Who needs it
Systems in the media and alta categories of the ENS need a Certificación de Conformidad. This often includes companies that provide cloud, software or IT services to public bodies, since public tenders frequently ask for it.
The audit
An accredited certification body reviews the documentation, the risk analysis, the Statement of Applicability and the evidence that each applicable measure is in place. Findings must be corrected before the certificate is issued. The CCN-STIC 802 guide describes how ENS audits are carried out.
Validity
The certificate must be renewed through a new audit at least every two years, and an extraordinary audit is needed after substantial changes to the system.
Who can certify
Only certification bodies accredited by ENAC for the ENS can issue it. The CCN publishes the list of certified organisations and accredited bodies.
