Technical implementation of the ENS in Palencia for public-sector suppliers

Yes. Article 2 of RD 311/2022 establishes that the ENS applies to the information systems of public-sector entities and to those of their suppliers when such systems are connected to or exchange information with the public sector. Both the Diputación Provincial de Palencia and the Ayuntamiento de Palencia are local entities subject to the ENS, which extends the obligation to their technology suppliers: software companies, system maintenance providers, cloud services contracted by the administration, IT support firms and any other service in which the supplier's systems come into contact with those of the Palencia administration.

MAGERIT (Metodología de Análisis y Gestión de Riesgos de los Sistemas de Información de las Administraciones Públicas) is the official risk analysis methodology for the Spanish public sector, developed by the Higher Council for e-Government Administration. The ENS requires that in-scope information systems have an up-to-date risk analysis as the basis for the proportional selection of Annex II security measures. MAGERIT is the reference methodology for that analysis in the context of the Spanish public administration and its suppliers: it defines the process, the catalogue of typed assets, threats and safeguards, and establishes how to calculate and document risk in a way that is understandable and verifiable by conformity auditors.

The Centro Criptológico Nacional (CCN) makes available to public-sector entities and their suppliers a set of free tools that Summum Sistemas integrates into the implementation process. PILAR is the MAGERIT-based risk modelling and evaluation tool: it allows building the asset inventory, assessing threats, managing the safeguard catalogue and generating risk reports in standard format. INES (Instrumento Nacional de Evaluación de la Seguridad) is the ENS compliance self-assessment tool: it generates a security status report that some administrations, including Palencia public-sector bodies, may request from their suppliers as evidence of the compliance level achieved.

Annex II of RD 311/2022 contains 75 security measures across three frameworks and sixteen families. The number of mandatory measures depends on the system category: basic, medium or high. For a basic-category system, the measures marked [B] are required; for medium, those marked [B] and [M]; for high, all measures marked [B], [M] and [A]. Not all measures carry the same weight in practice: the most critical for technology suppliers are typically those in the operational framework, especially access control (op.acc), system operations (op.exp), service continuity (op.cont) and, where cloud services are used, the cloud services family (op.nub). Summum Sistemas prioritises implementation based on the actual risk profile of each organisation.

For basic-category systems, the conformity route is the self-assessed declaration of conformity: the organisation itself evaluates its system following the CCN-STIC 809 procedure, documents the results and signs the declaration of conformity, which can be registered with the CCN. For medium or high-category systems, conformity must be certified by an inspection body accredited by ENAC under the standard UNE-EN ISO/IEC 17065. Summum Sistemas does not issue any ENS conformity certificate — that is the exclusive competence of ENAC-accredited bodies — but it technically prepares the system to pass the certification process with the best possible guarantees.

It depends on the system category, the size of the organisation and the starting point in terms of technical security. For basic-category systems with a reasonably well-ordered infrastructure, the technical implementation process — MAGERIT analysis, measure configuration and evidence preparation — can be completed in two to four months. For medium category, the typical timeframe is four to eight months. For high category, with complex systems, it may require eight to fourteen months. In all cases, the MAGERIT risk analysis with PILAR is the starting point: without it, it is not possible to correctly size the implementation effort or justify the proportional selection of measures that the ENS requires.