The requirement for selling to public bodies
Spain’s National Security Framework (ENS, RD 311/2022) is the security framework for Spanish e-government. It’s already in force and a common requirement for private suppliers serving the public sector.
This guide summarizes the framework in plain language and does not replace legal advice. Always check the official text before making decisions.
What the ENS is
It applies to Spanish public bodies and to any private company that provides services to public administration, and rests on three pillars. In practice it’s applied with the guides from Spain’s National Cryptologic Centre (CCN), which detail how to implement each measure. For some types of entity or service, the CCN also approves specific compliance profiles that adapt the measures to their case.
Three categories
Basic, Medium or High, based on the impact an incident would have on the information and services you handle.
75 security measures
Organized into organizational framework, operational framework and protective measures, proportional to each system’s category.
Declaration or certification
Basic category requires self-assessment; Medium and High require an audit by an accredited entity every two years.
From 2010 to today
01 / 2010
The ENS is created
Royal Decree 3/2010 creates the National Security Framework for Spanish e-government.
02 / 2022
ENS updated
Royal Decree 311/2022 updates the framework, aligning it with current threats and technologies.
03 / Today
Already required in tenders
The ENS is already in force and a common requirement in contracts and tenders with Spanish public administration.
75
Security measures
3
Categories (Basic/Medium/High)
2 years
Audit cycle (Medium/High)
2022
Last updated
Consequences of non-compliance
The ENS doesn’t impose commercial fines like the GDPR — it’s an eligibility requirement for working with public administration.
| Who | Consequence | Detail |
|---|---|---|
| Private suppliers | Loss of eligibility for public contracts | Without an ENS declaration or certification, you can’t bid on public tenders that require it. |
| Public sector | Disciplinary liability under civil service regulations | Non-compliance by a public body can lead to administrative liability for those responsible. |
What ISO 27001 gives you for the ENS
ISO 27001 is a good base for the ENS: many of its security measures apply here too. But it doesn’t cover all of it: the ENS has requirements of its own, such as system categorisation and the declaration of conformity, that must be covered separately.
What it means for your SME
If you sell software or services to any Spanish public administration, you’ll likely be asked for an ENS declaration or certification as part of the contract or tender.
The required category (Basic, Medium or High) depends on the service you provide, not the size of your company.
A Medium or High category certification expires after two years and has to be audited again. With Kardu every piece of evidence is dated and has its expiry, so you know what to renew before the auditor arrives.
6 minimum requirements
- Categorization of your systems (Basic, Medium or High)
- A risk analysis using a recognized methodology (in the public sector the usual one is MAGERIT, with the CCN’s PILAR tool)
- An information security policy
- A service continuity plan
- A declaration of conformity (Basic) or audit (Medium/High)
- Security roles assigned: the security officer must be different from the system officer; the information and service owners can be the same person
Official sources
This guide is a summary. For the legal detail, consult the royal decree’s text directly; for implementation, the CCN’s guides.
Official ENS text on the BOE →The CCN’s ENS portal →ISO 27001 as the base, ENS included
Kardu organizes your compliance evidence around ISO 27001 and maps it to the ENS and any other frameworks that apply to you, so you don’t duplicate work across regulations.