Templates and records · ENS
National Security Framework (ENS) templates and records
Eight documents the ENS requires of a public-sector information system or of anyone providing services to one, each with the article or measure that calls for it, its fields and an example.
In one sentence
Spain’s National Security Framework (ENS) requires you to document the system categorisation under its Annex I, the security policy in article 12, the risk analysis in article 14 and a statement of applicability signed by the security officer (art. 28.2), and to demonstrate compliance with an audit report at least every two years in the medium and high categories, or with a self-assessment in the basic category (arts. 31 and 38).
- Regulation
- Royal Decree 311/2022 Published on 4 May 2022; repeals RD 3/2010
- Statement of applicability
- Signed by the security officer Art. 28.2
- Audit
- At least every two years Plus an extraordinary audit after substantial changes (art. 31.1)
- Conformity
- Certification for medium and high; self-assessment for basic Art. 38.1
Contents
ENS templates and records
The ENS is not organised into clauses: each template cites the article of Royal Decree 311/2022 or the Annex II measure that requires it.
System categorisation
How to document a system’s categorisation under ENS Annex I: levels for the five security dimensions, basic…
ENS statement of applicability
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
ENS risk analysis
How to document an ENS risk analysis: recognised methodology, assets, threats, safeguards and residual risk…
Security policy
What an ENS security policy must contain under article 12: objectives, legal framework, roles, committees…
Authorisations log
How to keep a record of the ENS authorisation process: facilities, equipment, applications, media…
ENS incident log
How to log incidents under the ENS: classification, escalation, reporting to the competent CERT, response…
ENS audit report
What an ENS audit report must include: compliance opinion, findings, methodology, scope and supporting data…
Self-assessment and declaration
How to self-assess a basic-category ENS system and issue the declaration of conformity: who carries it out…
Frequently asked questions
What people ask us before getting started
Which documents are mandatory under the ENS?
At a minimum: the security policy (art. 12 and measure org.1), the security regulations and procedures (org.2 and org.3), the authorisation process (org.4), the system categorisation (Annex I), the risk analysis (art. 14 and op.pl.1), the statement of applicability (art. 28) and the audit or self-assessment report (arts. 31 and 38). Everything else depends on the category and on which measures apply.
Does a private company have to comply with the ENS?
Yes, when it provides services or solutions to public-sector bodies. Tender specifications commonly require certification of conformity in the category of the system that will be used.
Can ISO 27001 documents be reused?
In part. The risk analysis, the asset inventory and the incident log can be shared, but the ENS has its own categorisation, its own catalogue of measures and a statement of applicability signed by the security officer.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series