About this Framework
The Esquema Nacional de Seguridad (ENS — Royal Decree 311/2022) establishes security principles and minimum requirements for all Spanish public administration information systems and their contracted cloud and IT service providers. ENS defines three security categories (Basic, Medium, High) based on dimensional classification across confidentiality, integrity, traceability, authenticity and availability. Cloud service providers must achieve ENS certification to supply services to Spanish public administration at central, regional and local levels.
Key Control Domains
Security Governance & Policy
Security Organisation
Risk Management
Personnel Security
Physical Security
Operations Security
External Services Security (Cloud)
Service Continuity
Data Protection
Incident Management
Cryptography & Key Management
Network Security
Application Security
Who Needs This?
- Spanish public administration entities at central, regional and local level
- Cloud service providers supplying digital services to Spanish government
- IT service contractors for the Spanish public sector
- Entities subject to the LPACAP digital administrative services requirements
Compliance Benefits
- Mandatory compliance for Spanish public sector technology suppliers
- ENS certification enables government cloud and digital services market access
- Aligns with ISO 27001, EU NIS2 and GDPR requirements
- Required for AEPD data protection authority compliance in Spain
Official Reference
CCN-CERT ENS Portal
https://ens.ccn-cert.cni.es/
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/ens-national-security-framework-assessment