What it includes
A Plan de adecuación usually brings together the categorisation of the systems in scope, the security policy, the risk analysis, the Statement of Applicability with the measures that apply, the gaps found compared with those measures, and an improvement plan with actions, owners and deadlines.
Why it matters
It turns the ENS from a list of requirements into a project with a clear sequence. It is also the document that shows management, customers and auditors where the organisation stands and when it expects to be compliant.
Plan de adecuación vs gap analysis
A gap analysis is one part of the plan: it identifies what is missing. The Plan de adecuación adds the risk analysis, the decisions on which measures apply and the roadmap to close the gaps.
Reference guide
The CCN-STIC 806 guide explains how to prepare it.
