The Spanish National Security Framework (ENS), governed by Royal Decree 311/2022, binds the entire public sector and, with it, the private companies that supply it. If your organisation sells to a public administration, a university or a public body, the ENS has stopped being your client’s problem and become your requirement.
It starts with the category, and almost nobody reasons it properly
Basic, medium or high. The category is set by assessing systems across the five security dimensions — availability, authenticity, integrity, confidentiality and traceability — and everything else follows from it: how many measures apply, how much it costs and how conformity is evidenced.
Basic category: evidenced through a declaration of conformity.
Medium and high categories: require certification issued by an accredited certification body.
An inflated assessment costs you money for years. An understated one gets you excluded from the tender or fails the audit. It is a technical decision, not a commercial one.
What we do
Phase 1
Gap analysis
We measure the real distance between what the regulation demands and what you have today, control by control. No generic checklists: we review evidence, not statements of intent.
Phase 2
Action plan
Every gap becomes a task with an owner, an effort estimate and a priority based on risk. You decide what comes first knowing what protects you most.
Phase 3
Remediation
We work alongside you through delivery: policies, procedures, technical controls and evidence, until compliance holds up in front of an auditor.
We have run ENS projects for universities and public administrations. We work to the CCN-STIC guidance and hold the CCN certification in ENS and Risk Analysis.
Scope of work
Categorisation of information systems and a reasoned assessment of the five dimensions.
Risk assessment using the required methodology, at the depth the category demands.
Statement of Applicability across the Annex II measures, with justified decisions.
Organisational framework: security policy, standards, procedures and assignment of the roles the ENS requires — information owner, service owner, security officer and system officer.
Operational and protection measures: access control, operations, external services, continuity, monitoring and protection of facilities, equipment, communications, media, applications, information and services.
Specific compliance profiles where they apply to your type of entity.
Preparation for the certification audit and for the annual INES reporting.
How we work
1
Inventory and categorisation
Which systems and services are in, who owns each one and what category applies. With the assessment argued in writing, which is what you will be asked for.
2
Risk assessment
Run with a recognised methodology and traceable through to the measures that get implemented.
3
Gap analysis against Annex II
Measure by measure, with evidence and compliance level. This is where the real distance to conformity becomes visible.
4
Remediation plan
Prioritised, with owners, effort and budget fit, separating what blocks certification from what can follow.
5
Supported implementation
Documentation, technical control configuration and generation of the evidence the audit will review.
6
Internal audit and certification support
We rehearse the audit before the auditor arrives and stand with you through it.
What you get
Categorisation report with the five-dimension assessment justified.
A complete risk assessment and its report.
Statement of Applicability for Annex II.
Gap analysis measure by measure, with evidence.
Remediation plan, prioritised and budgetable.
The organisational framework documentation set, with ENS roles assigned.
Internal audit report ahead of certification.
Who does the work. The same team that audits, not an account manager. Governance, risk and compliance: CISSP, CISM, ISO 27001 Lead Auditor, ENS and Risk Analysis (CCN), certified DPO, CCSP and CDPP (ISMS Forum) and PMP (PMI). On the technical side: OSCP, CRTO II and eWPTX, ranked in the top 1% of the CCN-CERT Atenea platform. We have run compliance projects for crypto exchanges, universities and public administrations.
Questions we get asked
We are a private company. Does the ENS apply to us?
It applies as soon as you supply a public sector entity that requires conformity from you. More and more tenders ask for it as a technical solvency requirement, and without it you cannot bid.
Do you certify us?
No, and be wary of anyone offering that alongside implementation. ENS certification is issued by an accredited, independent certification body. We prepare you to pass it and stand with you through the audit.
How do the ENS and ISO 27001 relate?
They share philosophy and a good part of the controls, but they are not interchangeable: the ENS is a legal framework with measures fixed by category; ISO is a certifiable management system. If you hold one, much of the work for the other is already done, and we exploit that explicitly.
We already have conformity, but from years ago. Does it stand?
Conformity is not a permanent badge: it has to be maintained, the risk assessment reviewed, INES reporting filed and the certification renewed. If your last review predates Royal Decree 311/2022, there is work to redo.
Know your category before you budget
Half an hour with an auditor to review your systems, guide the categorisation and estimate the real scope of remediation.
Phone: +34 686 250 244 (Mon-Fri, 9:00 to 18:00 CET) · Email: info@jaymonsecurity.com
We reply within 2 working hours.
