ENS compliance in León: information security management for public-sector suppliers

Because Article 2 of RD 311/2022 extends the scope of the ENS to private entities that provide services or products to public-sector bodies subject to the regulation. The Diputación de León, the Ayuntamiento de León and the Universidad de León (ULE) are public bodies subject to the ENS; therefore, any company that supplies them with software, hosting services, system maintenance or data processing must demonstrate compliance. If you participate in procurement procedures of these bodies and cannot prove your compliance, you may be excluded from those contracting processes.

The ENS establishes three categories: basic, medium and high. The category is determined by assessing the impact that a security incident would have on the five CIDAT dimensions (confidentiality, integrity, availability, authenticity and traceability) for the services in scope. If the maximum impact in any dimension is low, the system is basic; if any dimension reaches medium impact, it is medium; if any reaches high impact, it is high. For a technology-services company working with the Ayuntamiento de León on a document management system, the typical category tends to be basic or medium. The category defines which Annex II measures are mandatory and whether a self-assessed conformity declaration (basic category) is sufficient or certification by an ENAC-accredited body is required (medium and high).

Annex II of RD 311/2022 sets out the 75 security measures that ENS-subject systems must apply depending on their category. These measures are organised across three frameworks — organisational (4 families), operational (7 families, including op.nub for cloud services) and protection (5 families) — totalling 16 families. Not all measures are mandatory for all systems: Annex II specifies for each measure whether it applies to basic, medium or high category systems, or to all. The gap analysis work consists precisely of identifying which of those measures apply to your organisation's system and which are already covered by your ISO 27001 management system controls.

Yes. The Universidad de León is a public university and, as such, is subject to the ENS. This means that its information-system suppliers — academic management software, cloud services, infrastructure maintenance, student data processing — must demonstrate ENS compliance if their systems interact with those of the ULE. The specific requirements depend on each procurement tender, but the regulatory trend is for ENS conformity requirements to appear increasingly in ICT service contracts of Spanish public universities.

Yes, and it is the most efficient way to do it. ISO 27001:2022 and the ENS share a very similar management structure: security policy, risk analysis, proportional control selection, implementation with evidence and periodic review. Many controls in Annex A of ISO 27001:2022 overlap with Annex II measures of the ENS, so the gap concentrates on aspects specific to the Spanish framework: Annex I categorisation, measures with no direct ISO 27001 equivalent and the documentation format required by the CCN. Summum Calidad performs a precise gap analysis and closes only what is missing, without redoing what already works in your ISMS.

No. Summum Calidad does not issue ENS conformity certificates or perform certification audits. For basic-category systems, we prepare the documentation needed for your organisation to issue its own self-assessed declaration of conformity in accordance with CCN-STIC 809. For medium or high category systems, we carry out a thorough pre-audit review and support you throughout the process, but the certificate is issued by an inspection body accredited by ENAC under UNE-EN ISO/IEC 17065, freely chosen by the organisation. Our role is to prepare you to pass that process with the highest possible assurance and the lowest risk of non-conformities.