Spanish national security system (ENS)

​For maximum protection of information systems

AENOR is the first company to obtain ENAC accreditation under the new National Security Framework (ENS), in accordance with Royal Decree 311/2022. Since 2013, AENOR has been supporting organisations that comply with the National Security Framework, leading the way in this certification.

What is the National Security Framework (ENS)?

The National Security Framework is a mandatory Law for companies in the public sector and their technology suppliers, which lays down the necessary conditions to guarantee trust in the use of electronic media. To this end, it establishes a series of measures that guarantee the security of the systems, data, communications and electronic services, allowing the exercise of rights and the fulfilment of duties via these media.

The framework establishes the security policy for the use of electronic media and consists of basic principles and minimum requirements that allow an adequate protection of information systems, services and their information.

The ENS is inspired by the family of ISO 27000 standards and, more specifically, by ISO 27001which is why its structure and application responds to the model of PDCA Cycle - Ongoing improvement, considering risk analysis and implementation of measures/controls.

What are the benefits for public and private organisations?

The main advantage of this certification for organisations is that they will have a system in place that is managed and controlled with measures/controls that ensure that information systems are properly protected against internal and external threats and incidents.

About the new version of the ENS...

1. Does the new version of the ENS require the certification body to be accredited by ENAC?
   
   Yes, we are already accredited. For this purpose, a transition plan has been drawn up which means, among other aspects, that our auditors are qualified and trained in ENS 2022, thus enabling AENOR to carry out audits with the new version, being the first organisation to do so under the new version of the ENS
    
2. What is the deadline for adapting to the new National Security Framework?
   
   The transition period defined in Royal Decree 311/2022 - ENS in its single transitional provision is 24 months from the day following the publication date (4 May 2022).
    
3. What is the adaptation plan defined for certification entities?
   
   In accordance with the transition plan established by the CCN in coordination with ENAC, for accrediting entities, our audits can now be performed under the new ENS (Royal Decree 311/2022), although the first certificates cannot not be issued before 1 December 2022, following the criteria established by the framework owner (CCN).
    
4. Which ENS can I certify with from now on?
   
   As AENOR is accredited for the new version of the ENS, companies can be certified with both versions (RD 3/2010 or RD 311/2022). The last version is recommended as RD 3/2010 is officially valid until 5 May 2024 (date subject to modification by the competent body).
   
   
5. I am currently certified with AENOR. Which ENS can I certify with from now on?
   
   Companies that are currently in the process of certification (initial or renewal) will obtain the certification with AENOR in accordance with Royal Decree 3/2010, which will be officially valid until 5 May 2024(*).