Categorization
Assess the information and services to determine the system's category: basic, medium or high.
Spain's National Security Framework · RD 311/2022
Start preparing for ENS medium and high certification today.
If you work with the Spanish public sector, the ENS (Esquema Nacional de Seguridad, Spain's National Security Framework) is a requirement to keep doing so. Audexa guides you through its 91 controls across the organizational framework, the operational framework and the protection measures, with policies, evidence and an action plan toward the audit.
- 91 controls across 15 areas
- 39 policy templates
- 63 mappings to ISO 27001
91 ENS controls with guidance and remediation steps
15 areas (org, op and mp), from categorization to certification
39 ENS-related policy templates
45 ENS ↔ ISO 27001 mappings to avoid duplicate work
What the ENS requires
No ENS conformity, no public-sector contract.
Royal Decree 311/2022 applies to the entire Spanish public sector and to private organizations that provide it with services or solutions. Systems are classified into basic, medium or high category.
Security measures
Organizational framework, operational framework and protection measures proportionate to the category.
Audit and certification
An audit at least every two years. Medium and high categories require certification; for the basic category, a self-assessment is enough.
How Audexa helps
The ENS organized, from categorization to audit.
Controls, policies and evidence organized according to the framework's own structure.
Assess
Know how far you are from ENS conformity.
Guided ENS audit
91 controls organized by organizational framework, operational framework and protection measures.
Applicability
Justify the controls that don't apply to your system and export them with the results.
Starting from ISO 27001
If you already have ISO 27001, reuse evidence through 63 mappings.
Document
The documentation the auditor asks for.
ENS policies
39 ENS-related templates, with approval and signature.
Evidence
Documents with an owner, review and expiry, linked to each measure.
Asset inventory
Devices, software and suppliers with an owner and periodic review.
Prepare for the audit
Arrive with the work done.
Action plan
Gaps turned into tasks with owners and dates.
Re-audit
Check your progress before the certification audit.
Reports
Executive and technical reports for management and the auditor.
Some features depend on your plan and active modules.
How it works
Three steps toward ENS certification.
Categorize and assess
Define the scope and complete the ENS audit to identify your gaps.
Implement
Approve policies, assign tasks and gather evidence for each measure.
Certify
Re-audit and arrive at the audit with your documentation in order.
Frequently asked questions
What people usually ask us about ENS.
Do private companies have to comply with the ENS?
Yes, if you provide services or solutions to the Spanish public sector within the framework's scope. Many public tenders require ENS conformity certification.
Does Audexa issue ENS certification?
No. Certification is issued by ENAC-accredited bodies. Audexa helps you implement the measures and prepare the documentation and evidence for the audit.
Does it help if we already have ISO 27001?
Yes. Audexa includes 63 mappings between ISO 27001 and the ENS so you can reuse evidence and reviewable answers.
Which plan do I need?
The ENS framework is available from the Core plan.
Request a demo
Let's prepare your ENS certification.
In 30 minutes we walk through the ENS audit, the policies and the action plan toward certification.
- We review your system's category.
- We show you controls, policies and evidence.
- We explain which plan fits you.