Compliance with the National Security Framework (ENS) and ISO 27001, with NIS2 preparation
We prepare you for Spain's National Security Framework (ENS) and ISO 27001 and stay with you up to the audit. The certificate is issued by an accredited, independent certification body.
Usual tools
- PHP
- TimescaleDB
In short
Compliance with the National Security Framework (ENS) and ISO 27001 means getting your systems, processes and documentation ready to pass the audit. We start with a gap analysis from €2,000 (excl. VAT, fixed price, compliance plan included), carry on with the technical and documentation work and stay with you through the audit. The certificate is issued by an accredited certification body.
Or call us on 644 00 76 20
- Languages
- Spanish, Catalan or English
- Contact
- We reply the same day or the next working day
What is included
- Gap analysis report with a traffic-light rating, control by control.
- System categorisation under the ENS.
- Risk analysis and treatment plan.
- Statement of Applicability.
- Prioritised compliance plan, with a timeline.
- Security policy and procedures.
- Evidence guide for the audit.
- Internal audit report before the certification audit.
When do you need it?
Almost always because someone outside asks you for it:
- You want to bid for public tenders that require ENS conformity.
- You provide services to a public authority and they ask for certification or a declaration of conformity.
- A customer sends you a security questionnaire or requires ISO 27001 before signing.
- You are a town council or public body and must comply with the ENS.
- You want to put your security in order with a recognised framework, even if nobody has asked you yet.
- You want to do ENS and ISO 27001 at the same time, with a single analysis and a single set of documents.
- Your sector is among those covered by the NIS2 Directive and you want to be prepared.
We work on ENS basic and medium categories.
Who issues the certificate?
We prepare you and stay with you up to the audit. The certificate is issued by an accredited, independent certification body. What public bodies require from their suppliers is covered in our guide to the ENS for public sector suppliers.
Under the ENS, the system category decides how conformity is demonstrated (Royal Decree 311/2022, articles 31 and 38):
- Basic category: a self-assessment is enough for the declaration of conformity, although you can also go through a certification audit.
- Medium and high categories: a certification audit is required.
- In every case, an ordinary audit at least every two years, and an extraordinary one if the systems change substantially.
The certification audit is invoiced directly by the certification body and is not included in our prices.
Bodies that certify ENS conformity must be accredited by ENAC, the Spanish National Accreditation Body, under the Technical Security Instruction on ENS conformity, section VI.1. For ISO 27001, the certificate is likewise issued by an accredited certification body.
How is it done?
Eight phases. The first three make up the gap analysis, at a fixed price; the rest is quoted in writing once the compliance plan is on the table.
Scope and categorisation
Which systems, services and sites are in scope, and for the ENS the category of each system following the CCN-STIC 803 guide.
Gap analysis
Control by control against Annex II of the ENS and Annex A of ISO 27001:2022, with a traffic-light view of what you have, what is missing and what is half done.
Risk analysis
Using the MAGERIT methodology and the CCN’s µPILAR tool, with a treatment plan for each risk.
Compliance plan
Prioritised measures with a timeline and owners, plus the Statement of Applicability.
Implementation
Technical changes to your systems and documentation: security policy, procedures and records.
Internal audit
A pre-audit using the same criteria the certification body will use, so you can fix things first.
Certification audit
We stay with you: we prepare the evidence, we are with you during the audit and we help you close any non-conformities.
Maintenance
Documentation kept up to date, periodic reviews and preparation for the following audits.
The documents we deliver follow the usual ENS documentation format: cover page, version control, table of contents and page numbering. You can see it in the sample audit extract in ENS format, with made-up data.
How much does it cost and how long does it take?
| Part | Indicative price (excl. VAT) | Indicative timescale |
|---|---|---|
| Gap analysis with compliance plan | From €2,000, fixed price | 2-4 weeks |
| Implementation up to the audit | Fixed price after the analysis | ENS basic: 1-3 months. ENS medium or ISO 27001 (10-50 people): 3-6 months |
| Monthly support | €300/month: documentation upkeep and quarterly review | After certification |
| Monthly support with a technical day | €600/month: the above plus 1 technical day a month | After certification |
Timescales are indicative and not guaranteed: they depend on what you already have in place and on your availability. The hours included in each support tier are agreed in writing before starting. Before the analysis, by email and at no cost, we carry out an initial assessment and set the scope and the fixed price. The certification audit is invoiced directly by the certification body and is not included in our prices.
ISO 27001 implementation
For companies whose client or a tender asks for ISO 27001, even if they do not work with the public sector.
We implement the information security management system (ISMS) required by ISO/IEC 27001:2022 and get you ready for the certification audit:
- Scope: which processes, systems, sites and people are in the ISMS. A well-defined scope shortens both the implementation and the audit.
- Context and risks: interested parties, risk assessment and treatment plan.
- Statement of Applicability: which Annex A controls you apply, which you do not, and why.
- Technical and documentary implementation: the controls in your systems, the security policy and the procedures.
- Internal audit and management review: the standard requires both, and they must be done before the certification audit.
Indicative timescale: 3 to 6 months for organisations of 10 to 50 people. It depends on the scope, on what you already have in place and on your availability, so we do not guarantee it. The quote depends on the scope and we give it to you in writing after the gap analysis. The certificate is issued by an accredited certification body: we prepare you and stay with you, we do not certify.
ENS and ISO 27001 together?
It usually pays off. Many measures in Annex II of the ENS have an equivalent in Annex A of ISO 27001:2022: access control, backups, activity logging, incident management, continuity. We carry out a single gap analysis and produce a single set of documents that works for both frameworks, and we flag what is specific to each. What changed in the 2022 version of the standard is in ISO 27001:2022: what changed from 2013.
If you first want to know where your platform stands technically, the reliability and security audit reviews access, backups, deployments and exposure, and its evidence is reused in the compliance work.
Preparing for the NIS2 Directive
Directive (EU) 2022/2555, known as NIS2, requires entities in eighteen critical sectors to take cybersecurity risk-management measures (Article 21) and to report incidents (Article 23).
In Spain it is not law yet. As of 2 November 2026, the draft bill transposing it, approved by the Council of Ministers on 14 January 2025, has not completed its passage and, with the Cortes dissolved by Royal Decree 806/2026 (elections on 29 November 2026), the new Parliament will have to take it up again. Until then, Royal Decree-Law 12/2018 remains in force. On 8 July 2026 the European Commission referred Spain to the Court of Justice of the European Union for failing to transpose it.
In the meantime, we help you prepare: we review your measures against those required by Article 21, we prepare the incident reporting procedure and we build on what the ENS or ISO 27001 already cover. Once the Spanish law is passed, we review the plan against the final text. Who it applies to and where it stands: NIS2: what it is and who it applies to.
What experience is behind it?
We have audited other companies’ infrastructure and, in technical leadership roles, as CTO and heads of systems, we have been responsible for the security and availability of production platforms. That is why we make the technical changes to your systems ourselves, and the documentation describes what actually works, not just what the standard asks for.
Frequently asked questions
Do you certify us?
No. We prepare you and stay with you up to the audit. The certificate is issued by an accredited, independent certification body, which you choose and engage yourselves. Our job is to make sure you get there with your systems, documentation and evidence in order.
Which ENS categories do you work with?
Basic and medium.
How long does it take?
As a guide: the gap analysis, 2-4 weeks; ENS basic, 1-3 months; ENS medium or ISO 27001 for companies of 10 to 50 people, 3-6 months. It depends mostly on how much you already have in place and on your availability, so we do not guarantee timescales.
How long does it take to implement ISO 27001?
As a guide, 3 to 6 months for organisations of 10 to 50 people, up to the certification audit. It depends on the scope, on what you already have in place and on your availability. The quote depends on the scope: we give it to you in writing after the gap analysis.
Is the NIS2 Directive already mandatory in Spain?
As of 2 November 2026 there is no Spanish law transposing it, and Royal Decree-Law 12/2018 is still in force. If your sector is among those the directive covers, it is worth preparing now: much of what it requires overlaps with the ENS and ISO 27001.
Tell us about your case
Call or write to us and we'll tell you where you stand and where to start. Free, no strings attached.
Or call us on 644 00 76 20
Reviewed on