ENS for SMBs supplying Spain's Public Administration

By the QuantumSec team

If your company provides a technology service to a city council, a regional department, or any public body, at some point you'll be asked to prove compliance with Spain's National Security Framework (ENS). Many SMBs assume the ENS is only for large public-sector suppliers, but Royal Decree 311/2022 applies to any private company providing technology services to the public sector, regardless of size. This guide explains how to approach it as a small company.

Why it applies even if you're a small SMB

The ENS doesn't distinguish by company size, but by the specific information system you manage for the Administration. If you develop or maintain an application, host data, or process information on behalf of a public body, that system must comply with the ENS regardless of whether your company has 5 or 500 employees. It's common to find it as a requirement in public procurement tenders, even low-value ones.

The BASIC category exists precisely for cases like yours

The ENS classifies systems as BASIC, MEDIUM or HIGH category based on the impact an incident would have. Most services an SMB provides to a local or mid-sized public body fall under BASIC category, which has a significantly lighter set of measures than MEDIUM or HIGH, and can be certified through documented self-assessment, without needing an external certification audit by an accredited body.

What minimum documentation you need

A basic (though simplified) risk analysis, a Statement of Applicability for the Annex II measures corresponding to your category, documented access and incident management policies, and evidence that the required technical measures (encryption, backups, access control) are actually implemented, not just written in a document.

How to approach it without a big consultancy's budget

The costliest mistake is contracting an adequacy project designed for HIGH category when your system is BASIC. Always start by classifying the system correctly: that determines whether you need a project of weeks or of months. For BASIC category, many SMBs can complete the self-assessment with targeted support rather than a full consulting project.

FAQ

Do I need an external certification audit if I'm BASIC category?

Not necessarily. For BASIC category, conformity can be certified through a properly documented internal self-assessment, without needing an ENAC-accredited certification body.

What happens if I don't comply with the ENS and a tender requires it?

You won't be able to bid for the contract or tender, and if you already have an active contract, the public body can require adequacy as a condition to keep or renew it.

Does ENS work help with anything else?

Yes. It shares important controls with ISO 27001 and NIS2, so the effort of ENS adequacy reduces the work if you need to comply with those frameworks in the future.