ENS

The ENS is set by Royal Decree 311/2022 of 3 May, published in the BOE on 4 May 2022 and in force from the following day, which repealed the Royal Decree 3/2010 the scheme had been born under. It binds the whole public sector on the terms of Article 2 of Law 40/2015 and, through its Article 2.3, the private entities that under a contractual relationship provide services or supply solutions to public bodies for the exercise of their administrative powers.

The mechanism has three steps. Information and services are rated across five security dimensions, not the three of the classic triad: confidentiality, integrity, traceability, authenticity and availability. Each affected dimension is then assigned a LOW, MEDIUM or HIGH level according to whether the harm would be limited, serious or very serious, and a dimension that is not affected receives no level. The category of the system follows from those levels: HIGH if any dimension reaches HIGH, MEDIUM if any reaches MEDIUM, BASIC if none goes above LOW. Those responsible for the information and the services do the rating; the person responsible for security determines the category.

The category decides what has to be implemented. Annex II holds seventy-three measures in three groups: organisational framework, operational framework and protection measures, required by the level of one or more dimensions or by the category, with reinforcements that add to the base requirements. The selection is formalised in the Statement of Applicability, signed by the person responsible for security: these are extensible minimums, and they can be replaced by compensating measures only where documentation shows those protect equally well or better.

Conformity is demonstrated according to the category (Article 38.1): systems categorised MEDIUM or HIGH need an audit in order to certify it, while BASIC systems need only to assess themselves and declare it, without prejudice to certifying voluntarily. Certification comes from bodies accredited by ENAC against UNE-EN ISO/IEC 17065:2012, and from the ENS technical audit bodies within their remit.

The recurring failure is treating the ENS as a documentation exercise: policies that describe the required measures without implementing or testing them. A system categorised MEDIUM or HIGH has to genuinely meet what it is given, from hardening to logging to access control, and keep evidence that it operates. From the attacker’s side, the interesting systems are exactly the ones certified on paper and hardened to a much lower reality.

The second failure is in the categorisation, which is where the whole budget is decided. Dropping one dimension from MEDIUM to LOW changes the conformity route, the number of required measures and the cost, so the pressure to rate low is constant and it lands on the dimensions the ENS adds to the classic triad: traceability and authenticity. A rating signed by someone who does not answer for that information is the finding that surfaces years later, with a whole system built on top of it.

The third arrives by contract. Article 2.3 requires the specifications of public sector contracts to cover the requirements needed to assure ENS conformity of the systems underpinning the contractor’s services, and it expressly mentions declarations or certifications of conformity; the same caution reaches the contractor’s own supply chain. Suppliers usually discover this while reading the tender, and the time available to adapt is then whatever remains before the submission date.

The fourth is treating conformity as a permanent state. Annex I requires the category to be re-assessed annually, or whenever the criteria behind it change significantly, and an extraordinary audit is triggered by substantial modifications. In the meantime a cloud migration is enough to make a Statement of Applicability obsolete while it is still signed.

Organisations frequently have all three on the table and hear from three different quarters that each one is the priority. They are similar in the substance of the controls and different in law.

Build one control set and map it three ways: the evidence is largely reusable. The ENS is the one that leaves least room, though. Under ISO 27001 the organisation defines the scope of its management system and justifies what it excludes, whereas here the list of measures is fixed by the category. An ISO 27001 certificate does not substitute for ENS conformity, nor does that conformity answer NIS2 on its own.

Counting three dimensions instead of five. Traceability and authenticity are dimensions of their own in the ENS, and they are the ones left without measures when somebody carries the classic triad over to Annex I.

Confusing the category of the system with the level of its dimensions. The category does not alter the level of the dimensions that played no part in determining it, and measures are required through both routes.

Assuming every public sector supplier needs to be certified. Article 2.3 requires the tender specifications to cover the requirements; what is asked, and with what scope, is fixed by each set of specifications from its own risk analysis.

Signing a Statement of Applicability with no evidence behind it. It is the document the audit is structured around: a measure marked as implemented with nothing to show for it is a finding served up.

Using compensating measures as a shortcut. They require documented justification, a detailed correspondence with the Annex II measures, and formal approval by the person responsible for security.

Start with the rating, not with the measures. Identify who answers for each item of information and each service, rate the five dimensions with that signature behind it, and write down the reasoning: the category, the measures and the cost all hang off that decision.

Check whether a specific compliance profile already exists for your case before designing anything: Article 30 provides for them on the principle of proportionality, and the CCN is what validates and publishes them. There are profiles for local entities by size (the CCN-STIC 883A to 883D guides, from councils under 5,000 inhabitants to provincial councils, island councils and their equivalents) and the CCN-STIC 890 guide, updated in July 2025, whose thirty-eight measures ease certification at the BASIC category, with a transitional character the CCN itself underlines. The CCN-STIC guides are also what turn the framework into concrete configuration and process requirements.

Separate the roles from the start. Article 11 distinguishes those responsible for the information, the service, security and the system, and requires responsibility for security to be separate from responsibility for operating the systems. And prepare, before you need it, the notification to the CCN of incidents with significant impact that Article 33.2 imposes, because knowing which channel and what data it takes is a rehearsal, not a reading.

Test the measures before anyone else looks at them. A penetration test scoped to the category of the system, with its retest, produces the evidence that holds up a measure marked as implemented.

The ENS is a framework, not a test: it states what has to hold, not whether it holds in a given system. The audit is structured around the Statement of Applicability and checks, measure by measure, whether what was declared exists and works. Its criteria are set by the Technical Security Instruction on auditing the security of information systems (Resolution of 27 March 2018); the one on conformity (Resolution of 13 October 2016) is still in force, although its text still refers to the repealed Royal Decree 3/2010 and the CCN treats it as pending an update.

What an auditor accepts as proof is not an assertion, it is evidence: configurations, logs, test results and the trail of what was corrected. At the BASIC category that evidence is gathered by the self-assessment itself, carried out by the staff who administer the system or whoever they delegate to. At the HIGH category the tone rises: Article 31.6 lets the person responsible for the system temporarily suspend the service, or the whole operation, in the light of the audit opinion.

We do not implement the ENS and we do not issue certificates, and we say so. What we bring is the technical evidence: each finding tied to the Annex II measure it affects and to the dimension that requires it, with reasoned severity and the retest result. It is part of the testing that produces the evidence an ENS auditor accepts.

Who has to comply with the ENS? The whole public sector on the terms of Article 2 of Law 40/2015 and, through Article 2.3, private entities that provide it with services or supply it with solutions under a contractual relationship. The specifications of each contract set out what the contractor is asked for.

What is the difference between the BASIC, MEDIUM and HIGH categories? The category comes from the highest level reached by any of the five dimensions, and it determines both the required measures and the conformity route: MEDIUM and HIGH systems need an audit to be certified, while BASIC systems declare conformity through a self-assessment.

How often is an audit needed, and how long does certification last? The ordinary audit is at least every two years, with an extraordinary one on substantial modifications that restarts that count, and an extension of up to three months for force majeure. Certification renewal cannot exceed two calendar years from the initial certification.

What happens if the ENS is not met? Royal Decree 311/2022 sets no penalty regime of its own. The consequence arrives by other routes: conformity has to be published on the website or electronic office, tenders require it in order to contract, and at the HIGH category the person responsible can suspend the service.