Spain's National Security Framework (Esquema Nacional de Seguridad, ENS) applies to a private company when, under a contract, it provides services or solutions to a public sector body so that the body can carry out its official functions. What it asks for depends on the system's category: for basic, a self-assessment and a declaration of conformity are enough; for medium and high, you need a certification audit at least every two years by a body accredited by ENAC.
What is the ENS?
It is the set of basic principles and minimum security requirements that public sector information systems in Spain must meet. Article 156.2 of Law 40/2015 provides for it, and Royal Decree 311/2022 of 3 May regulates it. That decree replaced Royal Decree 3/2010 and has been in force since 5 May 2022.
Its aim, under Article 1.2, is to secure "el acceso, la confidencialidad, la integridad, la trazabilidad, la autenticidad, la disponibilidad y la conservación de los datos, la información y los servicios" (access, confidentiality, integrity, traceability, authenticity, availability and preservation of the data, information and services) that those bodies manage electronically.
In practice it asks three things of you: organise security (a policy approved by senior management and security roles kept separate), apply the measures in its Annex II in proportion to the risk, and prove it with a declaration or a certification of conformity. The detail comes from mandatory technical security instructions (instrucciones técnicas de seguridad) and from the CCN-STIC guides of the National Cryptologic Centre (Centro Criptológico Nacional, CCN), especially the 800 series (second additional provision).
When does the ENS apply to a private company?
Article 2.3 of Royal Decree 311/2022 says the ENS "también se aplica a los sistemas de información de las entidades del sector privado, incluida la obligación de contar con la política de seguridad a que se refiere el artículo 12, cuando, de acuerdo con la normativa aplicable y en virtud de una relación contractual, presten servicios o provean soluciones a las entidades del sector público para el ejercicio por estas de sus competencias y potestades administrativas" (also applies to the information systems of private sector entities, including the duty to have the security policy in Article 12, when, under the applicable rules and by virtue of a contract, they provide services or solutions to public sector bodies so that those bodies can exercise their powers).
That means three conditions at once:
- A public sector client. The central government, the regional governments, local authorities and the institutional public sector: public bodies, private-law entities linked to or dependent on a public administration, and public universities (Article 2 of Law 40/2015).
- A contract. The ENS reaches your company "en virtud de una relación contractual" (by virtue of a contract).
- A service or solution the body uses for its official functions. What falls under the ENS is the information systems behind that service, not your whole company.
It does not stop at the main contractor. The same article adds that the requirement "se extenderá también a la cadena de suministro de dichos contratistas, en la medida que sea necesario y de acuerdo con los resultados del correspondiente análisis de riesgos" (will also extend to those contractors' supply chain, as far as necessary and in line with the results of the risk analysis). If you subcontract for the provider, it can be passed down to you.
There is a second route: personal data. Spain's data protection act, Organic Law 3/2018, requires public administrations and the other public bodies listed in its Article 77.1 to apply the ENS security measures, and its first additional provision adds: "En los casos en los que un tercero preste un servicio en régimen de concesión, encomienda de gestión o contrato, las medidas de seguridad se corresponderán con las de la Administración pública de origen y se ajustarán al Esquema Nacional de Seguridad" (where a third party provides a service under a concession, delegated management or contract, the security measures will match those of the public administration and follow the ENS). If you process data for a public administration, usually as its data processor, your measures must follow the ENS.
At a glance
| Your situation | Does the ENS apply? | Rule |
|---|---|---|
| You provide a service or solution to a public sector body, under contract, for its official functions | Yes, to the systems behind it | Royal Decree 311/2022, Art. 2.3 |
| You subcontract for that provider | If the risk analysis requires it and it is passed down to you | Royal Decree 311/2022, Art. 2.3 |
| You process personal data for a public administration under a concession, delegated management or contract | Your security measures must follow the ENS | Organic Law 3/2018, first additional provision |
| You are a private-law entity linked to or dependent on a public administration | Yes, you are part of the public sector | Royal Decree 311/2022, Art. 2.1, and Law 40/2015, Art. 2.2.b |
| You only work for businesses and individuals | The ENS does not bind you | Royal Decree 311/2022, Art. 2 |
What will the contract ask for?
The ENS is enforced through the tender documents (pliegos). Article 2.3 requires public bodies to include in them "todos aquellos requisitos necesarios para asegurar la conformidad con el ENS de los sistemas de información en los que se sustenten los servicios prestados por los contratistas, tales como la presentación de las correspondientes Declaraciones o Certificaciones de Conformidad con el ENS" (all the requirements needed to ensure ENS conformity of the systems behind the contractors' services, such as submitting the relevant declarations or certifications of conformity). And the technical security instruction on conformity makes the contracting body responsible for telling you about that obligation (section VII).
This is what the rules expect you to have ready:
- The declaration or certification of conformity for the systems you will use on the contract, with its badge on your website linking to the document, which must stay accessible (technical instruction, section VII.3).
- A security policy approved "por el órgano que ostente las máximas competencias ejecutivas" (by the body with the highest executive powers) in your company (Art. 2.3). At a minimum it must cover the organisation's objectives, its legal framework, the security roles with their duties and how they are appointed, the security committees, how documentation is organised and the risks of processing personal data (Art. 12.1).
- A security point of contact (POC). For outsourced services, the provider must appoint one unless there is a justified, documented reason not to. It will be its own security officer, someone in that officer's team or someone with a direct line to them (Art. 13.5).
- Incident reporting. Private companies providing services to public bodies report incidents affecting them to INCIBE-CERT, which passes them on to CCN-CERT straight away (Art. 33.7).
- Showing your reports. The public body using your service can ask you at any time for the self-assessment or audit report behind your declaration or certification (technical instruction, section VII.4).
The CCN sums it up in the FAQ on its ENS portal: ENS conformity of the systems serving the public sector "es un imperativo legal" (is a legal requirement), and meeting it puts you "en disposición de participar en licitaciones" (in a position to take part in tenders) that require it.
Is your system basic, medium or high?
The category drives almost everything, because it sets which measures you apply and what kind of review you need. It depends on the impact an incident would have on five dimensions (Annex I): confidentiality, integrity, traceability, authenticity and availability. Each affected dimension gets a level:
| Level | When it applies | Examples from Annex I |
|---|---|---|
| Low | The incident would cause "perjuicio limitado" (limited harm) | Minor damage to assets; a formal, curable breach of a rule; minor, easily repaired harm to a person |
| Medium | It would cause "perjuicio grave" (serious harm) | Significant damage to assets; a material breach of a rule; significant harm to a person that is hard to repair |
| High | It would cause "perjuicio muy grave" (very serious harm) | Wiping out the organisation's ability to perform its functions; very serious or irreparable damage to assets; serious harm to a person that is hard or impossible to repair |
The system's category is the highest level reached by any of its dimensions: if just one is high, the system is high. If a system handles several kinds of information or provides several services, the highest level wins in each dimension (Annex I, sections 3 and 4).
Who decides? The person responsible for the information or service values it, and the security officer sets the category (Art. 41). When you work for a public administration, the information and the service are theirs, so they should tell you which category they require. Look for it in the tender documents and, if it is not there, ask before you bid: it decides whether a self-assessment is enough or you need a certification. The category is also reviewed every year or whenever the criteria behind it change (Annex I, section 1).
Which audit does each category need?
Article 38.1 puts it this way: medium or high systems "precisarán de una auditoría para la certificación de su conformidad" (will need an audit to certify their conformity), while basic ones "solo requerirán de una autoevaluación para su declaración de la conformidad, sin perjuicio de que se puedan someter igualmente a una auditoria de certificación" (will only need a self-assessment to declare conformity, although they may also undergo a certification audit).
| Basic category | Medium or high category | |
|---|---|---|
| How you prove it | Declaration of conformity | Certification of conformity |
| Who reviews | The staff who run the system, or whoever they delegate to | A certification body accredited by ENAC |
| How often | At least every two years | At least every two years, plus an extraordinary audit after substantial changes |
| Who issues the document | Your own company | The certification body |
| How it is published | Badge on your website, linked to the declaration | Badge on your website, linked to the certificate |
What to know about each:
- The self-assessment is not a formality. It must be documented, "indicando si cada medida de seguridad está implantada y sujeta a revisión regular, así como las evidencias que sustentan la valoración anterior" (stating whether each security measure is in place and regularly reviewed, and the evidence behind that assessment) (Annex III, section 2.1). Even if your system is basic, you can still certify it; the technical instruction on conformity calls that option "siempre la deseable" (always the preferable one) (section III.4).
- The ordinary audit is at least every two years. It must also be repeated as an extraordinary audit after "modificaciones sustanciales en los sistemas de información, que puedan repercutir en las medidas de seguridad requeridas" (substantial changes to the information systems that may affect the required security measures). That extraordinary audit restarts the two-year clock, which can only be stretched by three months for force majeure not attributable to the organisation (Art. 31.1).
- Medium and high also need a yearly review. The CCN's FAQ explains that, on top of the certification audits every two years, these systems must carry out an internal compliance audit every year aimed at improvement.
Who can certify you?
Certification bodies must be accredited by Spain's national accreditation body (Entidad Nacional de Acreditación, ENAC) for the ENS under the UNE-EN ISO/IEC 17065:2012 standard (technical instruction on conformity, section VI.1). The CCN publishes on its portal the list of certification bodies that are accredited or in the process of accreditation. In the public sector, technical audit bodies (Órganos de Auditoría Técnica, OAT) can also certify within their remit, according to the CCN's FAQ.
One important point: whoever certifies you cannot be whoever prepares you. The technical security instruction on audits says that, "para asegurar la independencia objetiva de la Entidad Certificadora" (to ensure the certification body's objective independence), the audit will "en ningún caso" (in no case) include consultancy work, such as installing or changing applications in the audited system, drafting the documents the ENS requires or recommending specific products (section IV.2).
And if you want to check whether a provider is certified, the certification page of the ENS portal links to the list of private and public organisations whose systems have been certified.
What does the auditor check and what can the outcome be?
Under Annex III, the audit checks at least six things:
- That the security policy sets out the roles and duties of those responsible for the system, the information, the services and security.
- That there are procedures for resolving conflicts between them.
- That people have been appointed to those roles while keeping responsibilities separate.
- That there is a risk analysis "con revisión y aprobación anual" (reviewed and approved every year).
- That the relevant Annex II measures are in place.
- That there is a documented information security management system, regularly approved by senior management, based on the Statement of Applicability (Declaración de Aplicabilidad).
And it relies on evidence: documented procedures, an incident log, checking that staff know and apply the measures that affect them, and the use of certified products.
The Annex II measures fall into three groups: organisational framework [org], operational framework [op] and protection measures [mp]. The ones you choose go into the Statement of Applicability, signed by the security officer, and you can replace them with compensating measures if you justify in writing that they protect as well or better (Art. 28). One example from the CCN: medium systems must use two-factor authentication, which can be done with hardware tokens, digital certificates or one-time passwords sent by SMS or through a mobile app.
The final opinion is one of these three (technical instruction on audits, section VI.3):
| Opinion | When | What happens next |
|---|---|---|
| Favourable (favorable) | No major or minor non-conformities | Certification can be issued |
| Favourable with non-conformities | At least one non-conformity, major or minor | You submit a corrective action plan within one month at most; you are certified if the body considers it resolves the findings |
| Unfavourable (desfavorable) | Too many or too serious to fix with a plan | Extraordinary audit of those findings within six months at most |
If you are already certified and major non-conformities turn up, the certificate is suspended while you resolve them. If you do not close them within six months, it is revoked and you must remove the badge from your website until your next certification (section VI.6).
How does a company get ready for the ENS?
The CCN's FAQ proposes an adaptation plan with these steps:
- Draft and approve the information security policy and internal rules, with roles and responsibilities.
- Analyse and categorise your systems, valuing the information they handle (including whether there is personal data) and the services they provide.
- Prepare an initial Statement of Applicability with the Annex II measures, matched where relevant to a specific compliance profile.
- Carry out a risk analysis to confirm those measures are adequate and sufficient.
- Finalise the Statement of Applicability.
- Put the remaining measures for your category in place.
Three tips that come from the rules themselves:
- Limit the scope. What gets certified is systems, and the services they support are listed in the certification, according to the CCN. Annex II also lets you separate subsystems that need a different level from the main system, as long as the information and services affected can be clearly defined (section 2.2). Start by identifying which systems support the public contract.
- Keep the roles apart. The security officer must be a different person from the system manager, with no reporting line between them. They can only coincide where a lack of resources is justified, and then compensating measures are needed (Art. 13.3). In a small company, think about this before the audit.
- Check whether there is a compliance profile for you. Specific compliance profiles adapt the measures to a particular organisation or sector, and the CCN validates and publishes them (Art. 30). According to its FAQ, so far there are profiles for local authorities, universities and cloud services. If you sell software as a service to the public sector, look at the cloud one.
One more relief for basic systems: the CCN says an informal risk analysis is enough in that category.
What happens if you do not comply?
The CCN's FAQ answers that "El ENS no prevé sanciones por incumplimiento" (the ENS does not provide for penalties for non-compliance). For a supplier, what is at stake is the contract: the tender documents can require the declaration or certification (Art. 2.3), and the public body can ask for your reports at any time. And if an audit finds major non-conformities in a certified system, the certificate is suspended and may end up revoked.
Has anything changed recently?
Little in the rules themselves, but it is worth knowing what:
- The current ENS dates from 2022. Royal Decree 311/2022 repealed Royal Decree 3/2010. Systems that already existed, "incluidos aquellos de los que sean titulares los contratistas del sector privado" (including those owned by private sector contractors), had twenty-four months to adapt (sole transitional provision). On its certification bodies page, the CCN recommended reaching 5 May 2024 with a Royal Decree 311/2022 certificate or in the process of getting one.
- Only one change since then. Royal Decree 1125/2024 of 5 November amended the second additional provision to change who approves the technical security instructions: now the Minister for Digital Transformation and the Civil Service. It has applied since 7 November 2024 and is the latest amendment shown in the BOE consolidated text as of October 2026.
- Technical instructions awaiting an update. The conformity (2016) and audit (2018) instructions were written for Royal Decree 3/2010. The BOE does not list them as repealed and the CCN still cites them, but it says the conformity one is "en proceso de actualización" (being updated) to Royal Decree 311/2022. Before you bid, check the tender documents and the CCN portal in case a new version is out.
If you need your systems reviewed before the audit, at Quantum Nova we do the work ourselves, without subcontracting, and at a fixed price after a free assessment: see security audit and penetration testing. What we do not do is certify: certification is issued by a body accredited by ENAC.
Frequently asked questions
Is the ENS mandatory for private companies?
Only if a company provides services or solutions, under contract, to a public sector body for its official functions (Art. 2.3 of Royal Decree 311/2022), or processes personal data for a public administration under a concession, delegated management or contract. If you only work with businesses and individuals, the ENS does not bind you.
How often must ENS certification be renewed?
The audit for medium or high systems is repeated at least every two years, and sooner after substantial changes. The CCN also expects an internal audit every year. For basic systems, the self-assessment is also repeated at least every two years.
Can the consultancy that prepares me also certify me?
It is not advisable. Certification is issued by a body accredited by ENAC, and the technical instruction on audits says that, to protect its independence, the audit will in no case include consultancy work, such as drafting the ENS documents or installing applications. The prudent approach is for whoever prepares you and whoever certifies you to be different organisations.
Can a foreign company get ENS certification?
Yes. The CCN says the systems of any organisation, Spanish or not, must hold the certification when they provide these services, and that its list of certified companies includes several that are not Spanish and whose systems are not located in Spain.
Where can I check whether a provider complies with the ENS?
The provider should display the conformity badge on its website, linked to its declaration or certification. And the CCN's ENS portal links to the list of public and private organisations whose systems are certified.
Sources
- Royal Decree 311/2022 of 3 May regulating the Esquema Nacional de Seguridad (consolidated text), Arts. 1, 2, 12, 13, 28, 30, 31, 33, 38 and 41, Annexes I, II and III, second additional provision, sole transitional provision and sole repealing provision.
- Law 40/2015 on the Legal Regime of the Public Sector, Arts. 2 and 156.
- Organic Law 3/2018 on Personal Data Protection and digital rights, first additional provision.
- Resolution of 13 October 2016, technical security instruction on conformity with the ENS, sections III, VI and VII.
- Resolution of 27 March 2018, technical security instruction on information systems security audits, sections IV.2 and VI.
- Royal Decree 1125/2024 of 5 November, second final provision.
- National Cryptologic Centre, ENS portal: FAQ.
- National Cryptologic Centre, ENS portal: certification bodies.
- National Cryptologic Centre, ENS portal: certification.
This article explains the law and published court criteria as of the update date. It is not a substitute for advice from a lawyer on a specific case.