Esquema Nacional de Seguridad

What the ENS is

The Esquema Nacional de Seguridad is set out in Royal Decree 311/2022. It is the information security framework for Spanish public administrations, and it reaches the private suppliers who provide them with services.

It is not voluntary. If you provide services to a Spanish public administration and those services handle information or support a public service, the ENS applies to you by law.

Who the ENS applies to

• Spanish public administrations, at every level
• Private companies providing them with services that involve handling information
• A supplier's supplier, where the chain reaches the administration

The system's category, Básica, Media or Alta, is determined by the impact an incident would have on the security dimensions. It is not a commercial choice: it follows from the analysis, and both the level of requirement and the mode of accreditation depend on it.

What the ENS requires

The Royal Decree organises its security measures into three blocks: the organisational framework, the operational framework, and protection measures. The system's category determines which apply and in what depth.

Beyond the measures, the ENS requires risk analysis and management, a security policy, categorisation of systems, and periodic audit.

Its logic differs from ISO 27001's. ISO 27001 asks you to justify your decisions; the ENS tells you which measures your category requires.

How the ENS is demonstrated

It depends on the category. Systems in the Media and Alta categories require a certificate of conformity issued by an accredited certification body. Systems in the Básica category allow a declaration of conformity.

With Zerod

The ENS tells you exactly which measures apply to you. Zerod tells you exactly where you stand on each.

Activate the ENS and Zerod gives you the measure register for your category, generates the organisational framework documentation, and organises evidence collection against each measure.