ENS · National Security Framework

Implementation of the National Security Framework

We offer a service that provides not only appropriate consulting to comply with the National Security Framework, but also the possibility of having a support team in each area of action for the subsequent internal implementation and maintenance process.

Phase 1, Differential Analysis
Level of compliance with the ENS
Phase 2, Impact Analysis
Categorization of systems
Phase 3, Security Measures
Organizational, operational and protection framework
Phase 4, Security Audit
Compliance verification
The frame

What is the National Security Framework (ENS)?

Law 11/2007 on Citizens' Electronic Access to Public Services recognizes the right of citizens to interact with Public Administrations using electronic means to exercise the rights provided for in Article 35 of Law 30/1992, of November 26, on the Legal Regime of Public Administrations and the Common Administrative Procedure, as well as to obtain information, make inquiries and allegations, file requests, express consent, initiate claims, make payments, carry out transactions, and oppose administrative resolutions and acts.

Its Article 42.2 establishes the need to create a National Security Framework, which was developed by Royal Decree 3/2010, of January 8 (Official State Gazette of January 29), the main objective of which is to establish security principles and requirements for the use of such electronic means, thus allowing for the adequate protection of information.

Applicability

Scope of Application

The scope of the National Security Framework is that established in Article 2 of Law 11/2007:

Public administrations and entities
To the General State Administration, the Administrations of the Autonomous Communities and the entities that make up the Local Administration, as well as public law entities linked to or dependent on them.
Citizens
To citizens in their dealings with Public Administrations.
Between Administrations
To the relationships between the various Public Administrations.
Scope

Scope of Action

Establish a Security Policy
Identify the different responsible profiles
Classify information and systems
Classify information and systems
Establish a common and homogeneous language in their actions (interoperability between Administrations)
Create a roadmap to plan future budgetary efforts
Our services

How we work

Through interviews and a series of other analyses, the degree of the Organization's compliance with the ENS is verified, in order to establish the correct guidelines for action for its full adaptation.

The phases a project goes through are:

01Gap analysis
Through which minor or major non-conformities are detected, allowing us to identify the gaps between the Organization's current security model and the one proposed by the ENS.

This gap analysis is organized into the following tasks:
  • Analysis of the environment and existing documentation.
  • Determination of the asset inventory.
  • Designation of points of contact by business areas/departments.
  • Meetings and minimum security requirements.
02Impact Analysis and IT Systems Category
After becoming familiar with the environment and conducting the gap analysis, an Impact Analysis process is proposed for each of the services identified within the project scope.
03Security Measures
Once we know the level of compliance with the basic principles and requirements demanded by the ENS, we will be in a position to select the security measures that allow for the achievement of the appropriate level of compliance:
  • Organizational Framework.
  • Operational Framework.
  • Protection Measures.
04Security Audit
Upon reaching this stage, the information systems defined in the project would be ready to be audited to verify proper compliance.
Related Services
ISO 42001 AIMS Implementation ISO 27001 Management Systems PCI DSS Implementation and Certification European Regulation Strategy & CISOaaS Continuity & Resilience

Scope of service

What this service covers

Gap analysis

Assessment of the organization's degree of adaptation to the ENS, detection of minor and major non-conformities.

Asset inventory

Determination and cataloging of all information assets within the scope of the ENS.

Categorization of systems

Impact analysis and classification of information systems into basic, medium, or high categories.

Organizational Framework

Definition of security policies, security regulations, security procedures, and authorization processes.

Operational Framework

Planning, access control, operation, external services, service continuity, and monitoring.

Protective Measures

Protection of facilities and infrastructure, management of personnel, equipment, communications, and information.

Compliance audit

Verification of compliance with basic principles, minimum requirements, and implemented security measures.

Testimonials

What our clients say

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University

As the CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company wants to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility, which is why I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

Frequently Asked Questions

We answer your questions

What is the National Security Framework (ENS)?

The ENS is the Spanish regulatory framework that establishes the security principles and requirements for the use of electronic means in Public Administrations. It was developed by Royal Decree 3/2010 and updated by Royal Decree 311/2022, and its objective is to ensure the adequate protection of information.

Who is required to comply with the ENS?

The ENS is mandatory for the General State Administration, regional administrations, local entities, and public law entities linked to or dependent on them. It also applies to companies and providers that provide technological services or manage information for the public sector.

What are the system categories in the ENS?

Information systems are classified into three categories based on the impact that a security incident would have: basic category, medium category, and high category. Each category determines the security measures that must be implemented within the organizational, operational, and protective frameworks.

How long does the ENS implementation take?

The duration depends on the size of the organization, the complexity of its systems, and its level of security maturity. The process includes four phases: gap analysis, impact analysis and categorization, implementation of security measures, and audit. Internet Security Auditors conducts an initial assessment to estimate timelines.

Can ENS be integrated with ISO 27001?

Yes. The ENS and the ISO 27001 standard share many security controls and objectives. An organization that already has an ISMS compliant with ISO 27001 can leverage much of the work already done to comply with the ENS, and vice versa. Internet Security Auditors has extensive experience in integrating both frameworks.

Contact

Do you need to implement the National Security Framework?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

Offices
Barcelona · Madrid · Bogotá
R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support throughout the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

You have been our indispensable partner for the implementation of GDPR requirements. I would highlight your availability to resolve questions and your ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us