Who must comply
The entire Spanish public sector and the private entities that provide it with services or solutions handling public information.
ENS certification · Medium category
Eritia Privacidad is certified under Spain’s National Security Framework (ENS) at MEDIUM category, verified by an independent certification audit.
Our certification
Security verified by a third party, not self-declared
The National Security Framework (ENS), regulated by Royal Decree 311/2022, is the framework setting the mandatory security measures for public sector information systems in Spain and for the private companies that provide services to it.
Eritia Privacidad holds ENS conformity certification at MEDIUM category. Unlike the basic category, which allows self-assessment, the medium and high categories require a certification audit carried out by an independent body: saying you comply is not enough, you have to prove it to an auditor.
For our clients this means their data is handled within an audited management system, and that we can work with public administrations and their suppliers without becoming the weak link in their supply chain.
Certification details
- Certification body
- Adok Certificación, S.L.
- ENAC accreditation
- No. 242/C-PR473, for ENS conformity certification
- Reference standard
- Royal Decree 311/2022, of 3 May
- Category
- MEDIUM
The certification body’s accreditation can be verified in ENAC’s public register of accredited bodies.
What the ENS is
The mandatory security framework of the public sector
It is not a voluntary standard nor a commercial badge: it is a legal obligation with direct consequences in public procurement.
What it requires
A risk analysis, a security policy, a Statement of Applicability and the effective implementation of the measures matching the system’s category.
How it is proven
Through a declaration of conformity in the basic category, or certification with an independent audit in the medium and high categories.
How often it is reviewed
Conformity is audited every two years and whenever substantial changes are made to the system.
Categories
Basic, medium and high: where we stand
A system’s category is determined by the impact an incident would have on each of the security dimensions. The greater the impact, the more measures required and the more external control.
Basic
Systems whose compromise would cause limited harm. Conformity may be declared through self-assessment.
Medium
One dimension reaches medium level and none reaches high. Requires certification audited by an independent body.
High
One dimension reaches high level: very serious harm. Requires the full set of measures and audited certification.
Dimensions
The five dimensions that are assessed
The ENS does not measure security as a single block: it assesses five properties of information and services separately.
Confidentiality
That information is only accessible to those who are authorised.
Integrity
That data is not altered or destroyed without authorisation.
Traceability
That there is a record of who did what, when and on which information.
Authenticity
That whoever accesses or signs really is who they claim to be.
Availability
That information and services are accessible when they are needed.
What you gain
Why a certified provider matters to you
-
Your data, in an audited system
The organisational, operational and protection measures we apply have passed an external audit; they are not a statement of intent.
-
A supply chain with no blind spots
If you work with the Administration, your suppliers also fall under the ENS umbrella. With us that requirement is already covered.
-
Ready for public procurement
We can support you in tenders and public contracts without our conformity becoming an obstacle in the file.
-
Real traceability of access
We log and retain activity on information, which also makes it easier to respond to a breach or a formal request.
-
Mandatory periodic review
Certification is maintained through recurring audits: it is not a badge you earn once and forget.
-
Continuity in the face of incidents
Availability is one of the assessed dimensions: there is a continuity and recovery plan, and it is tested.
We help you
Do you need to bring your company into line with the ENS?
We know the process from the inside because we have been through it. We support companies and entities throughout the whole adaptation, up to the certification audit.
- 01
System categorisation
We determine which category applies to you by assessing the impact on the five security dimensions.
- 02
Risk analysis
We identify assets, threats and safeguards, and calculate the acceptable residual risk.
- 03
Statement of Applicability
We document which Annex II measures apply to you and how they are implemented in your specific case.
- 04
Implementation of measures
We deploy the missing organisational, operational and protection measures.
- 05
Audit and conformity
We prepare you for the certification audit and support you throughout the process.
Frequently asked questions
Common questions about the ENS
What is the difference between being certified and declaring conformity?
In the basic category an entity may declare its conformity after a self-assessment. In the medium and high categories a certification audit by an independent certification body is required. Our category is medium, so our conformity is audited by a third party.
My company is private, does the ENS affect me?
It affects you if you provide services to the public sector or if you are part of the supply chain of someone who does. In those cases the Administration can require you to prove ENS conformity just as it requires it of itself.
Does the ENS replace the GDPR or ISO 27001?
No. The GDPR regulates the processing of personal data, ISO 27001 is a voluntary international information security management standard and the ENS is a Spanish legal obligation in the public domain. They overlap in many measures, which is why it is better to address them in a coordinated way rather than separately.
How long does ENS adaptation take?
It depends on the starting point, the size of the system and the category. What we can tell you from day one is which category applies to you and how far your current situation is from what is required.
Does the certification expire?
Conformity is maintained through audits every two years, and must be reviewed whenever substantial changes are made to the information system. It is not a one-off formality.
Can I cover the ENS with Kit Digital?
The voucher funds catalogue technology solutions (cybersecurity, backups, secure workstation) that help meet several ENS measures, but the adaptation and the audit are a separate consultancy service. We can combine them.
Are you required to prove ENS conformity?
We tell you which category applies to you and what you are missing to meet it. First assessment at no cost.