Esquema Nacional de Seguridad (Real Decreto 311/2022)
ENS for Spain's public sector and its suppliers
Spain's National Security Framework applies to public bodies and to the companies that provide them with systems and services. CloudSignLab sets your system category, shows your ENS readiness from the controls you already have and keeps the Declaration of Applicability.
What the ENS asks of you
System category
Each system is classed as basic, medium or high from the impact on availability, integrity, confidentiality, authenticity and traceability.
Security measures
Organizational, operational and protection measures, with more of them required as the category rises.
Declaration of Applicability
A document stating which measures apply to the system and how they are met.
Conformity
A self-assessment for basic systems or a certification audit for medium and high ones, renewed regularly.
How CloudSignLab helps
Category in a few steps
Answer the impact questions per security dimension and CloudSignLab works out the system category.
Readiness from your controls
Controls name their ENS measures, so the work you do for NIS2 or ISO 27001 also counts for the ENS.
Declaration of Applicability
Record which measures apply and why, and print the declaration for your client or auditor.
Evidence and audits
Evidence linked to each measure and internal audits with findings followed up until they are closed.
Questions about the ENS
I am a private company. Does the ENS apply to me?
It does when you provide systems or services to Spanish public bodies, and your contracts usually say so. Your client tells you which category the service needs.
Get ready for your public sector clients
Start free, set your system category and see what is still missing.