ENS (RD 311/2022) for public sector suppliers: what it requires
What the Spanish National Security Framework requires of companies serving public bodies: categories, self-assessment, certification and audits.
By Pod SRE teamPublished on 6 min read
More and more public procurement tenders in Spain ask for the supplier to be “compliant with the ENS”, and it isn’t always clear what that means: whether a declaration is enough, whether you need a certificate, who issues it and how often it’s renewed. In this article we explain it based on the text of Royal Decree 311/2022 and on what the National Cryptologic Centre (CCN) publishes, with a link to each source.
In short: Royal Decree 311/2022 regulates the National Security Framework (Esquema Nacional de Seguridad, ENS) and also applies to private companies that provide services or solutions to public bodies (Article 2.3). Basic category systems need a self-assessment; medium or high category systems, a certification audit (Article 38). In all cases there’s an ordinary audit at least every two years (Article 31). The certificate is issued by a certification body accredited by ENAC.
Why the ENS affects you even if you’re not a public body
The ENS was created for the public sector, but Article 2.3 of Royal Decree 311/2022 extends it to the information systems of private sector entities when, under a contract, they provide services or solutions to public sector entities for the exercise of their powers.
That has two direct consequences:
- You need a security policy (Article 12), approved in your case by the body with the highest executive powers in the company.
- Tender specifications must include the requirements needed to ensure the contractor’s systems comply with the ENS. That’s why it appears in tenders.
Note: what has to be compliant is the information system you use to provide the service, not the company in the abstract. Getting the scope right is the first step and one of the biggest time savers.
The three categories
A system’s category (Article 40 and Annex I) depends on the impact an incident would have on five security dimensions: availability, authenticity, integrity, confidentiality and traceability. Depending on that impact, the system is in the basic, medium or high category. Assessing the information and services falls to their owners, and determining the category, to the security officer (Article 41).
The category determines how compliance is demonstrated:
| Category | How it’s demonstrated (Art. 38) | Ordinary audit (Art. 31) |
|---|---|---|
| Basic | Self-assessment and declaration of conformity (certification optional) | At least every two years |
| Medium | Certification audit | At least every two years |
| High | Certification audit | At least every two years |
In addition to the ordinary audit, Article 31 requires an extraordinary audit whenever there are substantial changes to the systems that could affect the required security measures, and that date then counts towards the next two years.
Declarations and certifications of conformity are published on the entity’s website (Article 38.2), so your public sector customers can check them.
Who issues the certificate
It isn’t issued by whoever helps you prepare. The Technical Security Instruction on conformity with the ENS, published in 2016, states that certification bodies must be accredited by the National Accreditation Body (ENAC) under UNE-EN ISO/IEC 17065, and the CCN refers to ENAC’s accreditation scheme on its certification bodies page.
We prepare you and support you up to the audit. The certificate is issued by an accredited certification body.
What the compliance process looks like
The CCN describes the compliance process in three phases, which we summarise as follows:
- Compliance plan. Identify the scope of the system, categorise it, obtain the provisional Statement of Applicability, carry out the risk analysis, validate the final Statement of Applicability (or a specific compliance profile, if one exists for your case) and approve the security policy.
- Implementation. A roadmap with the documents to write and the technical measures to apply, an internal policy framework and putting the management system into operation.
- Declaration or certification of conformity, depending on the category.
In a software company, the technical side usually weighs the most: access control and authentication, activity logging, vulnerability and patch management, backups that actually get restored, secure configuration of servers and the cluster. A well-written policy is of little use if the auditor asks for evidence and there isn’t any.
Common mistakes
- Categorising by eye. Aim too low and your conformity won’t cover what the tender asks for; aim too high and the effort shoots up.
- Too broad a scope. Including the whole company when the service provided to the public body is one specific platform.
- Treating it as a paperwork project. The measures must be in place and you must be able to demonstrate them.
- Forgetting the two-year cycle. Conformity isn’t forever: the ordinary audit is at least every two years.
If you’re also asked for ISO 27001, there’s a lot of shared work; we explain it in what changed in ISO 27001:2022. And if you’re asked about NIS2, in what NIS2 is and who it applies to we explain where it stands in Spain.
In ENS and ISO 27001 compliance we explain the phases, deliverables and indicative timelines, and in the reliability and security audit, how we review the technical side of a platform. If you have a tender in front of you and don’t know which category applies, send us an email.
Frequently asked questions
Can a private company have the ENS?
Yes, when it provides services or solutions to public sector entities. Article 2.3 of Royal Decree 311/2022 applies the ENS to the information systems it uses to provide those services.
Does the basic category need an external audit?
Not to declare conformity: a self-assessment is enough (Article 38). If you wish, you can also undergo a certification audit, and some tenders may ask for more than the minimum.
How often does it have to be renewed?
Article 31 requires an ordinary audit at least every two years, and an extraordinary one when there are substantial changes to the system.
Do you issue the ENS certificate?
No. We prepare you and support you up to the audit. The certificate is issued by a certification body accredited by ENAC.
References
- BOE: Royal Decree 311/2022 regulating the National Security Framework: Articles 2, 12, 31, 38, 40 and 41, and Annex I (in Spanish).
- BOE: Technical Security Instruction on conformity with the ENS: requirements for certification bodies (section VI, in Spanish).
- CCN: ENS compliance process (in Spanish).
- CCN: certification bodies (in Spanish).
