Spain's National Security Framework (ENS, Esquema Nacional de Seguridad) is the Spanish regulation that sets the principles, minimum requirements and security measures for public-sector information systems and for companies that serve the public sector under certain conditions. It is set out in Royal Decree 311/2022. It is not a general company certification: it applies to specific systems.
This entry is general information and is not legal advice. Verified on 15 October 2026 against the consolidated text of Royal Decree 311/2022 on the BOE (last update published on 6 November 2024).
Who it applies to
Royal Decree 311/2022 of 3 May, in force since 5 May 2022, repealed Royal Decree 3/2010. It applies to the whole public sector (Article 2.1). It also reaches the information systems of private entities when, under the applicable rules and through a contract, they provide services or supply solutions to public entities for the exercise of their administrative powers (Article 2.3). The tender documents for those contracts must include the requirements needed to ensure conformity.
Categories and conformity
Each system is classed as BASIC, MEDIUM or HIGH depending on the impact an incident would have on its availability, authenticity, integrity, confidentiality or traceability (Article 40 and Annex I). The category, the assets and risk management determine the measures in Annex II, which are recorded in a Statement of Applicability signed by the security officer (Article 28).
To show conformity, BASIC systems need a self-assessment and a declaration of conformity; MEDIUM or HIGH systems need a certification audit (Article 38). The security audit of MEDIUM or HIGH systems is carried out at least every two years and after substantial changes (Article 31), and can also serve for certification. The English category names are our rendering of the Spanish BÁSICA, MEDIA and ALTA.
Example
An illustrative example, not a real case. A software company hosts a case-management platform used by a town council, and the tender asks for ENS conformity of the service. The first step is to define which systems are part of that service (not the whole company), categorise them and draw up the Statement of Applicability. If the system turns out to be MEDIUM, a certification audit is needed; if it were BASIC, a self-assessment and a declaration of conformity would be enough.
What the ENS is not
It is not a universal company certification and does not prevent incidents on its own. Applicability, category and scope must be confirmed in the legal text and in the tender documents of each case. If a supplier shows an ENS certificate, check the entity, the system, the category, the scope and the validity. The ENS is a Spanish framework: confirm separately which other frameworks apply to your entity.
When to call an expert
Ask for help if a tender or a public-sector customer requires ENS conformity and you do not know which systems are in scope, which category applies or what evidence to gather, or if you need to implement technical measures and train the team. To interpret the contract or the tender, consult a legal professional.
At Impulso Tecnológico we work on diagnosis, technical controls and training: see our cybersecurity services, the public-sector industry page or tell us about your case. Impulso does not certify: certification is issued by an accredited, independent body.
Learn more
Related glossary terms: ISO 27001 and NIS2.
Official sources (in Spanish): Royal Decree 311/2022 (BOE), the adaptation process, the conformity badges and the certification bodies of the National Cryptologic Centre (CCN).
Full guide: ENS vs ISO 27001: which one does your SME need?.