ENS compliance in Burgos: information security management for public-sector suppliers

Yes. RD 311/2022 establishes that the ENS applies not only to public-sector entities themselves but also to their suppliers and contractors when the private company's information systems interact with those of the public sector. If you provide technology services, manage citizens' data or supply software to the Diputación de Burgos, the Ayuntamiento de Burgos or the Universidad de Burgos (UBU), your obligation to comply with the ENS is full and unconditional. The deadline for existing systems expired on 5 May 2024; new systems must comply from the moment they go live.

Yes. The Universidad de Burgos is a public higher-education entity and is expressly included in the scope of Article 2 of RD 311/2022. This means its information systems must comply with the ENS and that the suppliers managing or accessing those systems — academic management platforms, cloud services, ICT infrastructure maintenance — are equally obliged to comply at the category level that corresponds to those services.

It depends on the service and the data processed, but SaaS suppliers hosting applications for public-sector entities often categorise their systems as basic or medium. If the application manages citizens' personal data, budgetary information or administrative files with significant criticality, the medium category is common. The high category is less frequent in the local government context but can arise for systems managing critical infrastructure or emergency services. The final categorisation requires assessing the five CIDAT dimensions case by case — which is the first step of every project we undertake.

The main advantage is efficiency. Both frameworks share a very similar management structure — security policy, risk analysis, control selection, audit and continuous improvement — and many Annex II ENS controls have direct or partial equivalents in Annex A of ISO 27001:2022. With a certified or in-progress ISO 27001 ISMS, the gap towards the ENS is limited to the aspects specific to the Spanish framework. Addressing both frameworks in a single project avoids duplicating risk analyses, documentation and internal audits, with an estimated saving of 30–40 % compared to two independent projects.

Conformity with the ENS for medium or high-category systems can only be certified by inspection bodies accredited by ENAC under the standard UNE-EN ISO/IEC 17065. Summum Calidad does not issue that certificate. What we do is prepare your system — documentation, implemented controls, evidence and pre-audit review — so that you pass the certification process with the accredited body of your choice. For basic-category systems, conformity is demonstrated through a self-assessed conformity declaration in accordance with CCN-STIC 809, which we fully prepare and accompany.

ENS compliance is a technical solvency requirement in the procurement specifications of public contracts involving information systems. If you want to bid with the Diputación de Burgos, the Ayuntamiento de Burgos or the UBU for contracts that involve managing public-sector data or systems, the specifications will typically require proof of ENS compliance at the category corresponding to the contract. Failing to have completed it can disqualify you outright from that tender. Starting the project with sufficient lead time — a minimum of three to six months for basic category, nine to eighteen for medium or high — is the only way to be ready in time.