ENS

The Esquema Nacional de Seguridad (ENS, National Security Scheme) is Spain's mandatory security framework for public sector information systems and for the private providers whose services support them.

It is set by Royal Decree 311/2022 of May 3, 2022, which replaced the 2010 decree, and is operated by the Centro Criptológico Nacional (CCN) within the national intelligence center.

Each system is categorized as Básica, Media, or Alta according to the impact a breach would have on the services and information it handles, and the decree's Annex II lists the security measures required at each category across organizational, operational, and protective groups.

The CCN publishes the CCN-STIC guide series that explains how to implement and audit the measures; CCN-STIC 809 sets the conformity criteria and CCN-STIC 802 the audit method.

Conformity is demonstrated by a Declaración de Conformidad (self-declaration) for Básica systems and by a Certificación de Conformidad for Media and Alta systems, issued by a certification body accredited by ENAC after an audit. Certificates are renewed through a full audit at least every two years.

In writing, an organization needs the categorization decision and its rationale, a security policy approved by the governing body, the appointment of the security, information, service, and system roles, a risk analysis, the statement of applicability (declaración de aplicabilidad) mapping Annex II measures to controls, procedures for each measure, the security improvement plan, incident handling and CCN-CERT notification procedures, and the audit report.

Suppliers to Spanish public bodies must hold ENS certification for the services they provide, so ENS has become a common requirement in Spanish public procurement and for cloud providers serving the Spanish state.