Organizational framework
Security policy, rules, procedures and authorization process.
ENS · Royal Decree 311/2022 · Spain
National Security Framework (ENS): get certified to work with Spain’s public sector
We align your systems with the ENS and support you through certification in the category tenders require.
What is the ENS?
The mandatory framework for Spain’s public administration
The ENS, governed by Royal Decree 311/2022, sets the principles, requirements and security measures that Spanish public administrations and their technology suppliers must apply.
The National Cryptologic Centre (CCN) oversees it and publishes the CCN-STIC reference guides.
If your company sells software, cloud services or support to Spanish public bodies, certification is often a condition for bidding.
ENS structure
Three groups of measures
Operational framework
Planning, access control, operations, external services, continuity and monitoring.
Protection measures
Facilities, personnel, equipment, communications, media, applications, information and services.
Phases
How we get to certification
- 1Scope and categorization of systems by impact.
- 2Risk analysis and Statement of Applicability.
- 3Implementation of security measures and required documentation.
- 4Internal audit and corrective action plan.
- 5Support during the certification audit with an ENAC-accredited body.
- 6Maintenance and renewal audit every two years.
Categories
Basic, Medium or High
Basic
Limited impact if the system is compromised. It can be accredited through self-assessment or certification.
Medium
Serious impact. Requires a formal certification audit.
High
Very serious impact, as in essential or healthcare services. The highest technical and documentation demands.
Certificates issued under the former Royal Decree 3/2010 lost validity in May 2024: if your certification predates it, you need to align with the current version.
Why the ENS
Your access to Spain’s public market
Tenders
You meet a common requirement of public tenders.
Trust
You show public bodies and citizens that you protect their data.
Integration with ISO 27001
You leverage your ISMS: most controls are shared.
NIS2 readiness
Many ENS measures cover the directive’s risk management obligations.
Who it applies to
The public sector and its suppliers
- Public administrations
- Software suppliers to the public sector
- Cloud services and data centers
- IT support and outsourcing
- Universities and public healthcare
- Latin American companies bidding in Spain
FAQ
What clients ask us most
What is the ENS?
It is Spain’s National Security Framework, governed by Royal Decree 311/2022. It defines the security measures that public administrations and their technology suppliers must meet.
Who must comply?
Spanish public administrations and private companies that provide them with technology services or solutions within the scope of the contract.
Who issues the certification?
Certification bodies accredited by ENAC. Cloud Legion implements the measures, runs the internal audit and supports the certification process.
How often must it be renewed?
Compliance must be reviewed through an audit at least every two years.
Want to bid in Spain?
We prepare you for the ENS in the category your public client requires.