Templates and records · ENS
ENS security policy template
The document from which all the system’s security hangs: what is protected, why, who is answerable for what and how the rest of the documentation is organised.
In one sentence
The ENS security policy is the document approved by top management that sets out the organisation’s objectives or mission, the regulatory framework, the security roles and their duties, the committee structure, the guidelines for the documentation and the risks arising from processing personal data, which is the minimum content laid down in article 12 of Royal Decree 311/2022.
- Type of information
- Mandatory document Art. 12 and measure org.1 of Annex II, required in every category
- Who fills it in
- Top management or governing body Approves it; the security committee proposes and reviews it
- When
- When aligning with the ENS And at each periodic review or significant organisational change
- How long it is kept
- Current and previous versions Superseded versions show since when the roles were assigned
What the standard requires
What ENS demands and what it leaves to your judgement
It is one of the four organisational framework measures required equally in the basic, medium and high categories. Article 12 sets out what must be included: objectives or mission, regulatory framework, security roles with their duties and responsibilities, structure and membership of the committees, guidelines for structuring the documentation and risks arising from the processing of personal data.
The Royal Decree requires responsibilities to be separated: the security officer must be a different person from the system officer, with no reporting line between them (art. 13.3). Appointing a single person for everything is the most frequent audit finding.
The policy is developed further in the security regulations (org.2) and procedures (org.3); rules and instructions do not belong in the policy.
Structure
Fields the template should include
- Objectives or mission of the organisation
- Applicable regulatory framework
- Security roles: information owner, service owner, security officer and system officer, with their duties
- Security committee: membership and functions
- Guidelines for structuring the security documentation
- Risks arising from the processing of personal data
- Approval: body, date and version
Example
Example: extract from a public-sector supplier’s policy
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Mission | To provide local authorities with an available and reliable online appointment platform |
| Regulatory framework | RD 311/2022, Regulation (EU) 2016/679, Organic Law 3/2018 and the contract with each local council |
| Security officer | Compliance manager, independent of the IT department |
| System officer | Head of infrastructure |
| Security committee | Managing director, security officer, system officer and data protection officer · quarterly meeting |
| Approval | Board of directors of Gestiona Datos Locales (fictitious), 15 January 2026 · v3 |
At the audit
Mistakes auditors commonly flag
- No record of who approved the policy or when.
- Security officer and system officer are the same person or one reports to the other.
- The risks arising from processing personal data are missing.
- The policy includes rules on equipment use that belong in the security regulations.
In Kimobox
How this record is kept in Kimobox
- 1The security policy and regulations are managed as controlled documents.
- 2Regulations are communicated to the staff concerned through the employee portal, with read receipts.
- 3Each version keeps its approval, and earlier ones remain accessible.
Frequently asked questions
What people ask us before getting started
Is the ISO 27001 policy enough?
It can serve as a basis, but it must cover the six items in article 12, including the roles specific to the ENS and the committee structure. The usual approach is a single policy that satisfies both frameworks.
Can an SME have just one person for security?
Separating the security officer from the system officer is the rule. The Royal Decree allows justified exceptions, always with documented compensating measures.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Organizational framework
The organizational framework is the set of four documents that govern the organization's security: the…
ENS system categorisation template
How to document a system’s categorisation under ENS Annex I: levels for the five security dimensions, basic…
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
ENS risk analysis template
How to document an ENS risk analysis: recognised methodology, assets, threats, safeguards and residual risk…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series
- Regulation (EU) 2016/679, General Data Protection Regulation EUR-Lex · 27 April 2016