Royal Decree 311/2022
Compliance with the Spanish National Security Framework (ENS)
We prepare city councils, provincial councils, universities, public foundations and suppliers to comply with the ENS and pass the certification audit. We do so drawing on our experience as a company that develops software for the public sector and is certified under the ENS MEDIUM category.
- ENS MEDIUM category certified
- ISO/IEC 27001
Regulatory framework
What the Spanish National Security Framework is
The Spanish National Security Framework (ENS) is the mandatory information security framework for the Spanish public sector. It is regulated by Royal Decree 311/2022, which replaced the 2010 decree and set a twenty-four-month deadline, now passed, for adapting existing systems.
It sets out basic principles, minimum requirements and a set of security measures organised into three frameworks: organisational org, operational op and protective measures mp. The measures that apply depend on the system's category, and the National Cryptologic Centre (CCN) develops their application through technical instructions and the CCN-STIC 800 series guides.
For us, the ENS is above all the way we work when developing our custom software and our solutions. That is the experience we put at your organisation's disposal.
Scope of application
Who must comply with the ENS
The ENS applies to the entire public sector, as defined by Law 40/2015, and to private organisations whose systems support the services they provide to public authorities.
Local authorities
City councils, provincial councils, island councils, associations of municipalities and their dependent bodies.
Institutional public sector
Autonomous bodies, consortia, public companies and public sector foundations.
Universities and healthcare
Public universities and health services, which also process specially protected personal data.
Suppliers
Companies that provide services or supply information systems to any of the above.
Categorisation
ENS categories: BASIC, MEDIUM and HIGH
The category is obtained by assessing the impact an incident would have on information and services across five security dimensions. The system's category is the highest level reached in any of them.
- CConfidentiality
- IIntegrity
- TTraceability
- AAuthenticity
- DAvailability
-
BASIC
Limited harm
An incident would have a limited impact on the organisation's functions, its assets or the individuals affected.
Self-assessment and Declaration of Conformity (certification is also an option).
-
MEDIUM
Serious harm
An incident would cause serious harm. This is the category in which we are certified for application development and maintenance.
Formal audit and Certification of Conformity issued by an accredited body.
-
HIGH
Very serious harm
An incident would cause very serious harm, for example in critical services or involving particularly sensitive information.
Formal audit and Certification of Conformity issued by an accredited body.
Methodology
ENS compliance phases
A phased project, with a specific deliverable in each phase and scaled to the size of your organisation: a small town council does not need the same as a provincial council.
-
Initial analysis and categorisation
We identify the services and information within scope, assess them across the five security dimensions and determine the category of each system. We measure the gap between the current situation and what the ENS requires.
Deliverable: Diagnostic report and assessment and categorisation document.
-
Risk analysis
We inventory the assets, threats and existing safeguards following the MAGERIT methodology, and calculate the residual risk to decide what needs strengthening.
Deliverable: Risk analysis and treatment plan.
-
Statement of Applicability
We select the Annex II measures that correspond to the category, justify those that do not apply and document compensating measures where needed.
Deliverable: Statement of Applicability, signed by the security officer.
-
Policy, organisation and regulations
We draft the security policy approved by the governing body, define the roles (information, service, security and system owners) and draw up the internal regulations and procedures.
Deliverable: Security policy, internal regulations and operating procedures.
-
Implementing measures
We prioritise the outstanding measures in a compliance plan and support you in putting them in place, including technical measures on applications and systems, gathering the evidence the auditor will ask for.
Deliverable: Compliance plan and evidence log.
-
Audit and maintenance
We carry out a preliminary internal review, support you during the certification audit and prepare the corrective action plan. Afterwards, the system is maintained for periodic audits and the INES report.
Deliverable: Internal review report and corrective action plan.
Public procurement
What tender specifications require regarding the ENS
Royal Decree 311/2022 itself states that public sector contract specifications must include the requirements needed to ensure the contractor's systems conform to the ENS. In practice, these are the most common requirements:
- ENS Certification of Conformity held by the contractor, in the category corresponding to the contracted service.
- A certificate scope that covers the systems that actually support the service.
- Compliance with ENS requirements when the service is provided in the cloud or processes the public body's information.
- Appointment of a security officer and a commitment to report incidents.
- ISO/IEC 27001 as a requirement or as an award criterion.
We have been there as a supplier
We are certified under the ENS MEDIUM category for the information systems that support the development and maintenance of software applications, and to ISO/IEC 27001. We know what the auditor checks and what documentation a procurement panel asks for, because we submit it in our own tenders.
If your company bids in public tenders, we help you define a certificate scope that covers the services you offer.
Why ATISoluciones
Compliance delivered by people who develop and maintain systems
We apply it before we offer it
We have worked every day within a management system certified under the ENS and ISO/IEC 27001 since 2020.
Technical measures, not just documents
We are a development team: we understand the measures that apply to applications, access, logs and configurations.
Proportionate to your category
We propose the measures your category requires, without oversizing the project or tying you to a single vendor.
Frequently asked questions
Common questions about ENS compliance
What is the difference between ENS compliance and ENS certification?
Compliance is the work of implementing the ENS: categorising the systems, analysing the risks, approving the policy and applying the measures. Certification is the audit which, in the MEDIUM and HIGH categories, is carried out by an accredited certification body and ends with the Certification of Conformity. We handle compliance and support you up to the audit; the certificate is issued by the accredited body.
Which ENS category applies to my council?
It depends on how the information and services within scope are assessed, not on the size of the organisation. The category of each system is the highest level it reaches in any of the five security dimensions. That is why the first step in compliance is always categorisation.
Is certification mandatory in the BASIC category?
No. In the BASIC category a self-assessment and the Declaration of Conformity are sufficient, although the organisation can opt for certification. The MEDIUM and HIGH categories require a formal audit and the Certification of Conformity.
How often does the ENS audit have to be carried out?
As a rule, at least every two years. An extraordinary audit is also required whenever substantial changes are made to the system that could affect the security measures.
I am a supplier to the public sector. Do I have to comply with the ENS?
Yes, when your systems support services you provide to public sector bodies, and tender specifications usually require the declaration or certification of conformity. That is our own case: we develop software for the public sector and are certified under the ENS MEDIUM category. If you also develop software, see how we work in secure development.
How long does an ENS compliance project take?
It depends on the number of services within scope, the category and your organisation's starting point. After the initial diagnosis we give you a phased timeline tailored to your case.
Where does your organisation stand on the ENS?
Request an initial diagnosis: we review your situation and propose a phased compliance plan.
