Templates and records · ENS

ENS statement of applicability template

The list of Annex II measures applied to the system, with their reinforcements and any compensating measures that replace them, signed by the security officer.

In one sentence

The ENS statement of applicability formalises the Annex II security measures selected for a system according to its category, its assets and the risk analysis, together with any reinforcements and compensating measures used; article 28 of Royal Decree 311/2022 requires it to be signed by the security officer.

Content reviewed on 17 October 2026

Type of information: Mandatory document Art. 28.2 and 28.3 of Royal Decree 311/2022
Who fills it in: Security officer Signs it; the system officers prepare it together with them
When: After categorisation and risk analysis Updated whenever the category, the risks or the measures change
How long it is kept: At least until the next audit The Royal Decree sets no retention period; keeping the versions from each two-year cycle lets you show the auditor how things have moved on between audits.

What the standard requires

What ENS demands and what it leaves to your judgement

The Annex II measures are mandatory minimums, selected according to the system’s category, its assets and risk management decisions. The security officer may add to them. The measures chosen are formalised in the statement of applicability, which the security officer signs.

A measure may be replaced by a compensating one if there is documented justification that it protects against the risk equally well or better; that mapping must appear in the statement itself.

It is not the ISO/IEC 27001 statement of applicability: that one starts from the 93 Annex A controls and is decided by the organisation; this one starts from the Annex II catalogue, whose requirements depend on the category, and is signed by a specific role.

Read it in context: System categorization, in the ENS Academy

Structure

Fields the template should include

System and category
Annex II measure (code and name)
Applies or does not apply, with reason
Reinforcements applied
Compensating measure, if it replaces the original, with justification
Additional measures arising from the risk analysis
Implementation status and evidence
Security officer’s signature and date

Example

Example: four lines from a medium-category statement

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
System	Online appointment platform (fictitious) · medium category
org.1 Security policy	Applies · Implemented · Policy v3 approved in January 2026
op.exp.1 Asset inventory	Applies · Implemented · Inventory held in the management system
mp.if.* Facility protection	Compensating: the system is hosted in a certified provider’s data centre; justified by its certificate and the service agreement
Additional measure	Second factor for all council users, owing to impersonation risk R-04
Signature	Security officer, 10 February 2026

At the audit

Mistakes auditors commonly flag

Measures excluded that the category makes mandatory.
Compensating measures with no documented justification that they protect equally well or better.
A statement not signed by the security officer, or signed by someone who does not hold that role.
The ISO 27001 SoA reused with only the title changed.

In Kimobox

How this record is kept in Kimobox

1Organisational, operational and protection measures are recorded with their owner.
2Each measure is linked to the evidence that demonstrates it in the document manager.
3The statement is a controlled document: who signed it and every earlier version are kept.

Frequently asked questions

What people ask us before getting started

Can Annex II measures be replaced?

Yes, with compensating measures, provided there is documented justification that they protect against the risk equally well or better and the mapping appears in the statement of applicability (art. 28.3).

What is a specific compliance profile?

A set of measures tailored to a type of body or service, published to make alignment easier. If one applies to the system, the selection of measures can be based on it.

Keep your ENS records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series