ENS: how to comply with the Spanish National Security Framework
ENS certification, or a statement of conformity for BASIC systems, is mandatory if you are a Spanish public sector body or if your organisation supplies services or technology solutions to the Spanish administration. This guide explains what the ENS (Esquema Nacional de Seguridad, Spain’s National Security Framework) requires under Royal Decree 311/2022. It also covers how to categorise your systems, which documents you need and how to obtain a statement or certificate of conformity.
In 30 seconds: the ENS applies to the whole Spanish public sector and to the private suppliers that serve it. First, you categorise each system (BASIC, MEDIUM or HIGH) across five security dimensions. Then you approve a policy with four roles and assess risks. After that, you select the Annex II measures in a Statement of Applicability. Finally, you demonstrate conformity: a self-assessment is enough for BASIC. However, MEDIUM and HIGH require ENS certification by a body accredited by ENAC, Spain’s national accreditation body. You renew it at least every two years.
What the ENS is and who it applies to
The current ENS is Royal Decree 311/2022 of 3 May. Spain’s Official State Gazette (BOE) published it on 4 May 2022, and it came into force the following day. It replaced Royal Decree 3/2010. In addition, mandatory technical security instructions (ITS) and the CCN-STIC guides of the National Cryptologic Centre (CCN) supplement it. The CCN also publishes an English translation of the decree.
Public sector, private suppliers and ENS certification
Under Article 2, it applies to the entire public sector and to systems handling classified information. Article 2(3) then extends it to private sector organisations. It covers those that provide services or solutions to public bodies under a contract, so those bodies can exercise their powers. These suppliers must have their own security policy, approved by their highest executive body. Tender specifications will also require an ENS statement or ENS certification. Moreover, the requirement can reach the supply chain where the risk assessment justifies it. If you sell to the Spanish administration, see our page for public sector suppliers.
Basic principles and minimum requirements
Article 5 sets seven basic principles: security as an integral process; risk-based management; prevention, detection, response and preservation; lines of defence; continuous monitoring; periodic reassessment; and segregation of responsibilities. In addition, Article 12 adds 15 minimum requirements, such as risk management, access control and least privilege. Incident handling and business continuity also feature. All of them apply in proportion to each system’s risks.
How to categorise a system
The category sets the security effort required (Article 40 and Annex I). To set it, you assess the impact an incident would have on five dimensions, which keep their Spanish initials: confidentiality [C], integrity [I], traceability [T], authenticity [A] and availability [D]. Each dimension gets a rating of LOW, MEDIUM or HIGH, and the highest one decides:
- HIGH: any dimension reaches HIGH.
- MEDIUM: any dimension reaches MEDIUM and none reaches HIGH.
- BASIC: the highest rating is LOW.
The information owner and the service owner do the ratings. Then the security officer sets the category (Article 41). So if you are a supplier, check your category against the one the tender requires.
Steps to ENS certification and deliverables
The CCN describes the adaptation process in three blocks: adaptation plan, implementation and conformity. In practice, the road to ENS certification follows seven steps:
| Step | What you do | Deliverable |
|---|---|---|
| 1. Scope | Identify the systems, services and information involved | Scope and asset inventory |
| 2. Policy and roles | Approve the policy and appoint the information owner, service owner, security officer and system manager (Art. 13) | Approved policy, appointments and security committee |
| 3. Categorisation | Rate C, I, T, A and D | Rating report and category |
| 4. Risk assessment | Use a recognised methodology (MAGERIT with PILAR is common but not mandatory) | Risk report and treatment plan |
| 5. Statement of Applicability | Select the Annex II measures and justify exclusions and compensating measures | Statement signed by the security officer (Art. 28) |
| 6. Adaptation plan | Analyse the gap and roll out policies, procedures and technical measures | Adaptation plan, procedures and evidence |
| 7. Conformity | Self-assessment or audit, and fixing shortcomings | Report, statement or certificate and conformity mark |
The security officer must be a different person from the system manager, with no reporting line between them. Annex II, for its part, contains 73 measures: organisational framework (4), operational framework (33) and protection measures (36). It adds reinforcements by category. It also accepts compensating measures if you document that they protect as well or better (Art. 28.3).
ENS certification, statement of conformity and conformity mark
Article 38 sets out how you demonstrate compliance. In addition, the Technical Security Instruction on ENS conformity (Resolution of 13 October 2016) develops it. The CCN states that it is revising this instruction to align it with Royal Decree 311/2022. However, it remains the reference.
| Category | Procedure | Issued by | Outcome |
|---|---|---|---|
| BASIC | Self-assessment (or a voluntary certification audit) | The organisation itself | Statement of Conformity and its mark |
| MEDIUM | Formal certification audit | Certification body accredited by ENAC (UNE-EN ISO/IEC 17065) | Certificate of Conformity and its mark |
| HIGH | Formal certification audit | Certification body accredited by ENAC (UNE-EN ISO/IEC 17065) | Certificate of Conformity and its mark |
The conformity mark is a non-editable electronic document that links to the statement or certificate. Public bodies display it on their e-government site. Private suppliers, by contrast, display it on their website, where the document must remain accessible.
Two-yearly ENS certification audits, deadlines and compliance profiles
Each system needs an audit at least every two years, and an extraordinary one after substantial changes (Art. 31). Systems that already existed when Royal Decree 311/2022 came into force had 24 months, until May 2024, to comply. New systems, however, must comply from the design stage. For a supplier, though, each tender sets the real deadline for ENS certification. Article 30 also allows specific compliance profiles (PCE). The CCN validates these sets of measures for a group of organisations or a technology. There are currently profiles for local authorities, universities and cloud services.
CCN-STIC guides and CCN tools
The CCN-STIC 800 series develops the ENS. The most useful guides for compliance (in Spanish) are 801 (roles and responsibilities) and 802 (audits). Then come 803 (system rating) and 806 (adaptation plan). In addition, 809 (statements, certificates and marks) and 819 (compensating measures) are useful. Key CCN tools include:
- PILAR: risk assessment using the MAGERIT methodology.
- INES: the security status report that bodies subject to the ENS must submit.
- AMPARO: templates for the adaptation plan and its implementation.
- LUCIA: incident management.
ENS, NIS2 and ISO 27001
NIS2. Directive (EU) 2022/2555 requires, in Article 21, measures very close to the ENS. For example, it calls for risk analysis, incident handling, business continuity, supply chain security, access control and cryptography. However, Spain has not yet published its transposition law in the BOE. First, the government approved the draft Cybersecurity Coordination and Governance Law on 14 January 2025. Then, in July 2026, the European Commission referred Spain to the Court of Justice of the EU over the delay. We cover this in NIS2 transposition still pending in Spain. Even so, a well-implemented ENS covers much of what that law will require. We analyse it in ENS and NIS2.
ISO 27001. It is a voluntary international standard, whereas the ENS is mandatory within its scope. They also share a risk-based approach, a Statement of Applicability and continuous improvement. However, an ISO 27001 certificate does not replace ENS certification, which has its own scheme and checks the Annex II measures. Still, if you already hold ISO 27001, you have done much of the work, as we explain in ISO 27001 as a shortcut to NIS2, GDPR and DORA. In addition, a shared control map stops you duplicating evidence.
Frequently asked questions
Is the ENS mandatory for private companies?
Yes, when they provide services or solutions to Spanish public bodies under a contract, so those bodies can exercise their powers. Article 2(3) of Royal Decree 311/2022 sets this out. Tenders will therefore require a statement or certificate of conformity.
What is the difference between a statement and a certificate of conformity?
The organisation issues the statement itself after a self-assessment, and it is only valid for BASIC category. By contrast, an ENAC-accredited body grants ENS certification after a formal audit. It is mandatory for MEDIUM and HIGH.
How long does ENS certification last?
Two years. The ordinary audit recurs at least every two years. In addition, a substantial change to the system triggers an extraordinary audit.
How many security measures does the ENS have?
Annex II contains 73 measures (4 organisational, 33 operational and 36 protection measures). Which ones apply depends on the category and the risk assessment. You then record them in the Statement of Applicability.
Does ISO 27001 replace ENS certification?
It helps, but it does not replace it. You reuse risks, procedures and evidence. However, you still need to categorise each system and cover any missing Annex II measures. Then you must pass the ENS self-assessment or audit.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with ENS certification
Atalaya GRC organises your path to ENS certification service by service. You record each system’s category, work through the Annex II measures and link each one to its evidence. With “one control, many regulations”, that evidence also serves NIS2, ISO 27001 and GDPR. In addition, the regulatory clock alerts you to the two-yearly audit. The platform also centralises incidents, notifications and the third-party register for your supply chain. See the ENS guide or request a demo.
