When ENS applies to a software company
The Esquema Nacional de Seguridad, regulated by Royal Decree 311/2022, was written for Spanish public administrations. It reaches private companies through article 2, which extends it to the information systems that private providers use to deliver services or solutions to public sector bodies. The same article requires those bodies to include ENS conformity in their contracts. A software company meets ENS for the first time in a tender specification or a renewal clause, not in a regulator's letter.
For a SaaS company the trigger is concrete: a city council, a regional health service, a university or a ministry wants to use the product, and the product will process its information or support one of its services. From that point, the system that delivers the service has to conform to ENS at the category the contracting body requires. Our guide to ENS in a public tender covers the first weeks after that requirement appears.
ENS applies to the system, not to the company as a whole. A SaaS provider with several products can scope ENS to the one sold to the public sector, as long as the boundary is clear and the shared components, such as the identity provider, the deployment pipeline and the support team, are inside it.
How the category of the system is set
Annex I of RD 311/2022 sets the category of a system from the impact that a security incident would have on five dimensions: confidentiality, integrity, traceability, authenticity and availability. Each dimension is rated low, medium or high. The category is the highest rating across the five. A system with one high dimension is category ALTA, even if the other four are low.
In practice, the public body categorises the service it is contracting and writes the result into the tender. The provider's job is to understand why that category was chosen and to scope the system accordingly. A SaaS product that holds citizens' personal data, supports a service with legal deadlines or handles health information will rarely be BÁSICA. Our article on whether ENS applies and at which level explains the categorisation in detail.
Self-assessment or certification
The category determines how conformity is shown. A system in category BÁSICA can obtain a declaration of conformity based on a self-assessment, although many providers choose a certification audit anyway because buyers trust it more. Systems in categories MEDIA and ALTA require a certification of conformity issued after an audit by a certification body accredited by ENAC, the Spanish accreditation body, for the ENS scheme.
Article 31 of RD 311/2022 requires an ordinary audit at least every two years, plus an extraordinary audit after substantial changes to the system. For a SaaS company that ships changes continuously, the question of what counts as substantial deserves an answer before the first audit, not after. The audit itself is described in our article on how the ENS audit works.
What the scope covers for a SaaS product
The scope of an ENS system for a SaaS product usually includes four layers. The first is the production environment that runs the service, including the cloud accounts, the networks and the databases. The second is the code and the pipeline that deploys it, because changes to production are made there. The third is the people who operate and support the service, with their devices and access. The fourth is the external providers the service depends on, from the cloud platform to the email service that sends notifications.
Leaving the deployment pipeline or the support team outside the scope is a common mistake. Auditors follow the path a change takes to production and the path a support engineer takes to customer data. If either path crosses an area outside the scope, the measures that protect the system are incomplete.
What cloud delivery adds: op.nub.1
RD 311/2022 introduced a specific measure for cloud services, op.nub.1, in the operational framework of Annex II. It applies when the system uses cloud services provided by a third party, which is the normal situation for a SaaS company built on a hyperscaler. The measure requires the provider to meet the security level of the system, and at higher categories expects the cloud service to hold its own ENS certification and to be configured following the guidance of the CCN, the Spanish National Cryptologic Centre.
The major infrastructure providers hold ENS certifications for many of their services, but a certification covers specific services and regions. The SaaS company has to check that the services it actually uses are in scope of its provider's certificate, and that its own configuration of those services follows the applicable CCN-STIC guides. A certified cloud platform with an unhardened configuration does not satisfy op.nub.1.
ENS does not contain a general rule that data must remain in Spain. It does require the provider to know and control where processing happens, under which jurisdiction and with what encryption and key management. Some tenders add explicit location requirements, which then become contractual obligations.
The measures that usually create work
The full catalogue is explained in our article on the ENS Annex II security measures. For SaaS companies, the measures that most often require new work are these:
- Segregation of roles under article 11, which separates the person responsible for the information, the service, security and the system. In a small company this needs careful design.
- Access control, op.acc, including strong authentication and the review of privileged access to production.
- Activity logging, op.exp.8, with logs that are retained, protected and actually reviewed.
- Management of external services, op.ext, with documented security requirements for each provider.
- Application development and acceptance, mp.sw.1 and mp.sw.2, covering secure development and testing before release.
- Backups, mp.info.6, with tested restoration rather than a configuration screenshot.
Using ISO 27001 as a starting point
Many SaaS companies already hold ISO 27001 when the first ENS requirement arrives. The two frameworks share the logic of a management system built on risk, and a large part of the evidence can be reused. ENS is not a subset of ISO 27001, though. Its measures are prescriptive, they scale with the category, and it adds the article 11 roles and the CCN guidance. Our article on running ISO 27001 and ENS as a single programme explains how to avoid maintaining two parallel sets of documents.
Where Qalea fits
An ENS certificate for a SaaS product depends on measures that run every day: monitored access, reviewed logs, tested backups, controlled changes. Qalea runs the controls behind those measures, with a compliance platform mapped to Annex II and a monitoring layer of EDR, SIEM and a SOC that produces the operational evidence the auditor samples. We get the system audit-ready and keep it that way between audits, as described in our article on maintaining ENS certification. More on the framework in our ENS topic hub.
