTIC catalogue.
Key obligations
System categorisation
Each system is rated in five dimensions: confidentiality, integrity, traceability, authenticity and availability. The highest level reached sets the category: basic, medium or high.
Security policy and roles
A formally approved security policy and four defined roles: information owner, service owner, security officer and system officer, with the security and system roles held by different people.
Risk analysis and Statement of Applicability
The measures in Annex II, grouped into organisational framework, operational framework and protection measures, are selected by category and risk, with documented reinforcements or compensatory measures.
Incident management and notification
Public entities notify the CCN-CERT of incidents with significant impact; private providers do so through INCIBE-CERT, which forwards them to the CCN-CERT.
Audit and conformity
Basic-category systems need a self-assessment for a Declaration of Conformity. Medium and high systems require an audit and a Certification of Conformity, with ordinary audits at least every two years.
How we help
Diagnosis and categorisation
We define the scope, categorise your systems following the CCN-STIC guidance and measure the gap against the applicable measures.
Conformity plan
Statement of Applicability, prioritised roadmap and the policy and role structure the ENS requires, ready for approval.
Implementation
Procedures, logging and monitoring, hardening, identity and access, backups and incident management, backed by our 24/7 SOC when you need continuous monitoring.
Audit and renewal
We prepare your audit with the accredited certification body you choose, help you resolve findings and keep the system ready for each renewal.
Signs you need to act
- You want to bid for a public tender that requires ENS certification.
- A public-sector client has asked for your Declaration or Certification of Conformity.
- You are moving services used by public bodies to the cloud.
- Your certificate is approaching renewal and the last audit left open findings.
- You already hold ISO 27001 and want to reuse that work for the ENS.
Frequently asked questions
Does a private company need to comply with the ENS?
Yes, when it provides services or solutions to public sector entities that fall within the ENS. Public tenders include the requirement in their specifications.
What is the difference between basic, medium and high categories?
The category reflects the impact a security incident would have on the information or services the system handles. It determines which measures apply and whether a self-assessment is enough or a certification audit is needed.
Who issues ENS certification?
Certification bodies accredited by ENAC for the ENS, listed by Spain's National Cryptologic Centre (CCN). ZERYON does not certify: we prepare you and accompany you through the audit.
How long is ENS certification valid?
Generally up to two years, after which a new audit is required. Substantial changes to the system also call for an extraordinary audit.
If we hold ISO 27001, do we comply with the ENS?
Not automatically. Much of the ISMS can be reused, but the ENS adds system categorisation, specific measures and reinforcements, defined roles and the CCN-STIC guides, such as CCN-STIC 809 on conformity.