Who it applies to
The ENS applies to Spanish public sector entities and to private companies that provide services or solutions to them. In practice, it is often a requirement to bid for public contracts that involve information systems.
Categories and measures
Each system is assigned a category (básica, media or alta) based on the impact a security incident would have on five dimensions: confidentiality, integrity, traceability, authenticity and availability. The category determines which security measures apply. Measures are grouped in three blocks: the organisational framework, the operational framework and protection measures.
Declaration vs certification
Systems in the básica category can show conformity through a Declaración de Conformidad based on an internal assessment. Systems in the media and alta categories need a Certificación de Conformidad issued by an accredited certification body after an audit, renewed at least every two years.
Who maintains it
The Centro Criptológico Nacional (CCN) publishes the CCN-STIC guides that explain how to implement each measure.
