ENS audit: compliance with Spain's National Security Framework (ENS)

Spain's National Security Framework (ENS) is mandatory for Spanish public administrations and their technology providers. We help you understand which system category applies to you, which measures are required and how to obtain certification.

Scope your project · Check my ENS status

Rather talk it through? Call us at +34 960 730 013

Who must comply with the ENS?

Royal Decree 311/2022, which regulates the ENS, makes it mandatory for Spanish public administrations and for any private company that provides technology services to the public sector or processes citizens' information on behalf of the government. If you've won a public contract with a technology component, you are probably required (or soon will be) to certify under the ENS.

What ENS compliance involves

  • System classification: BASIC, MEDIUM or HIGH category based on the data and impact of the service
  • Risk analysis using the MAGERIT methodology
  • Selection and application of the security measures required by category
  • Statement of Applicability (SoA)
  • Compliance plan and follow-up
  • Mandatory internal audit prior to certification
  • Pre-assessment of the three Annex II frameworks (organizational, operational and protection measures) using the same criteria the certification auditor will apply
  • Support during the certification audit with the certification body

Compliance process

  1. System classification: We determine the security category (BASIC, MEDIUM or HIGH) based on the security dimensions of the information processed.
  2. MAGERIT risk analysis: We identify assets, threats, vulnerabilities and impact to underpin the measures to be implemented.
  3. Measure selection: We define the applicable security measures by category and draft the Statement of Applicability.
  4. Compliance plan: We plan the implementation of the pending measures with deadlines and resources.
  5. Audit preparation: We support the preparation of documentation and controls for the formal certification audit.

Deliverables

  • System classification report with justification
  • Documented risk analysis (MAGERIT)
  • Statement of Applicability (SoA)
  • Compliance plan with the status of each measure
  • Evidence and documentation for the certification audit

Who typically requests it?

  • Technology companies that have won or want to win public contracts
  • Cloud, hosting and SaaS providers with public sector clients
  • Public administrations that need to renew or begin their compliance work
  • Local entities (city councils) with e-government systems
  • Education, healthcare or justice organizations with critical IT systems

Frequently asked questions about ENS

What exactly does the auditor check in an ENS audit?

For MEDIUM or HIGH category, conformity is demonstrated through a formal audit that goes through the Annex II measures of Royal Decree 311/2022 in three frameworks: the organizational framework (security policy, rules and procedures), the operational framework (planning, access control, operations, continuity) and the protection measures (facilities, personnel, equipment, communications and information). It does not stop at checking that a document exists: it asks for evidence that the measure is actually operating. That is why our preparation reproduces that review before the certification body arrives.

What types of ENS audit are there, and which one does my system need?

It depends on the system's category (Annex III of Royal Decree 311/2022). The BASIC category needs no audit: a documented self-assessment, which the staff who administer the system or someone they delegate to can carry out, is enough to issue the declaration of conformity. MEDIUM and HIGH require a formal audit to obtain the certification of conformity, issued by an accredited certification body. In every case, Article 31 requires the audit to be repeated at least every two years, and on an extraordinary basis whenever the system changes substantially. We carry out the delegated self-assessment for BASIC and, for MEDIUM and HIGH, the pre-audit that reproduces the auditor's review so certification passes on the first attempt.

What's the difference between an ENS declaration of conformity and certification?

The declaration of conformity is an internal document the entity itself issues stating that it complies with the ENS. Certification is issued by a certification body accredited by ENAC after a formal audit. Some public contracts require certification, others accept the declaration.

How often must ENS certification be renewed?

ENS certification is valid for 2 years, with annual follow-up audits.

What if the systems are BASIC category?

BASIC category systems have a less demanding but equally mandatory set of measures. Conformity can be demonstrated through a properly documented internal audit.

Can I hire QuantumSec for the ENS audit, or does it have to be an official body?

Formal ENS certification must be issued by an ENAC-accredited certification body. Our service is the preparatory consulting: gap analysis, system classification, implementing controls and preparing all documentation so the certification audit passes on the first attempt.

Which bodies can certify the ENS?

Any certification body accredited by ENAC specifically for the ENS scheme, such as AENOR, Bureau Veritas or DNV. We don't issue the certificate ourselves — the accredited body does, after the formal audit — but we help you choose and prepare all the documentation and evidence that audit will require.

How long does ENS compliance take?

For a BASIC category with the infrastructure already in order, between 6 and 10 weeks to the declaration of conformity. For MEDIUM or HIGH with certification by an accredited body, the realistic range is 4 to 8 months: the bulk of the work is not the documentation but implementing the missing technical measures and accumulating the operating evidence the auditor will ask for.

Do I need the ENS if I am only a supplier to a public body?

In practice, yes. Royal Decree 311/2022 extends the obligations to private-sector operators providing services to public entities, and the level required is inherited from the category of the system you serve. Companies often discover this when reading the tender documents: ENS conformity appears as a technical qualification requirement, not as something that merely earns extra points.

How does the ENS relate to NIS2?

They overlap across much of the technical control set but do not replace each other. The ENS is the Spanish framework for the public sector and its suppliers; NIS2 is the European directive for essential and important sectors. If you already have the ENS in place, much of the NIS2 work is done — risk management, incident logging, continuity — but NIS2 adds obligations of its own, such as direct accountability for the management body.

Is a penetration test required for ENS compliance?

For HIGH category, yes: the R6 reinforcement of the monitoring measure [op.mon.3] requires periodic penetration testing of the systems in scope. For MEDIUM, recurring vulnerability assessment usually suffices, although the auditor may ask for evidence of deeper testing depending on the type of service. For BASIC it is not mandatory, but it is the fastest way to find out which declared measures are not actually working.

Related resources

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Check my ENS status