A public agency is asking us to comply with ENS — what is it and how do you get certified in Spain?

If the tender doesn't specify the tier, request an official clarification (aclaración) via the procurement portal right away. If they say basic, you don't have to pay an external auditor a single cent—just fill out the standard checklist on the CCN platform and register your system. Send the question without wasting time.

We bid on a 110,000 EUR public tender in Valencia last year. They asked us for ENS Medio. We already had our ISO 27001 foundation in place, but closing the gaps and passing the audit still took a solid 3 months. We paid 8,500 EUR for the accredited audit and another 4,000 EUR for consulting support.

On the technical side, the biggest divergence from ISO comes down to the CCN-STIC guides. For data encryption algorithms, you can only use standards approved by the Spanish National Cryptologic Centre, you must integrate your incident reporting mechanism with the government reporting platform, and MFA is mandatory for all system administrators.

Whatever you do, don't fall into the trap of thinking "we have an ISO certificate, we'll just attach that and the agency will accept it." In public tenders, bids lacking the proper ENS certificate or declaration are disqualified outright during the administrative screening—they won't even open your technical envelope.

Here is the roadmap you should follow: 1) Get written clarification on the ENS tier from the contracting authority. 2) Download the CCN-STIC 800 series guides and run a gap analysis against your existing ISO setup. 3) If basic, draft an internal declaration; if intermediate, start collecting quotes immediately from ENAC-accredited bodies.

spanish bureaucracy is super rigid on this stuff unfortunately. we narrowly saved a similar municipal contract with a basic tier self-declaration, otherwise an external audit wouldnt have made the deadline in time.

It's worth noting that the updated Royal Decree issued in 2022 restructured ENS requirements for cloud providers. Verifying that the cloud provider hosting your infrastructure already holds an ENS certification will significantly streamline your audit process.

The discussion got scattered, let me summarize. Having backups accessible on the same network and with the same identity makes them part of the target.

If you have questions, write them; I'll answer as best I can.

Let me summarize the topic, since several different answers were given. Mistakes made on the national security scheme side are usually reversible but expensive.

Hope this helps.

I agree.

There are three things to check when doing this. Mistakes made on the national security scheme side are usually reversible but expensive.

I'm also curious if anyone does it differently.

Following. If 2FA is on, a stolen password alone is useless.

I'll try it. Don't hesitate to ask; those who don't ask always pay more.

If you don't write this down from the start, it leads to arguments later. I'm also curious if anyone does it differently.

Noted, thanks.

its rare to find an explanation this clear and like when you try to change everything at once nothing settles.

im also curious if anyone does it differently.

I've been dealing with this for a long time. Your time to detect an issue directly determines its cost.

If you have questions write them; I'll answer as best I can.

This approach has a cost, which isn't discussed. Mistakes made on the national security scheme side are usually reversible but expensive.

If you don't write this down from the start, it leads to arguments later. Good luck with that.

My question might sound amateurish, sorry about that. Solutions that work at a small scale collapse when you grow; I learned this late.

This is my opinion, I'm not claiming it's absolute truth.