Spain ENS

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-11-07 Amendment by Royal Decree 1125/2024 to the ENS's second additional provision takes effect
2. 2022-05-05 Royal Decree 311/2022 enters into force; existing systems have 24 months from this date to fully conform (sole transitional provision)

1. 2024-11-05
   Royal Decree 311/2022 (as amended on 5 November 2024) AmendmentCurrent text

   Final provision 2 of Royal Decree 1125/2024 rewrites the second additional provision: the minister for digital transformation and the civil service approves the mandatory technical security instructions, on the CCN's initiative. source

   More

   • Published on 6 November 2024 and in force from 7 November 2024.
2. 2022-05-03
   Royal Decree 311/2022, of 3 May Major version

   The new National Security Framework, published in BOE no. 106 of 4 May 2022 and in force from 5 May 2022; it repealed Royal Decree 3/2010. source

The ENS binds the entire Spanish public sector and reaches private contractors through their public contracts and, where the risk analysis requires it, their supply chain.

Public sector

The whole public sector as defined in Article 2 of Law 40/2015, plus systems that handle classified information (Article 2(1)-(2)). source

Private contractors

Information systems of private entities that provide services or solutions to public sector entities under a contract, including the duty to have a security policy (Article 2(3)). source

Tender documents

Public contracts must include the requirements to ensure ENS conformity, such as declarations or certifications of conformity, extended to the supply chain as needed. source

Categories

Systems are classified in three security categories, BASIC, MEDIUM and HIGH (Article 40 and Annex I), which set the security measures of Annex II that apply. source

MEDIUM and HIGH systems need a certification audit, BASIC systems a self-assessment, and every system an ordinary security audit at least every two years.

Certification or declaration

MEDIUM or HIGH category systems need an audit to certify ENS conformity; BASIC systems need only a self-assessment for a declaration of conformity (Article 38(1)). source

Audit every two years

Systems undergo a regular ordinary audit at least every two years, and an extraordinary one after substantial changes (Article 31(1)). source

Publication

Declarations and certifications of conformity must be published on the entity's website or electronic office (Article 38(2)). source

Incident notification

Public sector entities notify the CCN of incidents with a significant impact on the security of their systems (Article 33(2)). source

The ENS is enforced through audits, published conformity, CCN reporting and public contract terms; for HIGH systems serious audit findings can lead to suspension.

Suspension

For HIGH category systems, the system owner may temporarily suspend processing or services until serious audit deficiencies are fixed (Article 31(6)). source

Audit reports

Audit reports may be requested by each organisation's IT security officials and by the CCN (Article 31(7)). source

State of security report

The CCN collects and consolidates information on the state of security of in-scope systems for a report used by the competent authorities (Article 32). source

1. Law text Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad (BOE, consolidated)
2. Law text Real Decreto 311/2022 - ELI permalink (consolidated)
3. Law text Real Decreto 1125/2024, de 5 de noviembre (BOE)

1. NIS2

   The EU directive on cybersecurity of essential and important entities across sectors, while the ENS covers Spain's public sector and its suppliers.

2. ISO 27001

   The international ISMS standard, certified voluntarily; ENS conformity is a legal requirement for Spanish public sector systems.

3. ANSSI qualifications

   France's ANSSI qualification of security and cloud providers, the nearest French counterpart for suppliers to the state.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Spain ENS (RSS)