Spanish National Security Framework
Mandatory for Spanish public bodies and their suppliers. We take you to certification at basic, medium or high category in about 90 days.
Royal Decree 311/2022
- What is at stake
- Mandatory for public administration suppliers
Who it applies to
- Public sector bodies
- Suppliers to the administration
- Companies bidding for public tenders
Typical timeline
≈ 90 days
Royal Decree 311/2022
In detail
The mandatory standard for Spain’s public sector.
Spain’s National Security Framework, governed by Royal Decree 311/2022, sets the security principles and requirements for public administration information systems and for companies providing services to them.
Systems are classified as basic, medium or high category based on the impact an incident would have on five dimensions: confidentiality, integrity, traceability, authenticity and availability. Each category requires a different set of Annex II measures.
Basic category can be self-assessed, while medium and high require a formal audit by an accredited certification body, repeated every two years.
Real scenarios
Who really needs it.
Public sector software vendors
If councils or regional governments use your management software, ENS is essential to keep selling.
Cloud services to government
Cloud services handling public information must be certified in the matching category.
Local authorities
Councils and provincial bodies are legally required to comply, whatever their size.
What you get
What you will have at the end.
- System categorisation
- MAGERIT risk assessment
- Statement of applicability
- Approved security policy
- Security rules and procedures
- Certificate and conformity badge
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
ENS
What we focus on
- 01
System categorisation
- 02
Statement of applicability
- 03
Annex II protection measures
- 04
Certification audit
Spanish National Security Framework
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for Spanish National Security Framework cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Does my ISO 27001 cover ENS?
It helps a lot since they share most controls, but it doesn’t replace it. Starting from ISO 27001 usually halves the effort.
What is a specific compliance profile?
A tailored set of measures approved by the CCN for certain entity types, such as small councils or universities, that simplifies adoption.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.