The Esquema Nacional de Seguridad is governed by Royal Decree 311/2022, which replaced the earlier RD 3/2010. Most organisations meet it the same way: a tender document lands, someone reads the technical requirements, and a sentence about ENS conformity turns out to be a condition of bidding.
The scheme reaches suppliers, not only public bodies
Article 2 of RD 311/2022 sets the scope. Alongside state, regional and local administrations, it covers private-sector organisations that handle information or provide services to them. Nationality is not the qualifier: a provider established outside Spain that processes Spanish public-sector information falls inside the same scope as one established in Madrid.
This is how the requirement travels down a supply chain. A prime contractor holds the public contract; the subcontractor running part of the system inherits the obligation. Companies frequently discover this second-hand, from a customer rather than from a regulator.
The practical consequence is commercial. Where a tender specifies ENS conformity, a bidder who cannot evidence it is excluded from that procedure. Where a live contract requires a valid certificate, letting one lapse gives the contracting body grounds to terminate.
Three categories, decided by impact, not by company size
ENS categorises systems, not organisations. A twelve-person company can operate a system in categoría media, and a large organisation can hold several systems in different categories at once.
Categorisation works from the harm that would follow if the system were compromised, assessed across confidentiality, integrity, availability, authenticity and traceability:
- Básica: limited impact
- Media: significant harm to the organisation
- Alta: serious harm
Two things follow from getting this wrong. Categorise too low and the certificate will not satisfy the tender. Categorise too high and you commit to controls, audits and cost the contract never asked for.
Declaration or certification: the distinction that changes everything
This is the part that most often surprises people, and it is worth being precise about.
For categoría básica, RD 311/2022 permits a declaración de conformidad: the organisation assesses itself and publishes the result. No external auditor is required.
For categoría media and alta, a certificación de conformidad is required, issued following an audit by a certification body accredited by ENAC.
Two different procedures, two different costs, two different timelines. A tender that says "ENS conformity" without naming a category is ambiguous, and the ambiguity is expensive in both directions. Read the technical specification for the category before scoping any work, and if the document is genuinely silent, ask the contracting body rather than guessing upwards.
What Annex II actually asks for
Annex II of RD 311/2022 sets out 73 security measures, grouped into three frameworks:
- Marco organizativo: 4 measures covering the security policy, normative documents, procedures and authorisation processes
- Marco operacional: 33 measures covering planning, access control, operations, protection of outsourced services, continuity and system monitoring
- Marco de protección: 36 measures covering facilities, personnel, equipment, communications, media, applications, information and services
Whether a measure applies, and with which reinforcements, depends on the system's category or, for some measures, on the security level of a specific dimension. Moving up a category does two things. It adds measures that do not apply below it: change management (op.exp.5) and contracting and service level agreements (op.ext.1) start at media, and supply chain protection (op.ext.3) applies only at alta. Where availability is rated high, the continuity plan, periodic testing and alternative means (op.cont.2, op.cont.3 and op.cont.4) also become mandatory. It also raises what existing measures demand: intrusion detection (op.mon.1) applies from básica and gains reinforcements at media and alta. The full breakdown is in our guide to ENS Annex II security measures.
That distinction matters when choosing how to comply. Documentation alone satisfies parts of the marco organizativo. It does not satisfy the operational monitoring measures, which require something to actually be watching.
The role you have to designate before anything else
Article 11 of RD 311/2022 sets the principle of differentiated responsibilities. It distinguishes four roles, the information owner, the service owner, the Security Officer (Responsable de la Seguridad) and the System Officer (Responsable del Sistema), and requires responsibility for security to be kept separate from responsibility for operating the systems. Article 13.3 makes the rule concrete: the Security Officer must be a different person from the System Officer, with no hierarchical dependency between them.
For a mid-sized company this is the awkward part. The obvious candidate is the IT lead, and the IT lead is usually the System Officer, because they run the systems. Article 13.3 only allows both roles to fall on the same person, or on people in a reporting line, in exceptional situations where a justified lack of resources makes it necessary, and then only with compensating measures that preserve the purpose of the separation. That justification and those measures have to be documented, and the auditor will ask for them.
The role is not ceremonial. Under article 13.2, the Security Officer makes the decisions needed to meet the security requirements, supervises how the measures are implemented and reports on them. Under article 28.2, the same person signs the Statement of Applicability that lists the Annex II measures selected for the system. In an organisation with no security function, it is a substantial job handed to someone who already has one.
What happens after the certificate
An ENS certificate is not a one-off. Certificates carry a validity of two years, and the scheme requires ordinary audits at least every two years, plus an extraordinary audit where the system changes substantially. Internal review continues in between.
That cadence is what tends to break document-led approaches. A folder of policies assembled for an audit drifts within months of the auditor leaving. Systems change, staff rotate, and the evidence that supported a measure last spring no longer describes what happens today. The next audit finds the gap.
Separately, RD 311/2022 obliges notification of incidents affecting covered systems to the CCN-CERT. That obligation is continuous, and it presumes the organisation can detect an incident in the first place.
What this means if you have no security function
Most companies that hit ENS for the first time do not have anyone whose job is security. The obligation still lands in full: a Security Officer separate from the System Officer, the Annex II measures that apply to the system's category, an audit at least every two years, monitoring that runs continuously, and a duty to notify incidents.
Part of that work can be done as a project: categorising the system, writing the policy and procedures, running the risk analysis and building the Statement of Applicability. The rest cannot. Detection, incident handling and the records that show each operational measure is working have to be produced continuously, for as long as the certificate is held. Deciding who does that work is the scoping question to settle before choosing any tool or provider.
Qalea is a compliance platform that comes with guided support from our security team. The platform maps the Annex II measures to your controls and keeps the evidence for each one. Our team works with your owners to categorise the system and build the Statement of Applicability, and the monitoring layer (EDR, SIEM and a SOC) produces the records that operational measures need. For companies that already have a security team, the platform reuses the controls and evidence they run for frameworks such as ISO 27001, so Annex II does not mean duplicating the work.
No provider can issue the certificate. That comes from a certification body accredited by ENAC, after an audit. What a provider can do is help keep the measures operating, and the evidence current, between one audit and the next.
If ENS is on your desk because of a tender, the first two decisions are the ones above: which category the specification requires, and whether that means a declaration or a certification. Those two answers set the scope of everything that follows.
