The National Security Framework is a Spanish regulation that sets minimum security requirements for systems that manage public-sector information or services. It also applies to companies that work for the public sector. If you sell services to a government agency, you will likely be required to comply with it. At Enthec, we’ll explain what it is, who it affects, and what you need to do.
What is the National Security Plan?
The ENS is the set of principles and minimum requirements for protecting government agencies’ information and electronic services. Royal Decree 311/2022, published in the Official State Gazette (BOE) on May 4, 2022, governs it and replaced Royal Decree 3/2010. The National Cryptology Center (CCN) implements it through its CCN-STIC guidelines.
Who is required to comply with the National Security Framework?
It applies to the entire public sector, as well as to private companies that provide services or solutions to a government agency. This requirement may extend to the suppliers of private companies themselves if a risk analysis warrants it.
You may be interested in: >NIS 2: How does it affect companies, and what steps should be taken to comply with the regulation?
What are the basic principles of the National Security Framework?
Article 5 establishes seven basic principles, which serve as a guide for everything else:
- Security as a Comprehensive Process: people, technology, and organization all at once, without ad hoc fixes.
- Risk-based management: we analyze what could go wrong and review it continuously.
- Prevention, detection, response, and maintenance: prioritize preventing incidents, detecting them, and restoring service.
- Lines of defense: multiple layers, so that if one fails, the others hold up.
- Continuous monitoring: detect anomalous behavior and respond promptly.
- Periodic reassessment: Update the measures as risks change.
- Clarification of Responsibilities.
What are the levels of the National Security Framework?
It has three system categories: basic, medium, and high. To assign a rating, assess an incident’s impact across five dimensions: confidentiality, integrity, traceability, authenticity, and availability.
Each dimension is assigned a level (low, medium, or high), and the system’s final rating is determined by the highest rating across the dimensions. This evaluation is reviewed periodically or whenever the system undergoes a significant change.
| Category | When it is assigned | How compliance is demonstrated |
| Basic | An incident would cause limited harm | Self-assessment and declaration of conformity |
| Media | The damage would be severe | Certification audit |
| High | The damage would be very serious | Certification audit; in the event of serious failures, service may be suspended |
What does compliance with the National Security Framework entail in practice?
It requires a security policy, a risk analysis, and the measures listed in Annex II appropriate for each category. These are the common critical issues identified in audits:
- Security Policy Approved by the company’s highest executive body.
- Distinct roles: The security team cannot report hierarchically to the IT team, except in justified cases.
- Statement of Applicability: the list of measures that apply, signed by the security officer.
- Incident Management: Private providers report incidents to INCIBE-CERT.
- Audit every two years, and an additional audit if the system undergoes substantial changes.
In June 2026, the CCN updated four guides in the 800 series and removed references to the old decree.
How is the continuous monitoring required by the ENS carried out?
Many companies treat the ENS as a test they take every two years, but the decree suggests otherwise. Article 6 excludes one-time actions, and Article 10 emphasizes continuous monitoring and ongoing asset assessment to detect vulnerabilities. Article 8 even calls for reducing the attack surface.
That is, in essence, Continuous Threat Exposure Management. It operates as a five-phase cycle: define, identify, prioritize, validate, and mobilize.
This is where Enthec’s solutions come in. Kartos monitors your company from outside the perimeter. It scans the web, the deep web, and the dark web for leaked information and exposed vulnerabilities—just as an attacker would. Qondar applies the same logic to people: what data about them is circulating and what risk it poses.
Do you want to know what an attacker sees in your company before your next audit?
Frequently Asked Questions About the National Security Framework
Is the ENS mandatory for all companies?
No. It is mandatory for the public sector and for vendors that provide services to it when the contract requires it. If you do not work with government agencies, you are not required to do so, although you may adopt it as a best practice.
What is the difference between a declaration and a certificate of conformity?
A declaration is a self-assessment used for basic-level systems. Certification requires an external audit and is mandatory for intermediate and advanced levels.
How often should a system be audited?
At least every two years. If the system undergoes substantial changes, it also requires an additional audit.
Does compliance with the ENS mean compliance with the GDPR?
No. The ENS protects systems, and the GDPR protects personal data. If your system processes personal data, both apply, and the most stringent measures identified through the risk analysis take precedence.
What happens if I don’t comply with the ENS?
Most likely, you’ll be excluded from the bidding process or lose the contract, because the bid specifications require compliance. If the breach also involves personal data, the GDPR applies. Consult an advisor about your specific situation.
