Complying with the Esquema Nacional de Seguridad (ENS): A Guide for Spain's Public Sector and Its Suppliers

As Spanish public bodies and the private-sector suppliers that serve them face growing pressure to secure the systems behind public services, compliance with the Esquema Nacional de Seguridad has become a core operational requirement, not just a documentation exercise. Regulated by Royal Decree 311/2022, the framework sets out basic principles and minimum requirements that protect information and services across five security dimensions: confidentiality, integrity, traceability, authenticity, and availability. Every system is classified as BÁSICA, MEDIA, or ALTA, and the 73 security measures in Annex II are applied in proportion to that category and its risk.

Organizations must categorize their systems honestly, put the strongest protection where the risk is highest, prove conformity through self-assessment or a certification audit, and keep the ability to detect, investigate, and report incidents. This guide breaks down the framework's essential requirements and shows how ManageEngine AD360 and Log360 help your organization implement, operationalize, and strengthen ENS compliance.

What you’ll learn

• What the ENS covers, who falls within its scope, and why it matters to the Spanish public sector and its suppliers.
• The five security dimensions, and how systems are categorized as BÁSICA, MEDIA, or ALTA based on the impact of an incident.
• How the framework's minimum requirements and Annex II measures — access control, activity logging, monitoring, and incident response — support compliance.
• What proving conformity means in practice, including self-assessment for basic-category systems and a certification audit for medium and high categories.
• How identity governance and security monitoring help strengthen access control and oversight of the systems the framework protects.