ENS 2022: Migration from ENS 2010 and New Requirements
Technical and operational roadmap to bring existing systems into line with RD 311/2022
ENS & Public Sector
ENS 2022: Migration from ENS 2010 and New Requirements
The Esquema Nacional de Seguridad (RD 311/2022) sets the minimum security requirements for the information systems of Spanish public administrations and of the companies that provide services to them. This guide explains how to determine a system's category, what Annex II requires, how the audit and certification process with ENAC works, and provides a phased adequacy plan with a reusable checklist and template.
Contents / Contenido
- 1. Executive summaryPreview
- 2. What is the ENS and why does it exist?Preview
- 3. Who is obligated by the ENS?Preview
- 4. The building blocks of the ENS: categories, dimensions and principlesRequires download
- 5. Annex II explained: the security measuresRequires download
- 6. Specific compliance profilesRequires download
- 7. The certification process (audit, ENAC, declaration/certification)Requires download
- 8. Phased adequacy planRequires download
- 9. ENS adequacy checklistRequires download
- 10. Reusable template: measures matrix by categoryRequires download
- 11. Common mistakes in adequacy projectsRequires download
- 12. GlossaryRequires download
- 13. How Hodeitek helpsRequires download
- 14. SourcesRequires download
Preview: first pages
The Esquema Nacional de Seguridad (RD 311/2022) sets the minimum security requirements for the information systems of Spanish public administrations and of the companies that provide services to them. This guide explains how to determine a system's category, what Annex II requires, how the audit and certification process with ENAC works, and provides a phased adequacy plan with a reusable checklist and template.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- 1. Executive summary
- 2. What is the ENS and why does it exist?
- 3. Who is obligated by the ENS?
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.
“This whitepaper is the clearest guide I've seen on NIS2 in 2026.”
Related resources
NIS2 Supply Chain Guide: From Art. 21 to the Provider Register
Article 21.2.d of NIS2 requires essential and important entities to manage the security of their direct suppliers and service providers as part of their risk management policy. This guide explains what the article actually requires, how it relates to the ENS and DORA, and proposes a phased implementation plan with checklists and a reusable supplier assessment questionnaire template.
ENS High vs ENS Medium: a practical guide to choosing the right category
The difference between ENS Medium and ENS High is strategic, not just technical. We break down the categorisation criteria, real cost, audit requirements and common mistakes.