1. The decision that sets the cost of the whole project

Categorisation is the first step of an ENS project and the one that determines everything after it: which measures apply, how demanding they are, whether you can self-declare or need an external audit, and how many months and euros the whole thing takes.

It is also, in our experience, the step organisations rush. Someone decides the system is “probably medium”, the team starts implementing, and eight months later an auditor asks for the reasoning behind that judgement and there isn’t any.

2. The five dimensions

The ENS does not rate systems directly. It rates the impact of a security breach across five dimensions, and the category follows from that. The dimensions are:

• Confidentiality — the damage if the information were disclosed to someone not authorised to see it.
• Integrity — the damage if the information were altered without authorisation or detection.
• Traceability — the damage if you could not determine who did what, and when.
• Authenticity — the damage if you could not prove that a party is who it claims to be, or that information comes from the source it claims.
• Availability — the damage if the service or the information were unavailable.

Two of these are routinely mishandled by teams coming from an ISO 27001 background, where the classic triad is confidentiality, integrity and availability. Traceability and authenticity are separate dimensions here, and they carry their own measures. Forgetting them is a common source of gaps discovered late.

3. How each dimension is rated

Each dimension is assessed as low, medium or high, according to the impact a breach would cause. The reasoning is about consequences, not about how sophisticated your technology is.

Questions that actually help when rating:

• Would a breach in this dimension cause serious harm to people’s rights? That pushes upwards fast.
• Would it prevent the administration from performing a public function, and for how long?
• Would it cause economic loss, and of what order?
• Would it damage public reputation or trust in a measurable way?
• Is there a legal or regulatory obligation attached to this dimension specifically?

The assessment must be written down with its justification. “Availability: medium” is not a categorisation. “Availability: medium, because an interruption beyond 24 hours would prevent the processing of applications with a statutory deadline, causing harm that is recoverable but significant” is.

4. From dimensions to category

The rule is simple and unforgiving: the system’s category is determined by the highest rating among its dimensions.

• If every dimension is low, the system is BASIC.
• If any dimension reaches medium and none is high, the system is MEDIUM.
• If any single dimension is high, the system is HIGH.

That last line is the one that surprises people. A system whose confidentiality, integrity, traceability and authenticity are all low, but whose availability is high, is a HIGH system, with the full weight of obligations that implies.

5. What changes between the three categories

The practical consequences, in the order they hit a project:

5.1. How conformity is evidenced

This is the largest single difference. BASIC is accredited through a declaration of conformity, which the organisation issues itself. MEDIUM and HIGH require a certification of conformity, issued after an audit by an accredited certification body. The jump from BASIC to MEDIUM is therefore not incremental: it introduces an external party, a formal audit and a recurring cycle.

5.2. Which measures apply and how demanding they are

The measures in Annex II are not simply switched on or off by category. Many apply across all three but with different intensity: a control that at BASIC can be satisfied with a documented procedure may, at HIGH, require automated enforcement, continuous monitoring and retained evidence.

5.3. The documentary burden

It grows faster than the technical burden. At HIGH you are expected to demonstrate not only that controls exist but that they have been operating, reviewed and improved over time.

6. Over-categorising is not the safe option

There is a tempting shortcut: rate everything high, and you can never be accused of under-protecting. It is a bad idea for three reasons.

• It is expensive. You commit to controls, audits and evidence you did not need, permanently.
• It is not more defensible. An auditor can challenge a categorisation for being unjustified in either direction. An unreasoned “high” is still unreasoned.
• It delays you. A HIGH project takes months longer than a MEDIUM one, and tenders have dates.

The opposite error is worse, though: an under-categorised system fails its audit and the remediation happens under time pressure, which is the most expensive way to do anything.

7. Scope: the lever nobody uses

Before arguing about ratings, define what the system is. Organisations routinely put their whole corporate infrastructure in scope when only one service touches the administration.

A well-drawn boundary — with the interfaces, dependencies and excluded elements documented — can be the difference between a nine-month HIGH project across the company and a five-month MEDIUM project on one platform. This is legitimate and expected: the framework asks you to define the system, not to include everything you own.

What it does require is that the boundary be real. If the excluded parts can affect the security of the included ones, the exclusion will not survive the audit.

8. Getting it right the first time

A categorisation that holds up has four components: a precisely defined scope, an inventory of the information and services handled, a rating per dimension with written reasoning tied to consequences, and formal approval by someone with authority to own the risk.

Produce those four and the rest of the project has a foundation. Skip them and every later decision rests on an assumption nobody can defend.

More in this series: ENS certification in Spain: who needs it and how to obtain it · Selling to the Spanish public sector: the security requirements

Do you need to comply with the ENS?

At Jaymon Security we take organisations through the whole ENS process from Spain: system categorisation, risk analysis, gap assessment, remediation and preparation for the conformity audit.

See our ENS compliance service or get in touch to discuss your case.