The ENS wants proof, not promises. We provide it.

It sets what has to be tested and how deep. Your category comes from the impact an incident would have (Annex I) and pulls in the Annex II controls that apply to you, with their reinforcements.

Specifically: at High category, penetration testing is listed as a required inspection [op.mon.3.r6.3]. And with third-party cloud, the systems supporting that service must either be ENS-compliant or meet a CCN-STIC guide that includes penetration testing audit requirements [op.nub.1.2]. We scope with your Statement of Applicability in front of us.

No. In the ENS, the level is an impact rating: each security dimension (confidentiality, integrity, traceability, authenticity and availability) is rated low, medium or high by the damage an incident would cause, and the highest of those ratings sets the system’s category as Basic, Medium or High (Annex I).

Risk in our report works per finding: how exploitable it is and how far it reaches. We tie every finding to the dimension it touches and the control it fails, so your auditor is not left making that link alone.

It depends on what is in scope, and any timeline we gave you before knowing that would be made up. The framework does have a clock: systems covered by the ENS are reviewed at least every two years, and again whenever the system undergoes substantial change (article 31.1). At Medium and High category that review is an audit; at Basic, a self-assessment is enough (article 38.1).

So the practical move is to start from your audit date and work backwards. The introductory meeting settles what is in scope, and the schedule is fixed in the proposal.

It is an input to the plan, not a replacement for it. The ENS does not use that name: it asks for a security policy (article 12), a risk analysis reviewed and approved every year (Annex III) and a Statement of Applicability signed by your security officer (article 28.2).

The pentest feeds all three. It tests the safeguards you already count as done, and every finding arrives with the Annex II control it fails, so it drops straight into your improvement plan.

The royal decree sets no deadline for fixing the findings. It sets who decides: the security officer analyses the report and takes the conclusions to the system owner, who then adopts the corrective measures (article 31.5). At High category, if the shortcomings are serious, the system owner can suspend the service until they are fixed (article 31.6).

In practice, severity and your next audit set the pace. There is no clock running on our side: the retest is included, at no cost and with no time limit, and it documents the closure.

No. We do not implement the ENS, run your compliance project or issue the certificate of conformity, which is awarded by an accredited certification entity. We perform the penetration testing aligned with your ENS scope so that you have the technical validation and evidence that auditors, public entities and third parties expect to see. We work alongside your ENS consultant, and the two roles fit together cleanly.

Yes. We walk you through it on the call, so you can see the level of detail, the clarity of the reporting and the evidence format, and ask about whatever matters to you. We do not email it out on its own.

Yes. If you sell services or software to the Spanish public sector and the ENS applies, you have to be able to show the right declaration or certificate for your category. The public body can ask for it at any time, so having the evidence ready is increasingly what wins and keeps public contracts.