Templates and records · ENS
ENS self-assessment and declaration of conformity (basic category)
In the basic category no external audit is needed: a documented self-assessment backing the declaration of conformity is enough.
In one sentence
The ENS self-assessment is the documented review, carried out by the staff who administer the system or by someone they delegate, of whether each applicable measure is implemented and subject to review, with its evidence; under article 38.1 of Royal Decree 311/2022, in the basic category it is enough to issue the declaration of conformity, without a certification audit.
- Type of information
- Mandatory record Art. 38.1 and Annex III of Royal Decree 311/2022
- Who fills it in
- Staff who administer the system Or whoever they delegate; the security officer analyses the outcome
- When
- At the same frequency as the audit The general rule in art. 31 is at least every two years and after substantial changes
- How long it is kept
- At least until the next audit The Royal Decree sets no retention period; keeping the versions from each two-year cycle lets you show the auditor how things have moved on between audits.
What the standard requires
What ENS demands and what it leaves to your judgement
Basic-category systems only need a self-assessment to declare conformity, although they may opt for a certification audit. The self-assessment is carried out by the staff who administer the system or by whoever they delegate, and must be documented, stating whether each measure is implemented and subject to regular review, with the supporting evidence.
The security officer analyses the outcome and passes the conclusions to the system officer so that corrective measures can be taken. Once the self-assessment is favourable, the declaration of conformity is issued under the terms of the Technical Security Instruction on conformity.
Being internal does not make it informal: a tender that asks for “ENS basic conformity” expects to see the declaration and, if requested, the self-assessment behind it.
Structure
Fields the template should include
- System, basic category and scope
- Who carries out the self-assessment, and dates
- Measure by measure: implemented yes or no, subject to regular review
- Evidence for each measure
- Deficiencies and corrective measures with deadlines
- Security officer’s analysis and conclusions
- Declaration of conformity: date and signatory
Example
Example: self-assessment of a web forms service
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| System | Forms service for an association of municipalities (fictitious) · basic category |
| Carried out by | Systems technician, delegated by the system officer · 2 to 6 March 2026 |
| Measures reviewed | 41 applicable · 38 implemented with evidence |
| Deficiencies | Equipment use regulations with no read receipts; inventory not reviewed since 2025; no restore test in the past year |
| Corrective measures | All three closed before 30 April |
| Analysis | Security officer, 8 May: conformity following the corrections |
| Declaration | Issued on 12 May 2026 |
At the audit
Mistakes auditors commonly flag
- A declaration of conformity with no documented self-assessment behind it.
- Measures marked as implemented without evidence.
- The self-assessment is carried out by the security officer, who then analyses it.
- The self-assessment route is used for a system that, properly categorised, would be medium category.
In Kimobox
How this record is kept in Kimobox
- 1The declaration and the compliance evidence are always ready for the two-year cycle.
- 2Each measure is linked to its evidence in the document manager.
- 3Deficiencies are recorded as nonconformities with their action plan, and the declaration is kept as a controlled document.
Frequently asked questions
What people ask us before getting started
Can a basic-category system be certified?
Yes. Article 38.1 allows it to undergo a certification audit even though this is not mandatory. Some public contracts require it, in which case a self-assessment is not enough.
Who signs the declaration of conformity?
The organisation responsible for the system, under the terms of the Technical Security Instruction on conformity. What must not be missing is the security officer’s prior analysis.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Audit and conformity certification
Medium- and high-category systems require a periodic audit that verifies compliance with the ENS.
ENS system categorisation template
How to document a system’s categorisation under ENS Annex I: levels for the five security dimensions, basic…
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
ENS risk analysis template
How to document an ENS risk analysis: recognised methodology, assets, threats, safeguards and residual risk…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series