ENS: what it requires and how to comply

What is the ENS in Spain?

Regulated by Royal Decree 311/2022, the ENS sets the security principles and requirements for public-sector information systems in Spain. It also shares much of its logic with ISO 27001, so an existing ISMS gives you a head start.

Who must comply with the ENS in Spain?

In Spain, the ENS covers all public administrations and, by extension, the private companies that provide services to the public sector. For example, it reaches technology providers, integrators and SaaS contracted by the administration.

ENS certification step by step

You prove ENS conformity in one of two ways, and which one applies depends on the category of your systems. If you supply the Spanish public sector, it is also the first thing the tender documents will ask for.

Declaration or certification of conformity?

• Declaration of Conformity: only valid for basic category systems. You get it through a self-assessment, which your own team can carry out, repeated at least every two years.
• Certification of Conformity: required for medium and high category systems, and optional for basic. It needs a formal audit, at least every two years, by an accredited certification body.

Who certifies the ENS?

Certification bodies must be accredited by ENAC, the Spanish national accreditation body, under UNE-EN ISO/IEC 17065, or be in the process of accreditation. The CCN publishes the list of certification bodies and the register of certified organisations, so check that your auditor is on that list before you hire them.

The conformity process in five steps

1. Categorise each system according to the information it handles and the services it provides.
2. Draft the initial Statement of Applicability with the Annex II measures for that category.
3. Run the risk analysis to confirm those measures are sufficient.
4. Approve the final Statement of Applicability and implement the missing measures.
5. Pass the self-assessment (basic) or the certification audit (medium and high).

How often is it renewed?

Both the declaration and the certification are reviewed, as a rule, at least every two years. For medium and high systems, the CCN also expects an internal compliance audit every year to follow up deviations. You must also publish the conformity badge on your website, linked to the certificate or declaration.

What drives the cost of ENS certification?

There is no official fee: each certification body sets its own price. In practice, the cost depends mainly on how many systems and services are in scope, their category and your starting point. If you already work with ISO 27001, you reuse much of the controls and evidence, which cuts the conformity effort.

What public tenders ask for

Tender documents usually require certification for the system’s category (or the declaration, if it is basic), with a scope that covers at least the subject of the contract. You must keep it valid for the whole contract and report it if you lose it. If you sell to the public sector, see also our guide for public-sector suppliers.

Sources: Royal Decree 311/2022 (article 38) and the FAQ of the CCN ENS portal (in Spanish). The conformity Technical Security Instruction in force dates from 2016 and is being revised to align it with Royal Decree 311/2022.

ENS in Spain: continuous improvement and monitoring

The ENS isn’t a one-off formality: it requires continuous improvement and monitoring of your systems’ security status, to maintain conformity over time and prove it when the administration asks. Before you start, see the step-by-step route in how to comply with the ENS in Spain. If NIS2 also applies to you, read how the ENS and NIS2 overlap.