Spain Royal Decree 311/2022 — National Security Scheme (ENS)

Why does it matter?

The ENS is the law that decides whether a Spanish public body, or a company selling it software, cloud or managed services, may operate a system at all: Article 2(3) extends the decree to private contractors, requires them to hold the Article 12 security policy and tells public buyers to write the Declarations or Certifications of Conformity into their tender specifications, and to look down the supply chain where the risk analysis requires it. Conformity is public (Article 38(2)) and periodically re-audited, and for ALTA systems Article 31(6) lets the system owner suspend operation after a bad audit. For data protection the decree is also the security standard the LOPDGDD's first additional provision assigns to public-sector processing, with Article 3 requiring the GDPR risk analysis and impact assessment alongside it.

Key benefits include:

• One categorization method

Annex I rates five dimensions, confidentiality, integrity, traceability, authenticity and availability, at BAJO, MEDIO or ALTO and derives the system category BÁSICA, MEDIA or ALTA, re-evaluated at least annually.

• A fixed, proportionate catalog

Annex II's 73 measures in the organizational, operational and protection groups apply by category or dimension level, with reinforcements, compensating measures and sector compliance profiles (Article 30).

• Named roles and a signed statement

Article 11 separates the information, service, security and system owners; the security officer signs the Declaration of Applicability under Article 28(2).

• A two-year audit cycle

Article 31 requires an ordinary audit at least every two years, and an extraordinary one after substantial changes, against the Technical Security Instruction on auditing.

• Published, certified conformity

Article 38 requires a Declaration of Conformity for BÁSICA systems and a Certification of Conformity for MEDIA and ALTA, from bodies accredited by ENAC, published on the entity's portal.

How does it work?

Chapter II (Articles 5 to 11) sets the basic principles: security as an integral process, risk-based management, prevention, detection, response and conservation, lines of defense, continuous surveillance and periodic reevaluation, and differentiation of responsibilities between the owners of information, services, security and the system. Chapter III (Articles 12 to 27) sets the minimum requirements. Article 12 requires a formally approved security policy stating the organization's objectives, regulatory framework, security roles and their appointment, the security committee, the documentation structure and the risks from personal data processing; the remaining articles require organization of the security process, risk analysis and management, personnel management, professionalism, access authorization and control, protection of facilities, procurement of security products and services, least privilege, system integrity and updating, protection of stored and in-transit information, prevention toward interconnected systems, activity logging and malware detection, incident management, continuity and continuous improvement.

Article 28 ties the requirements to Annex II: entities adopt the measures and reinforcements indicated there according to the system's assets, its category under Article 40 and Annex I, and the risk decisions taken; the measures are minimums that the security officer may extend, may be replaced by documented compensating measures, and are formalized in the Declaration of Applicability. Annex II groups the 73 measures into the organizational framework [org] (policy, rules, procedures, authorization process), the operational framework [op] (planning, access control, operation, external services, cloud services, continuity, monitoring) and protection measures [mp] (facilities, personnel, equipment, communications, media, software, information, services), each marked as applying by category or by the level of a dimension. Article 30 lets the CCN-STIC guides define specific compliance profiles for sectors or entity types, and Article 29 covers shared infrastructures and services.

Chapter IV covers assurance. Article 31 requires an ordinary security audit at least every two years, extendable by three months for force majeure, and an extraordinary audit after substantial changes, performed by category and compliance profile under the Technical Security Instruction on auditing, with a report on compliance and findings that goes to the system owner and the security officer. Article 32 feeds the national security status report compiled through the CCN; Articles 33 and 34 organize incident response through the CCN-CERT and sector capabilities. Article 38 sets the conformity procedure: BÁSICA systems need only a documented self-assessment for a Declaration of Conformity, MEDIA and ALTA systems need a certification audit, and both are published on the entity's portal or electronic office. The Technical Security Instruction on conformity (Resolution of October 13, 2016) requires certification bodies to be accredited by ENAC under UNE-EN ISO/IEC 17065 and defines the conformity marks.

Key Elements

• Scope (Articles 2 and 3)

The whole public sector under Article 2 of Law 40/2015, systems handling classified information, and private-sector entities that provide services or solutions to public entities under contract; personal data processing also follows the GDPR and the LOPDGDD.

• Security dimensions and categories (Article 40, Annex I)

Confidentiality, integrity, traceability, authenticity and availability rated BAJO, MEDIO or ALTO per information and service; the system takes the highest level, giving category BÁSICA, MEDIA or ALTA.

• Security policy and roles (Articles 11 to 13)

A policy approved by the competent body, or by the top executive body in a private contractor, naming the security roles, the committee and the documentation structure, with information, service, security and system responsibilities separated.

• Annex II measures and the Declaration of Applicability (Article 28)

73 measures in the org, op and mp groups selected by category and dimension level, extended or compensated as documented, and signed by the security officer.

• Audit and the status report (Articles 31 and 32, Annex III)

A two-yearly audit verifying roles, the annual risk analysis review, the Annex II measures and a documented management system; results consolidated by the CCN into the national report.

• Conformity and transition (Article 38, transitional provision)

Declaration of Conformity for BÁSICA, Certification of Conformity for MEDIA and ALTA by ENAC-accredited bodies, published on the entity's portal; pre-existing systems had until May 5, 2024.

What does it cover?

Under Article 2 the decree applies to the entire public sector as defined by Article 2 of Law 40/2015, including systems that process classified information subject to additional measures, and under Article 2(3) to the information systems of private-sector entities that, under a contract, provide services or solutions to public entities for the exercise of their powers, including the obligation to hold a security policy and to show conformity in procurement; the obligation extends down the contractors' supply chain as the risk analysis requires. Article 2(4) adds the 5G security rules of Royal Decree-law 7/2022 for public bodies deploying 5G, and Article 3 makes systems that process personal data apply the GDPR and the LOPDGDD, with the stricter of the ENS measures and the GDPR risk analysis prevailing.

What are its objectives?

Article 1 states the object: to regulate the Esquema Nacional de Seguridad, made up of the basic principles and minimum requirements needed for adequate protection of the information processed and the services provided by the entities in its scope, so as to secure access, confidentiality, integrity, traceability, authenticity, availability and conservation.

Treat security as an integral, risk-managed process with prevention, detection, response and conservation and several lines of defense (Articles 6 to 9).

Categorize every system by the impact of an incident on its five security dimensions and apply measures proportionate to that category (Article 40, Annexes I and II).

Separate the responsibilities for information, services, security and systems and document them in an approved security policy (Articles 11 and 12).

Verify conformity through self-assessment or certification audits at least every two years and publish the result (Articles 31 and 38).

Keep the scheme current with the legal framework, technology and threats through the CCN's instructions and guides (Article 39 and additional provision two).

Framework in Context

The ENS is Spain's national baseline for public-sector cybersecurity, sitting under the General Administrative Procedure and Public Sector Legal Regime laws (Laws 39/2015 and 40/2015) and carrying the data-security role the LOPDGDD's first additional provision gives it; Article 3 keeps the GDPR's risk analysis and impact assessment in force alongside it. The decree's preamble ties the update to the EU's network and information security directive and regulations, the National Cybersecurity Strategy and the Digitalization Plan for Public Administrations, and the CCN's compliance profiles and the Technical Security Instructions carry it into practice. Certification bodies are accredited by ENAC under ISO/IEC 17065, and the Annex II measures map readily to ISO/IEC 27001 controls, which is why many certified entities run one management system for both.

Common Framework Mappings

Entities map the ENS's Annex II measures to the frameworks below so that one control set serves the ENS audit, ISO/IEC 27001 certification and the GDPR.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1