Technical implementation of the ENS in Burgos

Yes. Article 2 of RD 311/2022 establishes that the ENS applies to the information systems of public-sector entities and to those of private entities that provide services or supply solutions to them. The Ayuntamiento de Burgos and the Universidad de Burgos (UBU) are public-sector entities subject to the ENS. If your company manages data from those bodies, runs software on their infrastructure or provides services in which their systems interact with yours, the ENS applies to you regardless of your company's size or the value of the contract.

PILAR is the risk analysis tool developed by the Centro Criptológico Nacional (CCN) specifically for the ENS. It implements the MAGERIT methodology in a structured way, with catalogues of assets, threats and safeguards aligned with Annex II of RD 311/2022, and generates reports in the format expected by conformity auditors. A spreadsheet-based analysis is not prohibited by the standard, but it increases the risk of methodological inconsistencies and makes it harder to trace the links between threats, risks and applied measures — which can generate observations during an ENAC conformity audit.

INES (Instrumento Nacional de Evaluación de la Seguridad) is the CCN tool that allows organisations to record and verify the implementation status of the Annex II measures of the ENS. It produces a status report that reflects the degree of compliance with each measure, differentiated by level (basic, medium or high), and serves as the documentary basis for the self-assessed declaration of conformity for basic-category systems. For medium or high-category systems, the INES report forms part of the dossier submitted to the ENAC-accredited auditing body.

The requirement varies according to the type of service and the conditions of each tender. The Diputación de Burgos, as an administration subject to the ENS, must ensure that its technology suppliers also comply with the framework. In practice, contracts for ICT services, software development, system hosting and data processing for the Diputación increasingly include clauses requiring the supplier's ENS accreditation. Not holding that accreditation can disqualify a bid at the technical solvency stage or generate contractual breaches during service delivery.

Annex II of RD 311/2022 organises 75 measures across 16 families and three frameworks (organisational, operational and protective). Not all measures are mandatory at their maximum level for basic-category systems: each measure has a differentiated level of requirement depending on the system category (B/M/H or n/a when not applicable). In practice, a basic-category system must apply the basic level of all measures marked as applicable at that level, which typically amounts to between 40 and 50 active measures depending on the system's scope. The MAGERIT/PILAR risk analysis determines which ones apply in each specific case.

Summum Sistemas is not an ENAC-accredited inspection body and does not issue ENS conformity certificates. Our work is technical and preparatory: we analyse risks using MAGERIT/PILAR, implement the Annex II measures, generate the evidence with INES and prepare the system to pass the conformity audit. The certificate is issued by the ENAC-accredited third party (ISO/IEC 17065) that the company engages. The practical difference is that arriving at that audit with systems technically implemented and the evidence package ready significantly reduces the risk of non-conformities and the overall cost of the process.