1. The requirement arrives through procurement, not through IT

Foreign companies bidding for Spanish public contracts are usually well prepared on the commercial side and caught out on the security side. The security obligations are not a separate process you can address later: they sit inside the tender documents, they carry exclusion criteria, and they are verified before award.

This article is the map. Not legal advice, and not a substitute for reading the specific tender, but the set of requirements that recur and the order in which they bite.

2. The ENS, and why it reaches you

The Esquema Nacional de Seguridad, governed by Royal Decree 311/2022, binds the Spanish public sector. It also reaches the private organisations that supply that sector, when the service affects the systems in scope.

In practice this means a tender may require you to evidence ENS conformity at a stated category, and to do so at the moment of bidding rather than after award. The two routes to that evidence differ sharply:

• BASIC category: a declaration of conformity you issue yourself.
• MEDIUM or HIGH: a certification of conformity, issued after audit by an accredited body.

Neither is obtainable in the few weeks a tender window usually allows. This is the single most common reason a technically strong bid is excluded.

3. Data protection, and the trap inside it

The GDPR applies, and Spain layers its own Organic Law 3/2018 on top. Two points that catch foreign bidders:

• The data processing agreement is not boilerplate here. Public bodies use specific clauses, and the tender often fixes the wording. Your standard template will likely need to be replaced, not negotiated.
• Sub-processors and transfers must be declared up front, including where your support team sits. A perfectly lawful arrangement can still fail a tender requirement that restricts processing locations.

Note that ENS conformity and GDPR compliance are different obligations. Satisfying one does not satisfy the other, and tenders frequently require both.

4. Where the data lives, and where support sits

Many tenders impose requirements on data location and on who can access systems from where. This is separate from the GDPR question: it is a contractual condition.

If your architecture is a single global region and your support follows the sun, expect this to need work. The realistic options are a regional deployment, a contractual restriction on administrative access, or both. Whichever you choose, it has to be documented and it has to be true, because it will be audited.

5. Certifications: what is asked for and what is accepted

Recurring requests:

• ENS conformity, as above. Not substitutable.
• ISO/IEC 27001, very frequently. It is genuinely useful groundwork for the ENS, but it is not equivalent to it.
• ISO 22301 for continuity, in critical services.
• Sector-specific schemes where the contract touches regulated activity.

An important practical detail: the certificate must cover the scope that is actually providing the service. A group-level certificate that excludes the subsidiary doing the work is a finding, not a credential.

6. NIS2 and where it overlaps

The NIS2 Directive adds obligations for entities in scope, and Spanish transposition brings supply-chain expectations with it. For a supplier, the practical effect is that your customer’s own obligations flow down to you through contract: incident notification windows, security requirements on the service you provide, and evidence that you meet them.

The overlap with the ENS is substantial but not complete. Treat them as two sets of requirements with a shared core rather than as one thing.

7. Incident notification: the clause people sign without reading

Contracts with Spanish public bodies typically impose short notification deadlines for security incidents, often shorter than what your internal process currently guarantees, and they specify who must be notified and in what form.

Before signing, check three things: that your detection capability can actually meet the window, that you know the notification route, and that your own providers are contractually bound to tell you fast enough for you to comply. A notification obligation you cannot meet is a breach waiting for an incident.

8. A realistic preparation timeline

If you intend to bid for Spanish public contracts and you are starting from a normal corporate security posture:

• Months 1–2: define the scope of the service, categorise it under the ENS, run a gap assessment. This tells you the real size of the job.
• Months 2–6: remediation. Organisational framework, procedures, technical controls, and — the part that cannot be compressed — accumulating evidence that controls operate.
• Months 6–9: conformity audit if your category requires certification, plus corrective actions.

The uncomfortable conclusion: this work has to start before the tender you want exists. Companies that win Spanish public contracts consistently are the ones that prepared for a pipeline, not for a specific bid.

9. What to do if the tender is already open

It happens, and it is not always hopeless. Three honest options:

1. Read the requirement precisely. Some tenders accept a formally approved compliance plan with committed dates rather than completed conformity. Others do not. The distinction is in the wording.
2. Bid in consortium with a partner that already holds what is required, with a clear division of responsibility.
3. Skip this one and prepare properly. Unglamorous, and frequently the right call, because the next tender is usually months away and the preparation is reusable.

What does not work is bidding on the assumption that the requirement will be waived. It is a verification step, not a formality.

More in this series: ENS certification in Spain: who needs it and how to obtain it · ENS security categories: BASIC, MEDIUM and HIGH explained

Do you need to comply with the ENS?

At Jaymon Security we take organisations through the whole ENS process from Spain: system categorisation, risk analysis, gap assessment, remediation and preparation for the conformity audit.

See our ENS compliance service or get in touch to discuss your case.