Spain ENS
Spain's Esquema Nacional de Seguridad (Real Decreto 311/2022): mandatory security framework for the public sector and private providers serving it. Systems are categorised BÁSICA, MEDIA or ALTA from impact on confidentiality, integrity, traceability, authenticity and availability, and apply the 73 Annex II measures (organisational org, operational op, protection mp) with reinforcements by category or dimension level, recorded in a signed Statement of Applicability, audited every two years and declared (BÁSICA) or certified (MEDIA, ALTA) as conformant.
Spain ENS is a compliance framework from Spain with 11 domains and 82 controls. The largest domains are Protection: facilities and personnel [mp.if, mp.per] – Spain ENS (11 controls), Operational: operation [op.exp] – Spain ENS (10 controls), Protection: information and services [mp.info, mp.s] – Spain ENS (10 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (11)
ENS articles: scope, roles, risk, audit and conformity – Spain ENS
| Code | Title |
|---|---|
| spain-ens::Art. 12 | Adopt a formally approved security policy covering the Article 12 content and minimum requirements |
| spain-ens::Art. 13 | Separate the information, service, security and system owner roles, with a security POC for outsourced services |
| spain-ens::Art. 14 | Manage risk with a recognised methodology and justify measures proportionately |
| spain-ens::Art. 2 | Apply the ENS to public sector systems and to private providers' systems serving them |
| spain-ens::Art. 28 | Select the Annex II measures by category and sign a Statement of Applicability |
| spain-ens::Art. 31 | Audit every system at least every two years, and extraordinarily after substantial changes |
| spain-ens::Art. 33 | Notify significant incidents to CCN-CERT (public bodies) or INCIBE-CERT (private providers) |
| spain-ens::Art. 38 | Declare (BÁSICA) or certify (MEDIA and ALTA) conformity and publish the badge |
| spain-ens::Art. 40 | Categorise each system BÁSICA, MEDIA or ALTA from impact on five security dimensions and review yearly |
Operational: access control [op.acc] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::op.acc.1 | Unique identification of users, roles and accounts |
| spain-ens::op.acc.2 | Access requirements and privileges |
| spain-ens::op.acc.3 | Segregation of duties |
| spain-ens::op.acc.4 | Access rights management: deny by default, least privilege, need to know |
| spain-ens::op.acc.5 | Authentication of external users |
| spain-ens::op.acc.6 | Authentication of internal users |
Operational: continuity and monitoring [op.cont, op.mon] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::op.cont.1 | Business impact analysis |
| spain-ens::op.cont.2 | Continuity plan |
| spain-ens::op.cont.3 | Periodic continuity testing |
| spain-ens::op.cont.4 | Alternative means |
| spain-ens::op.mon.1 | Intrusion detection |
| spain-ens::op.mon.2 | Security metrics |
| spain-ens::op.mon.3 | Surveillance and security event collection |
Operational: external resources and cloud [op.ext, op.nub] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::op.ext.1 | Contracts and service level agreements with external providers |
| spain-ens::op.ext.2 | Day-to-day management of external services |
| spain-ens::op.ext.3 | Supply chain protection |
| spain-ens::op.ext.4 | Interconnection of systems |
| spain-ens::op.nub.1 | Protection of cloud services |
Operational: operation [op.exp] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::op.exp.1 | Asset inventory with owners |
| spain-ens::op.exp.10 | Protection of cryptographic keys |
| spain-ens::op.exp.2 | Secure configuration before operation |
| spain-ens::op.exp.3 | Security configuration management |
| spain-ens::op.exp.4 | Maintenance and security updates |
| spain-ens::op.exp.5 | Change management |
| spain-ens::op.exp.6 | Protection against malicious code |
| spain-ens::op.exp.7 | Incident management process |
| spain-ens::op.exp.8 | Activity logging |
| spain-ens::op.exp.9 | Incident management records |
Operational: planning [op.pl] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::op.pl.1 | Risk analysis: informal, semi-formal or formal by category |
| spain-ens::op.pl.2 | Documented security architecture, management system and data validation |
| spain-ens::op.pl.3 | Formal planning of new component acquisition |
| spain-ens::op.pl.4 | Capacity planning and monitoring |
| spain-ens::op.pl.5 | Use CPSTIC-listed or certified security components |
Organisational framework [org] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::org.1 | Security policy document |
| spain-ens::org.2 | Security regulations on proper use and staff responsibilities |
| spain-ens::org.3 | Security operating procedures |
| spain-ens::org.4 | Formal authorisation process for system elements |
Protection: equipment and communications [mp.eq, mp.com] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::mp.com.1 | Secure perimeter |
| spain-ens::mp.com.2 | Confidentiality of communications |
| spain-ens::mp.com.3 | Integrity and authenticity of communications |
| spain-ens::mp.com.4 | Network segregation |
| spain-ens::mp.eq.1 | Clear desk |
| spain-ens::mp.eq.2 | Workstation locking and session closure |
| spain-ens::mp.eq.3 | Protection of portable devices |
| spain-ens::mp.eq.4 | Other network-connected devices (printers, IoT, BYOD) |
Protection: facilities and personnel [mp.if, mp.per] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::mp.if.1 | Separate, access-controlled areas for data centre equipment |
| spain-ens::mp.if.2 | Identification of persons entering |
| spain-ens::mp.if.3 | Environmental conditioning of premises |
| spain-ens::mp.if.4 | Electrical power and emergency supply |
| spain-ens::mp.if.5 | Fire protection |
| spain-ens::mp.if.6 | Flood protection |
| spain-ens::mp.if.7 | Register of equipment movements |
| spain-ens::mp.per.1 | Job security characterisation and vetting |
| spain-ens::mp.per.2 | Duties and obligations of staff |
| spain-ens::mp.per.3 | Security awareness |
| spain-ens::mp.per.4 | Security training |
Protection: information and services [mp.info, mp.s] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::mp.info.1 | Personal data requirements from the controller and DPO |
| spain-ens::mp.info.2 | Classification of information |
| spain-ens::mp.info.3 | Electronic signature |
| spain-ens::mp.info.4 | Time stamps |
| spain-ens::mp.info.5 | Document sanitisation |
| spain-ens::mp.info.6 | Backups |
| spain-ens::mp.s.1 | Protection of email |
| spain-ens::mp.s.2 | Protection of web services and applications |
| spain-ens::mp.s.3 | Protection of web browsing |
| spain-ens::mp.s.4 | Protection against denial of service |
Protection: media and software [mp.si, mp.sw] – Spain ENS
| Code | Title |
|---|---|
| spain-ens::mp.si.1 | Marking of information media |
| spain-ens::mp.si.2 | Cryptography on removable media |
| spain-ens::mp.si.3 | Custody of information media |
| spain-ens::mp.si.4 | Transport of information media |
| spain-ens::mp.si.5 | Secure erasure and destruction |
| spain-ens::mp.sw.1 | Secure application development |
| spain-ens::mp.sw.2 | Application acceptance and commissioning |
What is Spain ENS and who does it apply to?
Spain ENS is a compliance framework from Spain with 11 domains and 82 controls. Spain's Esquema Nacional de Seguridad (Real Decreto 311/2022): mandatory security framework for the public sector and private providers serving it. Systems are categorised BÁSICA, MEDIA or ALTA from impact on confidentiality, integrity, traceability, authenticity and availability, and apply the 73 Annex II measures (organisational org, operational op, protection mp) with reinforcements by category or dimension level, recorded in a signed Statement of Applicability, audited every two years and declared (BÁSICA) or certified (MEDIA, ALTA) as conformant. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Spain ENS actually require?
Spain ENS has 82 controls organised across 11 domains. The largest domains are Protection: facilities and personnel [mp.if, mp.per] – Spain ENS (11 controls), Operational: operation [op.exp] – Spain ENS (10 controls), Protection: information and services [mp.info, mp.s] – Spain ENS (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Spain ENS do I already cover?
Spain ENS does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Spain ENS?
Start your Spain ENS compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Spain ENS requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 82 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required