Technical implementation of the ENS in Tenerife

Yes. Article 2 of RD 311/2022 establishes that the ENS applies to public sector entities and to the information systems of suppliers that provide services or solutions to them. The Cabildo de Tenerife, the island's municipalities and the Universidad de La Laguna are all public sector entities subject to the ENS. Their technology contractors — software companies, cloud service providers, system maintenance firms, data processors — must conform to the same level as the Administration they serve. The Canarian special fiscal regime (IGIC instead of VAT) does not modify this obligation: the ENS is national legislation applicable across the entire Spanish territory, including the archipelago.

MAGERIT is the Methodology for the Analysis and Management of Information System Risks, developed by the former Ministry of Public Administration and maintained by the CCN. RD 311/2022 does not explicitly mandate MAGERIT, but the CCN-STIC 803 guide (System Valuation under the ENS) establishes MAGERIT as the official reference methodology for risk analysis and system categorisation. The PILAR tool, developed by the CCN, implements MAGERIT in automated form and generates risk reports in the format that ENAC-accredited conformity auditors expect. Using MAGERIT and PILAR is not a legal obligation, but it is the path that guarantees traceability, reproducibility and acceptance in the certification process.

For basic-category systems, the organisation may self-assess its ENS compliance and issue its own conformity declaration, following the CCN-STIC 809 procedure. No external third party is required: responsibility lies with the organisation itself. For medium or high-category systems, conformity must be certified by an inspection body accredited by ENAC under UNE-EN ISO/IEC 17065. Summum Sistemas does not issue any conformity certificate — that is the exclusive competence of ENAC-accredited bodies; our role is to prepare systems so they pass that process with the technical evidence fully in order.

Yes, and increasingly so. The op.nub family of Annex II governs security requirements when systems within scope use third-party infrastructure, platform or software as a service. For a supplier serving a SaaS application to the Cabildo de Tenerife or the Universidad de La Laguna with that application hosted on a cloud provider, op.nub requires documenting the shared responsibility model, verifying tenant-applicable controls and ensuring the cloud provider holds the certifications or security reports — such as the CCN's ENS for cloud providers — that allow trust in the chain of custody. Summum Sistemas reviews and documents this aspect as part of the technical implementation.

It depends on the system category, prior technical maturity and the number of systems within scope. For a supplier with basic-category systems and partially implemented security practices, technical implementation can be completed in three to five months. For medium category, with more complex systems and no previously documented hardening, the typical timeframe is six to twelve months, covering MAGERIT/PILAR analysis, technical measure implementation and evidence package compilation. In all cases, coordination with Summum Calidad on the documentary plane is done in parallel, without extending the overall timeline.

The IGIC (Impuesto General Indirecto Canario) regime applies to companies established in the Canary Islands providing services in the archipelago. In contracts between a Canarian technology company and a Canarian public body (Cabildo, municipality, ULL), invoicing is governed by IGIC rules, not mainland VAT. This affects the taxation of the technical ENS implementation services provided by Summum Sistemas in Tenerife, but does not modify either the content of the ENS requirements or the conformity timeline. RD 311/2022 applies throughout the national territory regardless of the regional fiscal regime.