National Security Framework · Royal Decree 311/2022
Get ENS-ready and bid for the tender
The tender requires ENS conformity and it has a deadline. Almenara organises your system’s category, the measures that apply to you and the statement of applicability (which measures you apply and why), and tells you what is missing before the audit.
Who it applies to
The Spanish public sector and the private companies that provide it with services or solutions. More and more tender specifications require ENS conformity to take part.
- Technology providers to public administrations
- Companies bidding for contracts that include information systems
- Public sector bodies
If this sounds familiar
Without the ENS you can’t bid for the tender.
ENS readiness with the measures, statement of applicability and continuity already modelled, and alongside your consultancy if you already work with one.
What ENS requires
The ENS classifies systems as basic, medium or high category and requires different security measures depending on that category:
- Annex ISystem categorisation
- Assess confidentiality, integrity, traceability, authenticity and availability to determine the basic, medium or high category.
- op.pl.1Risk analysis
- A risk analysis proportionate to the category, usually with the MAGERIT methodology and the PILAR tool.
- Annex IIMeasures and Statement of Applicability
- Select the organisational, operational and protection measures that apply, and justify it in the Statement of Applicability.
- op.extExternal services
- Contracting, service level agreements, day-to-day management and supply chain protection.
- op.contService continuity
- Impact analysis, continuity plan, periodic tests and alternative means.
- op.exp.7Incident management
- Detect, log and manage incidents, and report them to CCN-CERT where required.
Platform · modules
How Almenara helps with ENS
The modules that save you the most work, in order.
- ComplianceCategorisation, risk analysis, Statement of Applicability and tracking of every measure through to the audit.
- Third partiesop.ext measures: suppliers, agreements and supply chain.
- Continuityop.cont measures: impact analysis, continuity plan and tests.
- IncidentsIncident management and reporting in line with CCN guidance.
Framework catalogue
What you prove for ENS counts for the next framework
Every ENS requirement is mapped to Almenara’s common controls, like the rest of the catalogue. When you are asked for another framework or a customer’s questionnaire, you start from what you have already proven.
Service · where to start
Gap analysis against the ENS
We measure where your organisation stands against the measures your category requires and give you a prioritised plan to close the gap. If you work with a consultancy, we do it together with them.
Request a gap analysisRecommended services
- Service · Once
Gap analysis against a framework
We measure where you stand against ISO 27001, the ENS or DORA and what you still need to comply.
- Service · Every year
The annual risk assessment of your security system, with MAGERIT and PILAR when it is for the ENS.
- Service · Once
Five response playbooks for the most likely incidents in your organisation.
Our boundary: Almenara does not issue certificates (accredited certification bodies do) and does not carry out the internal audit of a system it has implemented or manages.
ENS FAQ
- What’s the difference between basic, medium and high category?
- The category depends on the impact an incident would have on the system’s security dimensions. The higher the category, the more Annex II measures apply and the more demanding they are.
- Is the ENS certified?
- At basic category a self-assessment ending in a declaration of conformity is enough; medium and high categories need a certification audit by an accredited body. In no case is it issued by Almenara.
- Does it work if I already use a consultancy?
- Yes. Almenara is the tool and your consultancy can work on it. We also have a programme for partner consultancies.
- Do you do the risk analysis with MAGERIT?
- Yes. The ENS risk analysis can be contracted as an annual service following MAGERIT/PILAR.
Shall we prepare for the ENS together?
We’ll show you what your system would look like in Almenara, with your own data.