Many SMEs ask the same question when a customer or a tender asks for "a security certification": ENS vs ISO 27001? They are not interchangeable. The ENS is a Spanish regulation that binds certain systems, above all those serving the public sector; ISO 27001 is a voluntary international standard that private and international customers tend to ask for. This guide explains when each applies, how they differ, what the certification path looks like, what drives the cost (without figures) and how a managed IT partner helps. Sources verified as at 15 October 2026.
General information, not legal advice. If your obligation comes from a contract or a tender, always read the tender documents and consult your legal adviser. This guide replaces neither the regulation nor the decision of a certification body.
When each one applies
ENS: the Spanish National Security Scheme
Royal Decree 311/2022 (in Spanish) applies to the whole public sector (Art. 2(1)). For the private sector, Art. 2(3) extends it to the information systems of entities that, under a contractual relationship, provide services or solutions to public entities for the exercise of their powers, including the duty to have a security policy. The tender documents of those entities must include the requirements to ensure ENS conformity, such as submitting ENS Declarations or Certifications of Conformity, and the precaution may extend to the contractor's supply chain depending on the risk analysis.
Two important points: the ENS concerns the systems that support the service, not necessarily the whole company, and the system's category (BASIC, MEDIUM or HIGH) determines the measures. The category is set by assessing the impact an incident would have on availability, authenticity, integrity, confidentiality or traceability (Art. 40 and Annex I); it is not chosen for convenience. The 24-month transitional period from entry into force (5-05-2022) for adapting pre-existing systems has already expired (single transitional provision).
Source: BOE, Royal Decree 311/2022. Last verified: 15-10-2026.
ISO/IEC 27001
It is an international standard with requirements for establishing, implementing, maintaining and improving an information security management system. It is not a law: a company adopts it by its own decision or because customers, private tenders, partners or insurers ask for it. ISO does not certify; certification bodies do, and in Spain it is advisable that they are accredited by ENAC (in Spanish). The current edition is ISO/IEC 27001:2022, and the transition from the 2013 edition had to be completed by 31-10-2025 according to the UKAS bulletin; check the ISO page for later amendments.
Last verified: 15-10-2026.
Which to look at first
| Your situation | Start with |
|---|---|
| You sell services or software to a public administration or public entity | ENS (confirm the category and the requirement in the tender) |
| A corporate or international customer asks for a security certification | ISO 27001 (confirm its scope with the customer) |
| Both apply | One common baseline and two scopes |
| You are building a security framework without a contractual requirement | A proportionate security plan; certification is optional |
If in doubt, ask the contracting body or customer in writing which document it will accept. The answer usually settles the question before you spend money on either route.
Main differences
| Aspect | ENS | ISO/IEC 27001 |
|---|---|---|
| Nature | Spanish royal decree | Voluntary international standard |
| Who must comply | Public sector and private suppliers of systems serving it (Art. 2) | Whoever chooses to certify or a customer requires it |
| Scope | Specific information systems | ISMS scope defined by the organisation |
| Levels | BASIC, MEDIUM and HIGH categories (Art. 40) | No categories; rigour follows risk |
| Controls | Annex II measures by category, with a statement of applicability (Art. 28) | Controls justified through the statement of applicability |
| Conformity | BASIC: self-assessment and declaration; MEDIUM and HIGH: certification audit (Art. 38) | Audit by a certification body |
| Review | Audit at least every two years and after substantial changes (Art. 31) | According to the certification body's cycle |
| Publication | Declarations and certifications are published on the electronic portal (Art. 38(2)) | The certificate shows entity, scope, dates and body |
Sources: Royal Decree 311/2022, Arts. 28, 31, 38 and 40; CCN, conformity badges (in Spanish). Last verified: 15-10-2026.
What they share: security policy, risk analysis, statement of applicability, incident management, continuity, supplier management and continual improvement. Much of the work is therefore reusable across both frameworks.
What you cannot assume: that one equals the other. The ENS is not a universal company certification, and ISO 27001 does not replace the ENS declaration or certificate that a tender requires under Art. 2(3). Always check the entity, scope, sites, validity and certification body shown on any certificate, yours or a supplier's.
The certification path
ENS path
According to the CCN (in Spanish), adaptation starts with a plan covering four preliminary phases: security policy, categorisation of systems, risk analysis and a statement of applicability or compliance profile. Then comes implementation (roadmap, regulatory framework, technical measures and management system) and, finally, the declaration or certification of conformity. Certifications are issued by certification entities accredited by ENAC (or, for the public sector, recognised technical audit bodies), whose list the CCN publishes. Art. 30 also allows specific compliance profiles for particular sectors or entities, and the CCN offers the µCeENS methodology, based on a specific compliance profile, to ease certification.
ISO 27001 path
- Context and scope: which processes, sites, systems and suppliers fall within the ISMS.
- Leadership and policy: management commitment, roles and objectives.
- Risks: assessment, treatment and a statement of applicability justifying the chosen controls.
- Implementation: technical and organisational controls, training and evidence.
- Internal verification: internal audit and management review.
- Certification audit by an accredited body, followed by periodic reviews.
What sets the calendar
It depends more on your starting maturity and the scope than on the standard chosen. If you already have a policy, inventory, tested backups, access management and incident records, it is much shorter; if everything must be built from scratch, allow time for a first implementation and for enough evidence of the system operating before the audit.
Common mistakes when choosing
- Certifying the whole company when the contract only requires one service. Limit the scope to the systems involved.
- Assuming a certificate covers your supplier's supplier. The certificate's scope rules; check entity, sites and validity.
- Starting with tools. A firewall or an EDR is not a management system: policy, risks, owners and records are missing.
- Leaving the audit until the end. Without months of evidence of operation, the first audit arrives too early.
Costs: what drives them (no figures)
Every case is different and we do not give prices here. The factors that weigh most are:
- Scope: number of systems, sites, people and suppliers included.
- Category (ENS) or risk level (ISO): more exposure means more measures and more evidence.
- Starting maturity: how many controls and records already exist.
- Internal effort: the time of management, IT and business areas often weighs as much as external fees.
- Advice and technical implementation: consulting, tools and system adaptation.
- Certification body: audit duration and review cycle.
- Maintenance: periodic audits, risk reviews and refreshing evidence.
To contain cost: limit the scope to the systems the contract really requires, reuse what you already have, request quotes from several accredited bodies and do not confuse "having tools" with "having a management system".
How a managed IT partner helps
Much of what is audited is operational evidence: patches applied, access reviewed, backups restored, incidents logged. A managed service provider can help on three fronts:
- Diagnosis: gap analysis against the ENS or ISO 27001 and a proposed scope.
- Technical controls: MFA, immutable backups, endpoint protection, patch management and segmentation, with records that feed the audits.
- Training: awareness for staff and for those who run the systems, with records of the training delivered.
Evidence usually requested on either path: an approved policy, asset inventory, risk analysis and statement of applicability, access-review records, backup restore tests, an incident log, completed training and a supplier list. Having them in order before the audit reduces last-minute work.
What Impulso Tecnológico does not do: it does not certify or issue declarations of conformity, which belong to accredited bodies or to the organisation itself; it does not guarantee that an audit will be passed; it does not give legal advice; and we recommend that the certification body be independent of whoever advises you. See our cybersecurity service, our public-sector cybersecurity solution, the public sector page and the glossary definitions of ENS and ISO 27001.
If your company may also fall within NIS2, read our guide to NIS2 for SMEs in Spain: ENS or ISO help, but they do not replace it. To discuss your case, talk to us.
Sources and verification date
All consulted on 15-10-2026: Royal Decree 311/2022 (BOE) · ENS conformity ITS (BOE) · CCN, adaptation process · CCN, conformity badges · CCN, µCeENS · CCN, certification entities · ISO, ISO/IEC 27001 page · UKAS, transition to ISO/IEC 27001:2022 · ENAC, management-system certification.