Templates and records · ENS
ENS incident log template
Each incident with its classification, its escalation and, where the impact is significant, the notification the ENS makes mandatory.
In one sentence
The ENS incident log documents detection, classification against defined criteria, escalation, response and, where the impact is significant, notification to the competent CERT; it meets measure op.exp.7 of Annex II, which calls for a comprehensive incident management process, and article 33 of Royal Decree 311/2022, which governs notification.
- Type of information
- Mandatory record Measure op.exp.7 of Annex II and art. 33 of Royal Decree 311/2022
- Who fills it in
- Security officer Coordinates the response and decides on notification; IT carries out containment
- When
- From the moment of detection Notification follows the deadlines set in the CCN guides according to severity
- How long it is kept
- At least until the next audit The Royal Decree sets no retention period; keeping the versions from each two-year cycle lets you show the auditor how things have moved on between audits.
What the standard requires
What ENS demands and what it leaves to your judgement
Measure op.exp.7 calls for a comprehensive process for dealing with incidents, with classification and escalation criteria. If an incident affects personal data, data protection legislation must also be taken into account. Higher levels add reinforcements on notification and response.
Article 33 requires public-sector bodies to report incidents with a significant impact to the CCN, and sets out how private organisations providing services to them do so. Guide CCN-STIC 817 details the classification and severity criteria.
Compared with an ISO/IEC 27001 incident log, the ENS log adds classification according to the CCN guides and the duty to notify; if you run both systems, a single log with those fields serves for both.
Structure
Fields the template should include
- Number, date and time of detection, and source
- System and service affected
- Classification and level of severity and impact
- Escalation: who is informed and when
- Notification to the competent CERT and to client bodies, with date and reference
- Is personal data affected? Decision on notifying the supervisory authority
- Response: containment, eradication, recovery
- Lessons learned and resulting measures
- Closure
Example
Example: denial-of-service attack on the platform
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Number | INC-ENS-2026-03 · 9 June 2026, 18:05 |
| Affected | Appointment booking service · 3-hour outage across 12 local councils |
| Classification | Availability · medium severity according to the reference guide |
| Escalation | 18:15 security officer · 18:30 crisis committee · 19:00 councils notified |
| Notification | Reported to the competent CERT through its notification platform · reference noted |
| Personal data | Not affected: availability only |
| Response | Traffic filtering with the network provider; service restored at 21:10 |
| Lesson | Contract permanent anti-DDoS protection · added to the risk analysis |
At the audit
Mistakes auditors commonly flag
- No written classification or escalation criteria.
- Significant incidents not reported, or no record of the notification.
- Client bodies, which have their own obligations, are not informed.
- Lessons learned never reach the risk analysis or the statement of applicability.
In Kimobox
How this record is kept in Kimobox
- 1Security incidents are classified and reported in line with the ENS, with their timeline and closure.
- 2Security incidents are linked to the system’s nonconformities.
- 3The corrective action is assigned with an owner and a date, with an alert if it slips.
Frequently asked questions
What people ask us before getting started
Who does a private company report to?
Article 33 governs reporting by public-sector bodies to the CCN and by the private organisations serving them through the CERT that corresponds to them. It is also advisable to inform the client body, which usually requires it by contract.
Is it the same as reporting a data breach?
No. A personal data breach is reported to the data protection authority within 72 hours under the GDPR. A single incident may require both notifications, each with its own deadlines.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 27001 information security incident log template
What an information security incident log should record under ISO 27001 controls 5.24 to 5.28: assessment…
Operational framework
The operational framework covers how the system is planned, run, and controlled day to day to maintain…
ENS system categorisation template
How to document a system’s categorisation under ENS Annex I: levels for the five security dimensions, basic…
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series
- Regulation (EU) 2016/679, General Data Protection Regulation EUR-Lex · 27 April 2016