What the tender actually asks for
When a Spanish public contract involves information systems, the contracting authority has to build ENS requirements into the tender. Article 2.3 of Real Decreto 311/2022 says the administrative or technical specifications must include whatever is needed to ensure that the contractor's systems conform to the ENS. It names the obvious instrument: the contractor's declaration or certification of conformity with the ENS. The same article extends that caution to the contractor's own supply chain, as far as necessary and according to the risk analysis.
So the question in most tenders is not whether you apply the ENS in some general sense. It is whether you can produce a specific document that is:
- issued in the right way;
- covering the right systems;
- at the right category;
- valid on the right date.
Bids are lost on each of those details, usually by companies that did the security work but presented the wrong proof.
The ENS requirement can appear in different parts of the tender documents:
- a technical solvency requirement that bidders must meet to be admitted;
- a condition the winner must meet before or during execution;
- a technical specification of the service;
- occasionally, an award criterion.
Read the clause closely before planning anything, because each placement sets a different deadline. If you are starting from zero, our guide to the first steps when a tender requires the ENS covers categorisation and the early decisions; this article focuses on the proof itself.
Declaration, certification and the conformity badge
The ENS has two ways of proving conformity, and which one applies depends on the category of the system. Article 38.1 of RD 311/2022 sets the rule: systems of MEDIA or HIGH category need an audit to certify their conformity. Systems of BASIC category only need a self assessment to declare it, although they can also choose a certification audit.
Declaration of conformity (BASIC)
For a BASIC system, the organisation carries out a self assessment against the applicable measures of Annex II and, if it conforms, issues its own declaration of conformity. There is no external auditor. Article 38.2 requires the declaration to be published on the organisation's website or electronic office, and the CCN provides a conformity badge for BASIC declarations that companies display alongside it.
A declaration is only valid for BASIC. If the tender requires MEDIA, or if any dimension of your system is valued at a level that makes the category MEDIA, a declaration does not meet the requirement however good the underlying work is. Our article on declaration versus certification explains how the category is decided.
Certification of conformity (MEDIA and HIGH)
For MEDIA and HIGH systems, conformity is proved by a certificate issued by a certification body after an external audit. The Technical Security Instruction on ENS conformity, approved by Resolution of 13 October 2016, sets how certificates are issued and published, and the CCN still cites it as the reference. Section V.1 provides that the certificate is completed with a certification badge whose use depends on the certificate itself.
A certificate of conformity states the organisation, the information systems and services in scope, the category, the date of certification and the date until which it is valid. Each of those lines matters in a tender, and the scope line matters most.
What a valid badge is, and what it is not
The badge is a visual sign that links to the declaration or certificate. It is useful for a website and a bid document, but it is not the proof. A contracting authority that wants to verify conformity looks at the certificate or declaration behind the badge: its scope, category and dates. A badge on a website with no current certificate behind it is worse than no badge, because it suggests the company does not know its own status.
The CCN publishes different badges for declarations and for certifications, so the badge also signals how conformity was assessed. A declaration badge in a bid for a service that requires MEDIA tells the evaluator at a glance that the proof does not match the requirement, before anyone opens the documents.
Who can issue a valid certificate
Only a certification body accredited for the ENS can issue a certificate of conformity. Section VI.1 of the 2016 instruction requires certification bodies to be accredited by ENAC, the Spanish national accreditation body, to certify systems within the scope of the ENS under the standard UNE-EN ISO/IEC 17065:2012. The CCN keeps a public list of certification bodies with their accreditation status.
This rules out several documents that bidders sometimes present:
- a gap analysis or readiness report from a consultancy;
- a letter from an implementation partner saying the company "complies with the ENS";
- an internal audit report;
- a certificate from a body that is not accredited for the ENS, even if it is accredited for other standards.
None of these is a certification of conformity. Qalea is in the same position as any consultancy or platform here: it can get a company audit ready and run the security measures the audit checks, but the certificate has to come from an accredited certification body. Before contracting an auditor, check that it appears on the CCN list with an active ENS accreditation.
Scope: the detail that disqualifies bids
Article 2.3 is precise about what must conform: the information systems on which the services provided by the contractor are based. A certificate is only useful in a tender if its scope covers those systems.
The certified system must support the tendered service
ENS certification is granted to defined information systems and the services they support, not to a company as a whole. A software company may hold a MEDIA certificate for its document management platform and bid for a contract to provide a citizen appointment system it runs on different infrastructure. The certificate is genuine, but it does not cover the systems behind the service being bought, and a careful contracting authority will notice.
Before bidding, set the scope line of your certificate side by side with the object of the contract. If the tendered service runs on systems outside the certified scope, there are two options: extend the scope through the certification body, or recognise that the bid relies on proof you do not have yet.
The category must match or exceed what the tender requires
A tender may require conformity at a specific category. A BASIC declaration does not satisfy a MEDIA requirement, and a MEDIA certificate does not satisfy a HIGH one. The security officer determines the category of a system from the valuations of the information and services it handles, following Annex I of RD 311/2022. It has to be reviewed annually or when significant changes occur.
If your own categorisation produces BASIC but the contracting authority requires MEDIA for the service, the authority's requirement governs what you must present. Raising the category means applying more Annex II measures and their reinforcements, and changes the route from declaration to certification.
When you must hold it: bid date or execution
Timing is where companies with genuine ENS work still lose contracts. Under Article 140.4 of Ley 9/2017 de Contratos del Sector Público, capacity, solvency and the absence of prohibitions to contract must exist on the final date for submitting bids and continue until the contract is formalised. The Junta Consultiva de Contratación Pública del Estado has confirmed this reading in its reports.
If ENS conformity is a solvency requirement
If the tender frames ENS conformity as part of technical solvency, you must hold the declaration or certificate by the bid deadline. A certificate obtained after that date does not cure the defect, even if it arrives before the award. Bidders usually declare compliance through the European single procurement document (DEUC) and present the supporting documents when asked. That happens before award for the best ranked bidder in any case. The declaration in the DEUC is a statement that the condition is met on that date, so it has to be true on that date.
The condition also has to continue until formalisation. A certificate that is valid on the bid deadline but expires before the contract is signed causes the same problem, so the renewal date of your certificate belongs in the bid calendar alongside the submission deadline. If the certificate has not been issued by the deadline, plan for the next tender rather than bidding on one that treats the ENS as solvency.
If it is a condition of execution
Some tenders treat ENS conformity as an obligation of the winning contractor, to be met before the service starts or within a set period after formalisation. This gives more room, but it is a binding commitment. If the deadline passes without a certificate, the contractor is in breach, with whatever consequences the specifications set.
Read how the clause defines both the deadline and the evidence. Some specifications ask for the certificate before the service starts, others within a number of months from formalisation. Whatever the form, the commitment should rest on a realistic plan: the gap analysis done, the certification body booked and the Annex II measures already running, not a promise to start the work after the award.
Provisional approval while a certification is completed
For a first certification, the CCN can exceptionally issue a provisional approval of conformity when the audit has found deviations whose corrective plan needs more than three months. Under the CCN's general audit and certification criteria, it lasts six months and can be extended by another six. It exists for specific situations, so do not plan a bid around obtaining one; if the timing is tight, ask whether the tender accepts it before relying on it.
The provisional approval is issued by the CCN, records the actions still pending and the period of validity, and can be withdrawn if the corrective plan is not completed. It is not a shortcut for a company that has not been audited: it only applies where a first certification audit has taken place and a corrective plan is under way.
How the contracting authority verifies it
A contracting authority does not have to take a bidder's word. The certificate itself names the certification body, which the authority can check against the CCN list of accredited bodies. The CCN also publishes the organisations that hold certifications of conformity, so a certificate that does not appear there, or appears with different dates or scope, raises questions immediately. Declarations for BASIC systems are published on the organisation's own website under Article 38.2, so an authority can check that a current one exists.
Authorities also check dates. Under Article 31 of RD 311/2022, systems in scope are audited at least every two years. An extraordinary audit is required when substantial changes to the systems could affect the required security measures. A certificate past its validity date proves nothing about today. A bidder whose certificate expires between the bid deadline and formalisation has the problem described above: the condition has to continue until the contract is signed.
Subcontractors and cloud providers
Article 2.3 extends ENS requirements to the contractor's supply chain, as far as necessary and according to the risk analysis. In practice this reaches the providers whose systems support the contracted service:
- the cloud platform that hosts it;
- a data centre;
- a managed service provider that operates part of the infrastructure;
- a subcontractor that handles part of the work.
What each provider needs depends on its role. A cloud provider hosting the system typically needs its own ENS certification at a category at least equal to the system's, and many large providers publish theirs. For HIGH systems, Annex II adds a specific measure on supply chain protection, op.ext.3. For MEDIA and HIGH, measures op.ext.1 and op.ext.2 require contracts and service level agreements with external providers and their day to day management.
Article 13.5 adds an operational requirement for outsourced services. Unless there is a justified and documented reason, the service provider must designate a security point of contact who supervises the security requirements of the service and the management of incidents within it. Tender documents can ask for that contact in the bid, so name a person who actually holds the role.
Keeping the proof valid for the life of the contract
Winning the tender is the start of the obligation, not the end. The contract usually runs longer than a single audit cycle, and conformity must be maintained throughout. That means:
- passing the regular audit at least every two years;
- handling the extraordinary audit that substantial changes trigger;
- keeping the Annex II measures running between audits.
Several events during a contract can put conformity at risk:
- migrating the service to a new cloud provider or region;
- adding a new module or a new integration with another system;
- changing a key subcontractor;
- an incident that reveals that a measure was not working;
- the person who held the security officer role leaving the company.
Each of these should trigger a check: does the certificate still cover what we deliver, and does the change require an extraordinary audit? Our guide to keeping ENS certification valid between audits covers which measures have to run every day, and our article on how an ENS audit works explains what the auditor reviews.
This is the part of ENS compliance that Qalea is built for. Qalea helps companies prepare for the certification audit and then runs the security measures the certificate depends on, with monitoring, incident management and supplier control operating continuously. The proof presented in the next tender then reflects a system that is actually maintained. The ENS topic page collects the rest of our guides.
