Templates and records · ENS
ENS audit report: content and example
The report that, at least every two years, gives an opinion on how far a medium or high-category system complies with the ENS and sets the correction plan in motion.
In one sentence
The ENS audit report gives an opinion on the degree of compliance with Royal Decree 311/2022, identifies findings of compliance and non-compliance and includes the methodology, scope, objective and data on which the conclusions rest; article 31 requires an audit at least every two years and the report to be submitted to the system officer and the security officer.
- Type of information
- Mandatory record Art. 31 and Annex III of Royal Decree 311/2022
- Who fills it in
- Audit body For certification, a body that meets the requirements of the Technical Security Instruction on conformity
- When
- At least every two years And after substantial changes to the system
- How long it is kept
- Every cycle Security officers and the CCN may request the reports (art. 31.7); keeping earlier ones lets you show progress
What the standard requires
What ENS demands and what it leaves to your judgement
Systems undergo an ordinary audit at least every two years, and an extraordinary one after substantial changes, which restart the clock. The two-year period can only be extended by three months for reasons of force majeure.
The report must give an opinion on the degree of compliance, identify findings and include the methodological criteria, scope, objective and the data, facts and observations supporting the conclusions. It is submitted to the system officer and the security officer; the latter analyses the conclusions and passes them to the former so that corrective measures can be taken.
In the medium and high categories, the certification audit can coincide with the ordinary audit. In the high category, where serious deficiencies are found, the system officer may temporarily suspend the service.
Structure
Fields the template should include
- System, category and scope audited
- Objective and type of audit: ordinary, extraordinary, certification
- Criteria and methodology
- Audit team and dates
- Opinion on the degree of compliance
- Findings of compliance and non-compliance by measure
- Data, facts and observations supporting them
- Security officer’s analysis and corrective measures with deadlines
Example
Example: recertification audit in the medium category
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| System | Online appointment platform (fictitious) · medium category |
| Type | Ordinary and certification · 14 to 16 September 2026 |
| Opinion | Compliant with minor nonconformities |
| Finding 1 | op.acc: two former employees’ accounts still active in the admin console · minor nonconformity |
| Finding 2 | org.3: the backup procedure does not reflect the new backup region · minor nonconformity |
| Observation | Good practice in incident management and notification |
| Corrective measures | Access review and procedure update · system officer · 31 October |
At the audit
Mistakes auditors commonly flag
- An audit carried out late after a substantial change that was not treated as such.
- Findings with no correction plan or owner.
- No record of the security officer’s analysis.
- Nonconformities from one audit reappear in the next.
In Kimobox
How this record is kept in Kimobox
- 1The evidence for each security measure is organised in the document manager.
- 2Audit findings are recorded as nonconformities with their action plan.
- 3The declaration or certificate of conformity is kept as a controlled document.
Frequently asked questions
What people ask us before getting started
What counts as a substantial change?
One that significantly affects the category, the scope or the measures: a new service, a change of hosting, a new interconnection. The Royal Decree requires an extraordinary audit after such changes; it is wise to record the reasoning behind deciding whether a change qualifies.
Is an internal audit report valid for certification?
No. Certification of conformity requires a certification body that meets the requirements of the Technical Security Instruction. An internal audit helps you prepare but is no substitute.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Audit and conformity certification
Medium- and high-category systems require a periodic audit that verifies compliance with the ENS.
ENS system categorisation template
How to document a system’s categorisation under ENS Annex I: levels for the five security dimensions, basic…
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
ENS risk analysis template
How to document an ENS risk analysis: recognised methodology, assets, threats, safeguards and residual risk…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series