ENS compliance in Madrid through information security management

The Comunidad de Madrid is a regional public-sector administration subject to the Esquema Nacional de Seguridad. Article 2 of RD 311/2022 establishes that the ENS also applies to private entities when their information systems process public-sector information or provide services to entities subject to the framework. If your company manages citizens' data, operates systems on behalf of the Comunidad de Madrid, or supplies technology solutions to it, you must comply. The deadline for existing systems was 5 May 2024.

Yes. The Ayuntamiento de Madrid, virtually all ministries and bodies of the Spanish central government headquartered in the capital, and Madrid's public universities — Complutense, Autónoma, Politécnica, Carlos III and Rey Juan Carlos — are public-sector entities subject to the ENS. Their digital services contracts — software development, system maintenance, cloud services, processing of citizens', students' or staff data — pass the ENS compliance obligation on to their private suppliers. If you tender for or provide services to any of these institutions, the ENS applies to you.

The category is determined by assessing the impact a security incident would have on the five CIDAT dimensions — confidentiality, integrity, availability, authenticity and traceability — for each in-scope service. If the maximum impact across any dimension is LOW, the system is basic category; if any dimension reaches MEDIUM, it is medium category; if any reaches HIGH, it is high category. The category determines which Annex II measures are mandatory and whether you need a self-assessed declaration of conformity (basic) or certification by an ENAC-accredited body (medium or high). Summum Calidad carries out that categorisation analysis as the first step of the project.

Yes, and it is the most efficient route. ISO 27001:2022 and the ENS share the same management system logic — security policy, risk analysis, control selection, review and continual improvement — and many of their controls are coincident or directly reusable. With ISO 27001 certified or in progress, the gap towards ENS focuses on aspects specific to the Spanish framework: the Annex I categorisation, controls without an exact ISO 27001 equivalent and adapting documentation to the CCN format. Summum Calidad closes only what is missing, without repeating what already works.

Annex II of RD 311/2022 contains 73 security measures — 4 organisational, 33 operational and 36 protective — organised across three frameworks and 16 families. The applicable measures depend on your system's category: basic, medium or high. Not all 73 measures are mandatory at every level; each measure specifies which categories it applies to. Among the families most relevant for digital services providers are op.nub (cloud services security), mp.com (communications protection) and op.exp (operations). Summum Calidad identifies the exact subset of measures that applies to you and prioritises their implementation by effort and impact on conformity.

For basic-category systems, conformity is accredited through a self-assessed declaration of conformity by the organisation itself, following the procedure of CCN-STIC 809: the company declares under its own responsibility that it meets the ENS requirements for that category. For medium or high category, conformity must be certified by an inspection body accredited by ENAC under UNE-EN ISO/IEC 17065: an independent third party audits the system and issues the certificate. Summum Calidad does not issue that certificate — that is the exclusive competence of accredited bodies — but does prepare your documentation, controls and evidence to pass that certification process with confidence.