Esquema Nacional de Seguridad (ENS): What It Is and Why a Public-Sector Client Asks
If you serve a Spanish public administration, or a company that does, this explains the questionnaire’s origin.
The Esquema Nacional de Seguridad (National Security Framework, ENS) is Spain’s framework for public-sector information systems security, set by Royal Decree 311/2022. It applies to Spanish public bodies and, by contractual extension, to private companies managing systems or services on their behalf.
Systems are classified into one of three categories — BASIC, MEDIUM, HIGH — based on potential impact, with measures organized into organizational, operational, and protection blocks.
Who does this apply to?
Any Spanish public administration and, in practice, any private supplier managing information systems or services for one, regardless of size.
Typical questions
Do you have an approved information security policy?
organizational framework
How are user access grants, changes and removals managed?
operational framework — access control
Evidence you’d need
- Approved security policy
- Access management procedure
Is your customer in the public sector?
Upload the questionnaire — we classify it by control. Detailed ENS measure references will appear once verified against the official text.
Analyze my questionnaire for freeFAQ
Do I need ENS certification to answer the questionnaire?
Not necessarily for the questionnaire itself, though your customer may require it later as a contractual condition.