The National Security Framework (ENS), regulated by Royal Decree 311/2022, establishes the security policy for the use of electronic means by Spanish public sector entities and their technology providers.
Security levels
ENS classifies systems into three categories (Basic, Medium, High) based on the impact a security incident would have on the organization’s functions and the services it provides.
Security measures
The framework includes 75 measures organized across three frameworks: Organizational Framework, Operational Framework and Protection Measures. Their application depends on the level assigned to the system.
Who does it apply to?
Spanish public administrations (national, regional, local) and private companies that provide services to the administration or process public data.
ermine and ENS
ermine includes the complete ENS template with all 75 measures, enables system categorization and generates the Adequacy Plan and Conformity Declaration or Certification required by the CCN-CERT.