Spain ENS Guide: Esquema Nacional de Seguridad Categories and Certification

Any company that sells IT services or solutions to the Spanish public sector can be required by contract to prove conformity with the Esquema Nacional de Seguridad, and for MEDIUM and HIGH systems that proof is an accredited certification, not a self-declaration. The ENS is set out in Real Decreto 311/2022, which replaced the 2010 scheme and applies to the whole Spanish public sector and to private suppliers that serve it. It sorts systems into BASIC, MEDIUM and HIGH categories, attaches a defined set of security measures to each, and uses the CCN-STIC 800 series of guides from the Centro Criptológico Nacional to explain how to apply them. This guide covers scope, categorisation, the structure of the measures, identity and access duties, how declaration and certification work, and how the ENS relates to ISO 27001 and to Spain's pending NIS2 law. It is for security managers in Spanish public bodies, and for cloud, SaaS and managed service providers bidding for public contracts. Status is as checked on 24 October 2026.

Key takeaways

• Category is set by the worst dimension. Each of five security dimensions is rated BAJO, MEDIO or ALTO, and the system takes the highest level reached: one ALTO dimension makes the whole system ALTA (HIGH).
• Proof depends on category. BASIC systems need a self-assessment and a declaration of conformity; MEDIUM and HIGH systems need a certification audit by a body accredited by ENAC.
• Private suppliers are in scope through contracts. Article 2.3 extends the decree to private entities that provide services or solutions to public bodies, and tender documents must require ENS conformity, potentially down the supply chain.
• Audits recur every two years. Article 31 requires an ordinary audit at least every two years and an extraordinary audit after substantial changes.
• NIS2 will build on the ENS. Spain's draft cybersecurity coordination and governance law, approved as a draft on 14 January 2025, says risk measures will be inspired by the ENS, but the law had not been confirmed as adopted in the sources checked.

What it is and who it applies to

Real Decreto 311/2022 of 3 May was published in the Boletín Oficial del Estado (BOE) number 106 on 4 May 2022 and entered into force on 5 May 2022. It repealed Real Decreto 3/2010. The consolidated text on the BOE shows a later amendment by Real Decreto 1125/2024 (in force 7 November 2024), which changed the second additional provision on CCN guides and instructions. Existing systems had a 24-month transitional period to adapt.

The CCN, part of the Centro Nacional de Inteligencia, issues the CCN-STIC 800 series, validates compliance profiles, runs CCN-CERT as the public sector incident response capability and takes part in the certification governance. Technical security instructions (Instrucciones Técnicas de Seguridad, ITS) issued under the decree are mandatory. The CCN portal showed 1,971 certified private-sector systems across 1,846 entities, and 1,484 public-sector systems across 1,449 bodies, when checked for this guide; these figures change often.

Structure and key requirements

Categorisation (Annex I, Articles 40 and 41)

Information and service owners (responsables de la información and del servicio) rate the impact of an incident on five dimensions. The security manager (responsable de la seguridad) then fixes the system category.

The category is BÁSICA if the highest level is BAJO, MEDIA if it is MEDIO and ALTA if any dimension is ALTO. Traceability and authenticity are separate dimensions, which makes identity and logging decisions visible in the categorisation itself.

Security measures (Annex II, Article 28)

Annex II measures are minimums. They are recorded in a Declaración de Aplicabilidad (statement of applicability), may be extended at the security manager's discretion, and may be replaced by documented compensatory measures that protect equally or better (Article 28.3). Measures are grouped as follows (counts from a University of Granada summary of the 2022 text):

The 2022 text introduced op.nub (cloud services, applying to providers of cloud services to the public sector), op.mon.3 (surveillance), mp.eq.4 (other network-connected devices) and mp.s.3 (web browsing protection), and added op.ext.3 (supply chain protection, HIGH) and op.ext.4 (system interconnection, from MEDIUM). Each measure has base requirements and reinforcements (refuerzos) that become mandatory as the category rises; check the measure text and CCN-STIC guidance for the exact reinforcement for your category rather than relying on summaries.

Roles and governance

• Four responsables: information owner, service owner, security manager and system manager (Article 11). The security and system managers must be different people, or compensating measures must be applied.
• Security policy: approved by each body, covering objectives, legal framework, roles and personal data risks (Article 12).
• Compliance profiles: Article 30 allows sector or entity profiles (perfiles de cumplimiento) validated and published by the CCN, which tailor the measures for a given category.
• State of security report: public bodies report security status data used for the national report (Article 32), through CCN tools such as INES.

Identity and NHI requirements

The access control group (op.acc) covers identification, access rights and authentication, and the 2022 text strengthened identification at the MEDIO and ALTO levels. Because authenticity and traceability are rated dimensions, a system that depends on proving who did what will often be MEDIUM or HIGH for that reason alone.

• Unique identification: every user and every process acting on the system needs an identifier that can be traced to an accountable owner. Shared and generic accounts undermine both the authenticity and traceability dimensions.
• Authentication strength by category: the authentication measures scale with category, and multi-factor authentication is expected at the higher categories, particularly for remote and privileged access. Confirm the exact reinforcement in the measure text and CCN-STIC implementation guidance; prefer phishing-resistant methods for administrators. See the Phishing-Resistant MFA Guide.
• Least privilege and segregation: rights are granted per role and reviewed; the separation of security and system managers in Article 11 is the governance version of the same principle. See the Privileged Access Management Guide.
• Service accounts and API credentials: integrations between public bodies (op.ext.4 interconnection) and cloud services (op.nub) usually run on service accounts, API keys and certificates. Inventory them, assign owners, rotate them and include them in access reviews. See the Service Account Security Guide and the Secrets Management Guide.
• Activity logging: traceability requires that actions by users and by automated identities are logged and attributable. See the Cloud Logging and Audit Trail Guide.
• Threat model: valid account abuse, including cloud accounts (MITRE ATT&CK T1078.004), is the attack that identification and authentication measures are meant to stop.

Implementation steps

1. Define the scope. List the information and services in scope and the systems that support them. For a supplier, scope the services named in public contracts; certifications are issued per system and scope.
2. Appoint the four responsables and approve the security policy (Articles 11 and 12).
3. Categorise. Rate C, I, T, A and D for each information type and service and derive the category (Annex I). Record the reasoning; auditors will test it.
4. Analyse risk and select measures from Annex II for the category, plus any applicable compliance profile (Article 30).
5. Write the Declaración de Aplicabilidad, listing each measure, its status and any compensatory measure with its justification (Article 28).
6. Implement and pilot. Start with access control, logging and incident management, since these feed authenticity and traceability. Roll out MFA and privileged access changes to a pilot group first, keeping a documented fallback (for example, temporary break-glass accounts under monitoring) in case authentication changes block services.
7. Self-assess or certify. BASIC systems run a self-assessment and issue a declaration of conformity; MEDIUM and HIGH systems undergo a certification audit (Article 38).
8. Publish and maintain. Public bodies publish declarations and certifications on their sedes electrónicas. Re-audit at least every two years and after substantial changes (Article 31).

Small vs large organisations: a small supplier offering a single SaaS service to a few municipalities may justify BASIC and use a self-declaration where the contract allows it. A large cloud or managed service provider supporting ministries will usually face MEDIUM or HIGH and a full certification, and should align its ENS scope with its ISO 27001 scope to avoid running two separate programmes.

Evidence and assessment

• Certification bodies: the CCN portal listed 21 bodies accredited by ENAC for the ENS when checked. Bodies still in accreditation may certify for up to 12 months from their ENAC application. Systems handling DIFUSIÓN LIMITADA information need a body that also holds a company security clearance, or a route under CCN-STIC-101.
• Guidance: CCN-STIC 809 covers the declaration and certification of conformity and the badges, with annexes for the BASIC declaration, certificates and provisional approvals. The ITS on conformity with the ENS sets the formal rules. The CCN-STIC 800 series also covers categorisation, implementation and audit.
• Registry: certified entities are published on the CCN governance portal, which buyers can use to check a supplier's certificate and scope.
• Evidence auditors ask for: categorisation records, Declaración de Aplicabilidad, risk analysis, policy and role appointments, access review records, MFA configuration, log retention settings, incident records and previous audit findings.

Metrics that show the programme is working:

• Percentage of Annex II measures for the category implemented, as recorded in the Declaración de Aplicabilidad.
• Open audit non-conformities and average days to close them.
• Percentage of privileged and remote access protected by MFA.
• Service accounts and API keys with a named owner and a review in the last 12 months.
• Days until the next ordinary audit (never more than two years from the last).

Mapping to other frameworks

• ISO 27001: an ISO 27001 certificate does not replace ENS certification, but the two can share an ISMS, risk method and evidence. See the ISO 27001 Certification Guide.
• NIS2: Spain missed the 17 October 2024 transposition deadline. The Council of Ministers approved the draft Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025; it would create a Centro Nacional de Ciberseguridad as single point of contact and name supervisory bodies including the CCN. Commentary on the draft says its risk-management measures will be inspired by the ENS. A tracker reviewed in May 2026 still showed the law as not adopted and noted an infringement case before the Court of Justice of the EU. Check the BOE for the current position. See the NIS2 Directive Guide.
• Cloud schemes: op.nub sits alongside national cloud schemes elsewhere in Europe; for sovereignty requirements see the Data Sovereignty and Residency Guide.

Common pitfalls

• Under-categorising to avoid certification. Rating every dimension BAJO to stay BASIC fails when an auditor or the contracting body disagrees, and a contract may demand MEDIUM anyway.
• Certifying the wrong scope. A certificate covers named systems and services. A supplier certified for its hosting platform is not certified for a separate SaaS product it later sells.
• Ignoring traceability for machine identities. Integrations running under shared or unowned service accounts make it impossible to prove who performed an action, which weakens both T and A. Leaked or over-scoped tokens are a recurring breach cause, as in the PocketOS database deletion, where one account-wide platform token allowed production data to be wiped.
• Letting the two-year audit lapse. Article 31 sets a maximum interval, and substantial changes trigger an extraordinary audit earlier.
• Compensatory measures without justification. Article 28.3 accepts them only when documented to protect equally or better and recorded in the Declaración de Aplicabilidad.
• Not flowing requirements down. Article 2.3 lets tender documents extend ENS conformity into the supply chain; suppliers that do not pass requirements to their own subcontractors leave gaps.

Practitioner checklist

• Confirm whether your public contracts require ENS conformity and at which category.
• Appoint the information, service, security and system managers and keep security and system roles separate.
• Rate C, I, T, A and D for each service and record the reasoning behind the category.
• Produce and maintain a Declaración de Aplicabilidad with justified compensatory measures.
• Inventory user, service and API identities; make each unique, owned and reviewed.
• Apply MFA to remote and privileged access at a strength that matches the category reinforcements.
• Centralise and retain logs that attribute actions to people and to automated identities.
• Book a certification body accredited by ENAC for MEDIUM or HIGH, and diary the two-year re-audit.
• Flow ENS requirements into contracts with your own subcontractors and cloud providers.
• Track the NIS2 transposition law and map its measures to your ENS controls once published.

Standards and references

• BOE: Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad (consolidated text)
• Centro Criptológico Nacional: Esquema Nacional de Seguridad portal
• Centro Criptológico Nacional: Distintivos de conformidad
• Centro Criptológico Nacional: Entidades de certificación del ENS
• CCN-CERT: Guías CCN-STIC serie 800, Esquema Nacional de Seguridad
• Ministerio del Interior: El Consejo de Ministros aprueba el anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Cloud Accounts

Related NHI Mgmt Group resources: Global Cybersecurity Regulatory Map · NIS2 Directive Guide · ISO 27001 Certification Guide · Cloud Concentration Risk and Exit Strategy Guide. This guide summarises Spain's Esquema Nacional de Seguridad as of October 2026 and is not legal advice.