Certification ENS

The National Security Framework (ENS) is the Spanish regulation governing security in the use of electronic means by Public Administrations. It is mandatory for all public sector entities and for suppliers providing technology services to them.

Three: Basic, Medium, and High. The category depends on the impact a security incident would have across the dimensions of availability, integrity, confidentiality, authenticity, and traceability. The higher the category, the more controls are mandatory.

Typically between 4 and 8 months, depending on the category, organization size, and current maturity level. Basic category can be achieved in 3–4 months; High category may require 8–12 months.

No, but they are complementary. ENS is a mandatory Spanish regulation for the public sector. ISO 27001 is a voluntary international standard. They share many controls, and obtaining both certifications simultaneously is more efficient.

Yes. The ENS requires technical audits such as vulnerability analysis (op.exp.4) and penetration tests (op.exp.5). Our service includes all necessary technical audits performed by our penetration testing team.

If you provide technology services to the Public Administration, you need ENS certification. It is increasingly a requirement in public procurement tenders. Without certification, you cannot access many public contract opportunities.

Yes. ENS certification is valid for 2 years. Annual surveillance audits and a recertification audit every 2 years are required. In addition, annual internal audits and continual system review are mandatory.

The ENS is based on the CCN-STIC guidelines from the National Cryptologic Center (CCN). Key references include CCN-STIC-801 (responsibilities), CCN-STIC-802 (auditing), CCN-STIC-804 (ENS in the cloud), and the CCN-STIC configuration guides for various technologies.