Spanish National Security Framework (ENS): complete guide to Royal Decree 311/2022

The Spanish National Security Framework (Esquema Nacional de Seguridad, ENS) is Royal Decree 311/2022 of 3 May, the rule that sets the basic principles, minimum requirements and security measures for information across the whole Spanish public sector and the companies that provide it with services or solutions. Conformity is declared through a self-assessment if the system is BASIC category and certified through an audit if it is MEDIUM or HIGH category [1].

This guide walks through the framework end to end: who it applies to, the seven principles and fifteen minimum requirements, the categories, the catalogue of measures, the difference between declaring and certifying, what changes if you supply the public sector, the phases of a project and a checklist. If you want help meeting it, see our ENS compliance service.

What the ENS is and what changed in 2022

Royal Decree 311/2022 was published in the BOE no. 106 of 4 May 2022, came into force the next day and repealed Royal Decree 3/2010, which had regulated the ENS for electronic administration [1]. It has 41 articles, seven chapters and four annexes: categories (Annex I), security measures (Annex II), audit (Annex III) and glossary (Annex IV).

Its preamble sets three goals for the update: to align the ENS with the current legal and strategic framework, to be able to adjust requirements to specific groups or types of system through specific compliance profiles, and to respond better to cybersecurity trends, with more weight on continuous monitoring [1].

The single transitional provision gave 24 months from entry into force for existing systems, including those of private-sector contractors, to reach full alignment; the CCN places that milestone at 5 May 2024 [1] [8]. New systems apply the decree from the design stage.

The decree is completed by pieces worth telling apart:

The CCN's portal lists four ITS: conformity, audit, security status report and incident notification [2] [3] [4] [5]. They are resolutions from 2016 and 2018, and the CCN itself says the conformity ITS is under review to adapt it to Royal Decree 311/2022 [7], so check the portal for the current text when preparing a certification. The sources are published in Spanish.

Who the ENS applies to

Source for the table: [1]. Two clarifications that avoid confusion:

• Scope is per system, not per company. The decree refers to the information systems that support the services provided. A supplier does not certify "the company" in the abstract, but the systems it uses for the contracted service.
• If your entity is private and does not provide services to the administration for its powers, the ENS is not mandatory on this route. You can adopt it voluntarily as a reference, but the obligation comes from Article 2.

If you are a supplier, the dedicated guide on ENS for public-sector suppliers goes into the tender documents and what the public client will ask of you.

On consequences: the CCN states that the ENS does not provide for a penalty regime, although the administrations' liability for the damage they cause remains [7]. In practice the pressure comes through contracts: tender documents must require the declaration or certification of conformity, and losing it can affect the contract.

The seven basic principles

Article 5 lists the principles that must guide every security decision. The ENS treats security as a process, not a one-off project [1].

The fifteen minimum requirements

The security policy is developed by applying the minimum requirements of Article 12.6, which are demanded in proportion to the risks of each system; some may be set aside in systems with no significant risks [1]. The policy must be approved by the competent body and, in private suppliers, by the body with the highest executive powers.

Two Article 13 requirements are often missed. The security officer must be different from the system officer, with no hierarchical dependence between them, except in exceptional cases of justified lack of resources, where compensatory measures must be applied. And for outsourced services, the provider must appoint a security point of contact, while ultimate responsibility remains with the public entity receiving the service [1].

Categories: basic, medium and high

A system's category balances the importance of the information and services it handles against the security effort required, under the principle of proportionality (Article 40). It is determined by assessing the impact of an incident across five dimensions: confidentiality (C), integrity (I), traceability (T), authenticity (A) and availability (D, for disponibilidad) [1].

Each affected dimension gets a level according to the harm an incident would cause:

The category follows from the highest level reached by any dimension:

An illustrative example, not a real case: a system whose availability would reach MEDIUM and whose other four dimensions would stay at LOW is MEDIUM category, because one dimension at MEDIUM is enough. The category does not change the levels of the other dimensions, which still determine which measures apply to each [1].

Who decides: the information and service owners assess the levels, and the security officer determines the system's category (Article 41). Annex I requires the category to be re-evaluated every year or on significant changes to the criteria. For the method, Annex I refers to the CCN's CCN-STIC guides, which specify the categorisation criteria [1]. If you hesitate between two categories, the comparison of ENS High versus Medium details what changes in practice.

The Annex II security measures

Annex II groups the measures into three frameworks, and each measure applies according to the system's category or, for those tied to a specific dimension, according to that dimension's level [1]. The catalogue contains 73 measures:

Many measures include reinforcements (R1, R2…) that add up as the level rises. These examples, taken from the Annex II table, show how the requirement grows between categories or levels:

A useful detail: reinforcement R6 of op.mon.3, which is only part of the HIGH category set, provides for periodic configuration checks, vulnerability analysis and penetration testing [1]. It is not a generic yearly obligation for every category.

Statement of Applicability, compensatory measures and profiles

The Annex II measures are enforceable minimums that the security officer may extend (Article 28.2). They can be replaced by compensatory ones if it is documented that they protect equally or better, and the correspondence is detailed in the Statement of Applicability, which the security officer formally approves (Article 28.3). A CCN-STIC guide of those provided for in the second additional provision guides that selection [1]; the CCN cites guide CCN-STIC 819 for compensatory measures [7].

Specific compliance profiles allow a set of measures suited to a particular type of entity or sector. The CCN cites, among the authorised profiles, those for local entities and universities [7], and maintains the µCeENS methodology to certify against a specific compliance profile [10].

Conformity: self-assessment, audit and certification

Article 38 sets two routes by category. MEDIUM or HIGH systems need an audit to certify their conformity; BASIC systems only need a self-assessment to declare it, although they may also undergo a certification audit [1].

Sources: [1] [2] [9].

Audit cycle rules:

• At least every two years. Article 31 requires a regular ordinary audit at least every two years, extendable by three months for force majeure beyond the entity's control, and an extraordinary one after substantial changes to the system. The extraordinary audit resets the count for the next two years [1].
• A certificate lasts two years. The CCN explains that the renewal date cannot exceed two calendar years from the initial certification and that the audit should be planned so the renewal decision falls within the validity period [7].
• A partial extraordinary audit does not extend validity. If only what differs is audited (for example, moving from MEDIUM to HIGH), the new certification cannot go beyond the date of the previous one; a full audit can have the usual two-year validity [7].
• Publicity. Those responsible for the systems publish declarations and certifications on their portals or electronic offices (Article 38.2).
• HIGH category. The system owner may temporarily suspend processing, the service or operation until serious deficiencies in the audit opinion are fixed (Article 31.6).

An audit checks, among other things, that the policy defines the roles, that a risk analysis exists with annual review and approval, that Annex II measures are met, and that a documented information security management system exists, approved by management on the basis of the Statement of Applicability (Annex III). It relies on evidence: documented procedures, incident records and interviews with staff [1]. Guide CCN-STIC 809 describes the declaration and certification of conformity [9].

Who can certify

Certification bodies must be accredited by ENAC under UNE-EN ISO/IEC 17065. Public-sector technical audit bodies recognised by the CCN can also certify [2] [8]. The CCN publishes the list of accredited bodies or bodies in the process. A body in the accreditation process may audit and issue certificates for 12 months; if it does not obtain accreditation in that time, it must stop [8].

If you supply the public sector

For a supplier, the ENS arrives through the contract. Public entities' tender documents must include the requirements to ensure conformity of the systems supporting the service, such as presenting the declaration or certification, and may extend to your supply chain [1].

Sources: [1] [2]. The CCN also clarifies that the requirement applies to any entity, Spanish or foreign, and that non-Spanish companies hold certifications [7]. Services supported by certified systems benefit from the certification, because they must be listed in the certificate.

Phases of an alignment project

The CCN portal describes the alignment process in five blocks, which work as a planning outline [6]:

Typical timelines, without promises. The decree sets no standard duration for alignment. It depends on the category, the scope, prior maturity and available resources. What is fixed is the rhythm afterwards: an audit at least every two years and an annual review of the risk analysis. The certification body submits an offer with the audit days and their format (on site, remote or mixed) once it has studied the prior documentation [7]; there is no single timeline valid for everyone. The CCN suggests starting with the BASIC category only as a roadmap agreed in the security committee, never as an end point if the system is of a higher category [7].

To see the regulatory change from the earlier version, read the whitepaper on migrating to ENS 2022.

Checklist

Common mistakes

• Certifying a narrower scope than the contracted service. The public client requires conformity to cover the systems supporting the service. A trimmed scope may fall short of what the tender requires.
• Staying at BASIC with a higher-category system. The category is set by impact, not ambition. Reaching BASIC conformity does not meet what a MEDIUM or HIGH category requires [7].
• Thinking the certificate means you are done. There is an audit at least every two years and, for MEDIUM and HIGH, the CCN says systems must also evidence an annual internal compliance audit aimed at improvement [7].
• Having the security officer and system officer as the same person or in the same reporting line without documenting the exception and compensatory measures (Article 13.3).
• A risk analysis done once. Annex III checks that it is reviewed and approved every year.
• Confusing the ENS with ISO 27001. The ENS is a prescriptive catalogue of measures with its own conformity route (Article 38); an ISO 27001 certificate is not the ENS certification. They are compared in the ISO 27001 guide.
• Not publishing the badge or reporting the security status. Badge publicity is an Article 38.2 obligation, and the CCN says bodies must complete the security status report through INES [6].
• Forgetting the extraordinary audit after a substantial change to the system (Article 31.1).

ENS, NIS2, DORA, AI Act and ISO 27001

• NIS2 is the general cybersecurity directive for essential and important sectors; if your organisation also falls in its scope, read the NIS2 compliance guide.
• DORA is the digital operational resilience regulation for the financial sector; the DORA guide explains it.
• The AI Act regulates artificial intelligence systems; the AI Act guide covers its obligations.
• ISO 27001 is a voluntary information security management standard. It does not replace the ENS certification, which has its own conformity route; the ISO 27001 guide explains how they are alike and how they differ.
• Technical testing. To validate monitoring and surveillance measures, the difference between Red Team and pentest helps you pick the right exercise, and our pentesting and Red Team service delivers it.

The ENS at Hodeitek

Hodeitek holds ENS certification in the Medium category, certificate no. 34/5704/26/09103, issued on 17 September 2026 by OCA Instituto de Certificación, a body accredited by ENAC. The certificate scope covers the systems supporting the HodeiShield SaaS service, penetration testing services, cybersecurity and ICT systems and services consulting, consulting on AI applied to business and process automation design, in accordance with the current Statement of Applicability. Renewal is due after two years, as the rule requires.

That certification does not certify your organisation and is not a product certification. To track conformity, HodeiShield offers scoring per measure and category based on Annex II, supplier scoring and scheduled scans with periodic follow-up; the use case details what the platform does and does not do. It does not audit, does not certify and is not in the CCN's ICT Security Products and Services Catalogue (CPSTIC), which Annex II cites for choosing certified products (op.pl.5) [1]. For full support, the GRC consulting team and the ENS compliance service cover the diagnosis, the roadmap and audit preparation.

This guide is informational and does not replace the official text or an auditor. Updated on 13 November 2026.