ENS for SMBs supplying Spain's Public Administration
By Kike Gandia · Co-Founder & CEO, OSCP
If your company provides a technology service to a city council, a regional department, or any public body, at some point you'll be asked to prove compliance with Spain's National Security Framework (ENS). Many SMBs assume the ENS is only for large public-sector suppliers, but Royal Decree 311/2022 applies to any private company providing technology services to the public sector, regardless of size. This guide explains how to approach it as a small company.
Why it applies even if you're a small business
The ENS doesn't distinguish by company size, but by the specific information system you manage for the Administration. If you develop or maintain an application, host data, or process information on behalf of a public body, that system must comply with the ENS regardless of whether your company has 5 or 500 employees. It's common to find it as a requirement in public procurement tenders, even low-value ones.
The BASIC category exists precisely for cases like yours
The ENS classifies systems as BASIC, MEDIUM or HIGH category based on the impact an incident would have. Most services an SMB provides to a local or mid-sized public body fall under the BASIC category, which has a significantly lighter set of measures than MEDIUM or HIGH, and compliance can be demonstrated through a documented self-assessment, without needing an external certification audit by an accredited body.
What minimum documentation you need
A basic (though simplified) risk analysis, a Statement of Applicability for the Annex II measures corresponding to your category, documented access and incident management policies, and evidence that the required technical measures (encryption, backups, access control) are actually implemented, not just written in a document.
How to approach it without a big consultancy's budget
The costliest mistake is commissioning a compliance project designed for the HIGH category when your system is BASIC. Always start by classifying the system correctly: that determines whether you need a project of weeks or of months. For the BASIC category, many SMBs can complete the self-assessment with targeted support rather than a full consulting project.
Declaration of conformity and certification of conformity are not the same thing
This is the confusion that derails the most budgets. Royal Decree 311/2022 sets out two ways of evidencing compliance depending on the system category, and tenders usually demand one or the other without explaining it:
| System category | How it is evidenced | Who issues it | What is published |
|---|---|---|---|
| BASIC | Declaration of conformity based on documented self-assessment | The entity responsible for the system itself | Declaration of conformity badge |
| MEDIUM | Certification of conformity after a formal audit | Accredited certification body | Certification of conformity badge |
| HIGH | Certification of conformity after a formal audit | Accredited certification body | Certification of conformity badge |
Two practical consequences. First: if your system is BASIC and the tender simply asks for "ENS certification", it is worth asking the contracting body whether a declaration of conformity is acceptable, because tenders often reuse generic wording. Second: a BASIC-category self-assessment is not a form you fill in over an afternoon — it requires the same risk assessment and the same Statement of Applicability as the rest, just without an external audit.
What if the system runs on AWS, Azure or Google Cloud?
This is the question that comes up as soon as you get into detail, because almost no SMB hosts on its own servers. The short answer: your cloud provider being ENS-conformant does not make you conformant, but it does save you a large share of the work. The model is shared responsibility and it has to be documented explicitly: the provider answers for the measures in the layer it manages (facilities, hardware, hypervisor, and in some services the operating system) and you answer for everything you build on top — configuration, access control, encryption of your data, activity logging, backups. In practice it comes down to two pieces: the provider's ENS conformity evidence for the specific services you use (not for its whole catalog) and a matrix assigning each Annex II measure to "provider", "us" or "shared". That matrix is one of the first things an auditor asks for, and it is also where most projects stall, because nobody had written it.
FAQ
Do I need an external certification audit if my system is BASIC category?
Not necessarily. For the BASIC category, conformity can be demonstrated through a properly documented internal self-assessment, without needing an ENAC-accredited certification body.
What happens if I don't comply with the ENS and a tender requires it?
You won't be able to bid for the contract or tender, and if you already have an active contract, the public body can require you to achieve compliance as a condition for keeping or renewing it.
Does ENS work help with anything else?
Yes. It shares important controls with ISO 27001 and NIS2, so the effort you put into ENS compliance reduces the work if you need to comply with those frameworks in the future.
Who classifies the system, us or the public body?
The category is determined by whoever is responsible for the system, based on the impact an incident would have across the five security dimensions — but when the system delivers a service to an Administration, that assessment is agreed with the body: it is their information and their service at stake. Asking the contracting body in writing which category it considers applicable, before sizing the project, avoids the most expensive scenario, which is finding out halfway through.
What if the contract is already signed and they ask for conformity now?
The usual outcome is an agreed compliance plan with milestones and deadlines, not immediate conformity. Presenting that plan signed by leadership, with owners and dates, is normally enough to keep the contract while it is executed. What does cause problems is not responding, or committing to a date you will not meet.
Will the public body audit us directly?
Not routinely. The norm is that it requires you to provide conformity evidence (declaration or certification, depending on category) and reviews it on documentation. It is common, though, for the contract to include a right-to-audit clause, which can be triggered after an incident or at renewal. It pays to keep the documentation permanently presentable, not only at tender time.
Does conformity need renewing, or is it permanent?
It is not permanent. Conformity has to be maintained for as long as the service is provided, which means revisiting the risk assessment and the measures when the system changes, and renewing the accreditation periodically. In practice the annual maintenance effort is far smaller than the initial compliance project, but it is not zero: if nobody owns it internally, the documentation goes stale at the first architecture change.
Related service
ENS audit and consulting services
Related content
- Cybersecurity for SMBs
- ENS certification: what the auditor checks
- ISO 27001 consulting
- What is MAGERIT?
- ISO 27001 vs ENS
- All the regulations we cover