Sector · ENS for public sector suppliers
ENS and NIS2 for public-sector suppliers in Spain
The ENS sets the security baseline for public sector suppliers in Spain. If you provide services or sell technology solutions to the Spanish public sector, tenders will require you to comply with the National Security Framework (ENS) at the system’s category, and increasingly with NIS2 measures through the supply chain.
The ENS and other rules for public sector suppliers
The ENS also binds private suppliers to the public sector
Royal Decree 311/2022, which regulates the ENS, applies to the whole Spanish public sector and also to the private suppliers that provide it with services or solutions. Systems are classed as basic, medium or high according to the impact an incident would have, for example on availability or confidentiality. That category then determines the measures you apply and how you demonstrate compliance.
| Category | How it is demonstrated |
|---|---|
| Basic | Self-assessment and declaration of conformity. |
| Medium | Certification audit by an accredited body, at least every two years. |
| High | Certification audit by an accredited body, at least every two years. |
NIS2 and the supply chain
Public administration is one of the NIS2 sectors, and the directive also requires supplier risk to be managed. Although Spain’s transposition law is still pending, public bodies already pass these requirements on through contracts and tenders. As a result, public sector suppliers may face NIS2 clauses alongside the ENS in the same contract.
GDPR as a data processor
When you process data on behalf of a public body you act as a processor: you need a processing agreement, records of processing, security measures (in the public sector, those of the ENS) and to report any breach without delay.
ENS and ISO 27001: don’t duplicate
The ENS and ISO 27001 share many of their controls. So, if you already hold ISO 27001, a large part of the work is done, although the ENS has its own measures and certification that must be covered.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps public sector suppliers with the ENS
- System categorisation as well as the ENS statement of applicability.
- ENS controls mapped to ISO 27001, so the work is done only once.
- Evidence organised for the certification audit, so it is ready when the auditor asks.
- In addition, the security clauses each public contract requires of you, with their deadlines.
FAQ
ENS for public sector suppliers: frequently asked questions
Does a private company have to comply with the ENS?
Yes, when it provides services or solutions to Spanish public-sector bodies, at the category of the system concerned.
Does ISO 27001 replace the ENS?
No. They share many controls and a solid ISO 27001 does much of the work, but the ENS has its own measures and certification.
How often is the ENS audited?
For medium and high categories, at least every two years, and also when there are substantial changes to the system.
Other sectors: Banking and fintechInsurersEnergy and essential servicesConnected-product manufacturers
Shall we look at it with your own services?
We’ll show you the platform with a real case from your sector. No commitment, no sales script.
