National Security Framework (ENS)

Spain’s National Security Framework, known as ENS, establishes security principles and requirements for public-sector systems and for covered entities when they provide services or solutions. System category and scope determine measures, responsibilities and assessment; applying a generic control list is insufficient. Compliance or certification must be checked against the specific entity, system, category, scope and validity. ENS is not a universal company certification and does not guarantee absence of incidents. An organisation should maintain policy, risk analysis, an applicability statement, evidence, supplier management, incident handling and improvement. For an international context, the Spanish ENS should not be presented as an automatic substitute for local law or other applicable frameworks. Applicability must be confirmed from Royal Decree 311/2022 and competent guidance.