ENS compliance in Palencia: information security management for public-sector suppliers

The Diputación Provincial de Palencia and the Ayuntamiento de Palencia are territorial administrations of the Spanish public sector and are directly subject to the ENS under Article 2 of RD 311/2022. Other dependent or linked bodies are also in scope, including patronatos, consortia and instrumental entities of the local Palencia administration. Any company providing technology services, managing information systems or processing citizens' data on behalf of those bodies shares the obligation to comply with the ENS to the extent it affects them.

It depends on the category of the information system involved in the contract. If the systems are basic category, a self-assessed declaration of conformity pursuant to CCN-STIC 809 is sufficient; no third-party certification is required. If they are medium or high category, certification by an inspection body accredited by ENAC under UNE-EN ISO/IEC 17065 is mandatory. The procurement documents of each tender usually specify the exact level of requirement; it is advisable to review them before starting the compliance process.

Because the ENS and ISO 27001:2022 share the same management architecture: security policy, risk analysis, proportionate control selection and continual improvement. Many Annex II controls of the ENS have a direct equivalent in Annex A of ISO 27001:2022, so organisations that already hold the standard can close the gap towards the ENS by focusing only on the aspects specific to the Spanish framework. An integrated approach avoids duplicating documentation, reduces the audit burden and optimises the total cost of the project.

Annex II of RD 311/2022 sets out 75 security measures distributed across three frameworks and 16 families. The organisational framework groups policy, regulatory, procedural and authorisation measures; the operational framework includes 7 families with 33 measures covering planning, access control, operations, external resources, continuity and the op.nub family for cloud services; the protection framework covers measures protecting specific assets. Not all measures are mandatory for all systems: the applicable subset depends on the category — basic, medium or high — assigned to the system during the Annex I categorisation process.

The timeline depends on the system category, the size of the organisation and the starting point in terms of security. For basic-category systems with security practices already in place, the process can be completed in three to six months. For medium or high category, without prior ISO 27001, the process typically takes between nine and eighteen months, including risk analysis, measure implementation and the conformity audit by the accredited body. With ISO 27001 already certified, timelines are significantly reduced.

When a company already holds ISO 27001 certification or is working towards it, Summum Calidad carries out a precise gap analysis mapping the Annex II controls of the ENS against the controls already implemented in the ISMS. The result is an inventory of what can be reused directly — with no additional work — what requires documentary adjustment and what is genuinely new with respect to the ENS. The project then focuses solely on closing the actual gaps, without redoing what already works, and the cost is substantially lower than a compliance project starting from scratch.