Templates and records · ENS
ENS system categorisation template
An assessment of the harm an incident would cause in each security dimension, which gives the system its category and, with it, the measures that must be applied.
In one sentence
System categorisation assigns a low, medium or high level to each security dimension —confidentiality, integrity, traceability, authenticity and availability— according to the harm an incident would cause, and from that derives the system’s basic, medium or high category, which matches the highest level, following the procedure in Annex I of Royal Decree 311/2022.
- Type of information
- Mandatory document Art. 40 and Annex I of Royal Decree 311/2022
- Who fills it in
- Information and service owners They value the dimensions; the security officer determines the category
- When
- Before selecting the measures And again whenever the information handled or the services change
- How long it is kept
- At least until the next audit The Royal Decree sets no retention period; keeping the versions from each two-year cycle lets you show the auditor how things have moved on between audits.
What the standard requires
What ENS demands and what it leaves to your judgement
Annex I requires the level of each of the five dimensions to be assessed for every item of information the system handles and every service it provides. A dimension that is not affected gets no level. If the system handles several types of information or provides several services, each dimension takes the highest level among them.
The category follows from the dimension with the highest level: high if any is high, medium if the highest is medium, basic if the highest is low. It is neither an average nor a matter of convenience.
The Royal Decree divides the roles: the information and services are valued by their owners, and the category is determined by the security officer. A record of who valued what is part of the evidence.
Structure
Fields the template should include
- Information system and scope
- Information handled and services provided
- Level of each dimension per information item and per service, with rationale
- Resulting level of each dimension for the system
- System category
- Who values each information item and each service
- Determination of the category by the security officer, with date
Example
Example: online appointment platform for local councils
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| System | Online appointment platform run by Gestiona Datos Locales (fictitious), used by twelve local councils |
| Information | Citizens’ contact details · Confidentiality medium · Integrity low |
| Service | Booking and managing appointments · Availability medium · Traceability low · Authenticity low |
| Rationale for availability | An outage of more than a day forces offices to see people without appointments and overwhelms them, without irreparably affecting anyone’s rights |
| Result | C medium · I low · T low · A low · Av medium |
| Category | Medium |
| Determination | Security officer, 3 February 2026 |
At the audit
Mistakes auditors commonly flag
- A category picked by gut feeling or to lower the bar, with no assessment by dimension.
- No record of who valued the information and the service.
- The system is valued as a whole without separating information from services.
- The categorisation is not reviewed when a new service is added.
In Kimobox
How this record is kept in Kimobox
- 1The valuation of the security dimensions is documented as a versioned record.
- 2The category assigned to the system is recorded with its rationale.
- 3The risk analysis is linked to the process map of the information system.
Frequently asked questions
What people ask us before getting started
Can a system be medium category if almost everything is low?
Yes: a single dimension at medium level is enough to make the system medium category. That is why each valuation should be carefully justified, especially availability.
Who determines the category?
The security officer, based on the valuations made by the information and service owners. The Royal Decree separates these roles so that nobody both values and decides.
Keep your ENS records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
System categorization
The first step of the ENS is categorizing the information system based on the impact a security incident…
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
ENS risk analysis template
How to document an ENS risk analysis: recognised methodology, assets, threats, safeguards and residual risk…
ENS security policy template
What an ENS security policy must contain under article 12: objectives, legal framework, roles, committees…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Royal Decree 311/2022 regulating the National Security Framework (Esquema Nacional de Seguridad) BOE-A-2022-7191 · 4 May 2022
- National Cryptologic Centre — CCN-STIC 800 series guides on the ENS Centro Criptológico Nacional (CCN-CERT) · Current series