Align ENS and ISO 27001 with one control set using CCN-STIC 825

CCN-STIC 825 is a security guide from Spain's Centro Criptológico Nacional titled "Esquema Nacional de Seguridad: Certificaciones 27001". It identifies the security measures that the ENS, regulated by Royal Decree 311/2022, has in common with ISO/IEC 27001:2022 and ISO/IEC 27002:2022. It belongs to the CCN-STIC 800 series of guides that support the ENS, and its current edition is dated April 2026.

No. CCN-STIC 825 is guidance and is not itself a legal requirement. The Esquema Nacional de Seguridad it supports is mandatory for the Spanish public sector and for private companies whose systems provide services or solutions to public bodies. CCN-STIC 800 series guides form part of the documentation used in ENS security audits, so following them helps organisations show how they meet the ENS.

Not automatically. CCN-STIC 825 states that the mapping is not an arithmetic equivalence. The ENS uses five security dimensions instead of ISO's three, sets 73 mandatory measures scaled by system category, and requires its own conformity certification from an accredited body for MEDIUM and HIGH systems. An ISO 27001 management system is a strong base, but ENS-specific measures and scope must be added.

The ENS is a Spanish legal framework, while ISO/IEC 27001 is a voluntary international standard. According to CCN-STIC 825, the ENS covers five dimensions (availability, integrity, confidentiality, traceability and authenticity) against ISO's three, has 73 measures against 93 Annex A controls, favours the MAGERIT risk methodology, and runs a two-year certification cycle compared with ISO's three-year cycle with annual surveillance.

CCN-STIC 825 recommends one integrated management system. Key steps are working with all five ENS security dimensions, aligning scopes where possible, unifying the Statements of Applicability, adopting a single risk methodology, combining roles and management reviews, using shared metrics, running annual audits against both, and then passing each framework's separate certification process, starting from the ENS MEDIUM category.

CCN-STIC 825 is used by Spanish public sector bodies and their technology and service suppliers that must meet the ENS and also hold or want ISO 27001. It works in both directions: ENS-compliant organisations can use it to build towards ISO 27001 certification, and ISO 27001-certified organisations can use it to check how their system conforms with Royal Decree 311/2022.

There is no fixed timeline. It depends on your system's ENS category, whether you already hold ISO 27001, how far your scopes overlap and how mature your controls and evidence are. CCN-STIC 825 describes its mapping as a general starting point that each organisation must tailor through its own convergence analysis, so plan time for that gap analysis before audits.

CCN-STIC 825 is mapped in OneClickComply's control library and available on request. The mapping links ENS security measures to the same controls used for ISO 27001, so evidence collected once from your connected tools can count towards both. OneClickComply does not issue ENS or ISO 27001 certificates: these come from accredited certification bodies.