Prepare for ENS conformity in Spain with less manual work

The ENS, or Esquema Nacional de Seguridad, is Spain's National Security Framework, set out in Royal Decree 311/2022 of 3 May 2022. It defines the basic principles, minimum requirements and security measures that information systems in the Spanish public sector must apply. It replaced the original 2010 framework and is scaled by system category: BASIC, MEDIUM or HIGH.

The whole Spanish public sector must comply with the ENS, including systems that handle classified information. Private companies are also in scope when, under a contract, they provide services or solutions to public sector bodies for the exercise of their administrative functions. Public contracts must require contractors to show conformity, typically through an ENS declaration or certification.

A private company needs ENS conformity when it supplies systems or services to a Spanish public sector body. For BASIC category systems a self-assessment and declaration of conformity is enough. MEDIUM and HIGH category systems require a certification audit. Tenders often state the required category, so suppliers usually check the contract terms before choosing a route.

BASIC, MEDIUM and HIGH are the ENS security categories in Annex I, set by the impact a security incident would have on confidentiality, integrity, traceability, authenticity and availability. The higher the category, the more Annex II measures apply and the stronger they must be. BASIC systems can self-assess, while MEDIUM and HIGH systems need a certification audit.

Article 31 requires systems in scope to undergo a regular ordinary security audit at least every two years. An extraordinary audit is also needed whenever substantial changes are made that could affect the required security measures, and that audit resets the two-year count. Audits follow the requirements in Annex III of Royal Decree 311/2022.

The ENS and ISO 27001 overlap heavily: both are risk-based and cover security policy, roles, access control, incidents, continuity and audit. However, ISO 27001 certification does not replace ENS conformity, because the ENS sets its own mandatory measures, categories and conformity procedures. Organisations holding ISO 27001 can reuse much of their evidence and controls when preparing for the ENS.

Annex II of Royal Decree 311/2022 contains 73 security measures in three groups: 4 in the organisational framework, 33 in the operational framework and 36 protection measures. Which measures apply, and at what level of strength, depends on the system's security category and the outcome of the risk analysis, documented in a statement of applicability.

Yes, on request. The ENS is mapped in OneClickComply's control library and is available on request rather than as a live, ready-to-adopt framework today. Once enabled, it uses the same automated evidence collection, policy generation, continuous monitoring and auditor guidance as other frameworks. OneClickComply does not issue ENS certifications, which come from certification bodies.