Our news
If you work for the Administration, you will need the ENS: what category applies to you and what it entails
The National Security Framework (ENS) is the standard that defines how information must be protected in Spanish public sector systems. If your company provides services to a government agency and those services use or depend on its systems, you will need to comply with the ENS. The level of security varies from company to company: basic, medium, or high.
Many SMEs only discover this when reading a tender document, just before submitting their bid. This article explains when it's required, how to determine your category, and what you'll need to do. This way, you can prepare in advance.
Why might a private company need the ENS?
A private company must comply with the National Security Framework (ENS) when it provides services or solutions to a public sector entity. Specifically, when those services use or depend on the Administration's systems. This applies to management software, cloud hosting, IT maintenance, and records management, among many other cases.
It is regulated by Royal Decree 311/2022, of May 3, published in the Official State Gazette (BOE) on May 4, 2022. Article 2 of this decree obliges the Administration to include compliance with the National Security Scheme (ENS) in the tender specifications when the contract requires it. Furthermore, if the risk analysis indicates it, this requirement also extends to the successful bidder's supply chain.
When will you need the ENS in a public contract?
They will ask for it when the tender specifications explicitly state it. The Administration can require it in three different ways: as a solvency requirement, as a criterion that awards points, or as a condition that is verified during the execution of the contract. Therefore, it is advisable to carefully read how it is presented in each tender.
The difference is important. If it's a solvency requirement, you have to prove it with your bid, and if you don't, you're excluded from the tender. The Central Administrative Court of Contractual Appeals reiterated this in rulings from June 2024 and October 2025: it's only a solvency requirement if the tender specifications expressly state it as such.
Which category are you in?
The category depends on the potential damage an incident would cause to the system you provide. Five dimensions are assessed: availability, authenticity, integrity, confidentiality, and traceability. Each dimension receives a low, medium, or high rating. The highest rating is the one corresponding to the highest level. To determine your category, follow these steps:
- Define the system: the specific service you provide to the Administration and the equipment, applications and people that support it.
- Evaluate each dimension: Think about what would happen if the data were leaked, altered, or became unavailable.
- Assign a level to each one: low if the harm would be limited, medium if it would be serious, and high if it would be very serious.
- Take the highest level: That's the system's category. Just one dimension at a medium level is enough for the category to be medium.
- Check it every year: and whenever the service, the data you process, or the customer changes.
The usual practice is for the Administration to specify the required category in the tender documents. If it doesn't, you and the service manager at the public entity will determine the category.
What does each category entail?
All three categories share the same logic: you must apply the measures in Annex II of the Royal Decree that correspond to your level. What changes is the number and stringency of these measures and, above all, how to demonstrate compliance, as summarized in this table.
| Basic | Average | High | |
|---|---|---|---|
| How is this demonstrated? | Self-assessment and declaration of conformity | Certification following an audit | Certification following an audit |
| Who issues it | The company itself | An accredited certification body | An accredited certification body |
| Revision | Periodic self-assessment | Audit at least every two years | Audit at least every two years |
In the basic category, you can also choose to voluntarily obtain certification. Many companies do so because a certificate carries more weight than a statement made to the client. Furthermore, an extraordinary audit is mandatory when the system undergoes substantial changes, and it resets the two-year period.
What will you have to do if you're going to need the ENS?
The work always follows the same order: define the scope, assess the category, analyze the risks, implement the necessary measures, and demonstrate the results. A small or medium-sized enterprise (SME) starting from scratch typically needs several months. That's why it's advisable to begin before the tender you're interested in comes up.
The measures include the security policy and the roles of information officer, service manager, security officer, and system administrator. Also included are access control, backups, and incident management. On our page about the National Security Scheme We explain how we support you every step of the way, from the initial analysis to certification.
How can Apen help you if you're going to need the ENS?
At Apen, we review the tender specifications or contract, define the affected system, and tell you which category you qualify for. Then we provide you with a plan outlining the necessary measures, prioritized by need, and we support you through the certification process, from initial declaration to audit.
We have been working with SMEs in the Vallès region and Barcelona for over 35 years, many of them suppliers to city councils and other public administrations. Call us at 938 606 220 or request your free assessment, and you'll know in just a few days how far you are from compliance.
Frequently Asked Questions
Will all companies that work for the Administration need the ENS?
No. Only those that provide services or solutions that use or depend on the Administration's systems, and only if the tender specifications require it. An office supply provider, for example, does not need it.
What is the difference between the declaration and the certification of the ENS?
The declaration is issued by the company itself after a self-assessment and is only valid for the basic category. The certification is issued by an accredited body after an audit and is mandatory in the medium and high categories.
How often does the certification need to be renewed?
An ordinary audit must be carried out at least every two years, and an extraordinary audit if the system changes substantially.
Is ISO 27001 suitable for the ENS?
It helps a lot, because many measures overlap, but it doesn't replace the National Security Scheme (ENS). The ENS has its own requirements, such as its roles, categories, and accreditation process with the Administration.
Does the ENS affect my subcontractors?
It may affect them. If the risk analysis indicates it, the compliance requirement also extends to the contractor's supply chain.
How long does it take to get it?
It depends on the category and your starting point. A basic declaration can be ready in a few weeks, while an intermediate certification usually takes several months.
