Templates and records · ENS

ENS risk analysis template

The analysis that justifies the system’s measures and their proportionality, with a degree of formality that rises with the category.

In one sentence

The ENS risk analysis identifies the system’s assets, threats and safeguards to justify that the measures are proportionate; article 14 of Royal Decree 311/2022 requires it to be carried out with an internationally recognised methodology, and measure op.pl.1 calls for an informal analysis in the basic category, semi-formal in medium and formal in high.

Content reviewed on 17 October 2026

Type of information: Mandatory document Art. 14 and measure op.pl.1 of Annex II
Who fills it in: Security officer With the system officer and the information and service owners
When: When the system is designed and periodically Reviewed after significant changes and before each audit
How long it is kept: At least until the next audit The Royal Decree sets no retention period; keeping the versions from each two-year cycle lets you show the auditor how things have moved on between audits.

What the standard requires

What ENS demands and what it leaves to your judgement

Each organisation carries out its own risk management, analysing and treating the risks to its system with an internationally recognised methodology. The measures adopted to mitigate them must be justified and proportionate.

Measure op.pl.1 scales the rigour: an informal analysis is enough in the basic category; medium calls for semi-formal, and high for formal. MAGERIT, the Spanish government’s risk analysis methodology, and the CCN’s PILAR tool are the most widely used references in the public sector.

The analysis is also what determines the additional measures in the statement of applicability and justifies any compensating ones.

Read it in context: Operational framework, in the ENS Academy

Structure

Fields the template should include

Methodology and degree of formality according to category
System assets and their valuation by dimension
Threats identified per asset
Existing safeguards and their effectiveness
Potential risk and residual risk
Decision on residual risk and who makes it
Additional measures proposed for the statement of applicability
Date and version

Example

Example: one risk from a semi-formal analysis

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Methodology	MAGERIT, semi-formal analysis (medium category)
Asset	Appointment booking service
Threat	Impersonation of a council employee to alter appointments (R-04)
Existing safeguards	Username and password with expiry
Risk	Potential high · residual medium with current safeguards
Decision	Not accepted: a second factor is added as an additional measure
Final residual risk	Low · accepted by the security officer
Date	28 January 2026, version 4

At the audit

Mistakes auditors commonly flag

An informal analysis for a medium-category system.
A home-grown methodology with no recognised basis.
The analysis is not used to justify the measures: it goes one way and the statement another.
Residual risk with no explicit acceptance.

In Kimobox

How this record is kept in Kimobox

1The risk analysis is linked to the process map of the information system.
2Each risk is recorded with its asset, its treatment and its owner.
3Versions of the analysis are kept as a versioned record for the audit.

Frequently asked questions

What people ask us before getting started

Is MAGERIT mandatory?

No. The Royal Decree calls for an internationally recognised methodology; MAGERIT qualifies and is the norm in the public sector, but others with an equivalent basis also work, such as the approach set out in ISO/IEC 27005.

Can I use the same analysis for ISO 27001?

Yes, if it meets the criteria of both: risk owners and acceptance criteria for ISO 27001, and the degree of formality required by the category for the ENS.

Keep your ENS records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series