Spain ENS (RD 311/2022)

Esquema Nacional de Seguridad - Spanish national security framework for public-sector systems.


Short name	ENS
Region	Europe
Country or scope	Spain
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ENS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for ENS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ENS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ES-ENS-OPEXP1` Asset Inventory	Systems must maintain an inventory of assets identifying what the system is composed of; a populated software component inventory is the direct SBOM expression (RD 311/2022 Annex II, op.exp.1)	Scan
`ES-ENS-MAINT` Maintenance and Security Updates	Operational measures require ongoing maintenance and application of security updates to system components, demonstrable only when component versions are recorded (RD 311/2022 Annex II, maintenance/updates measure op.exp)	Scan
`ES-ENS-CONFIG` Security Configuration Management	Systems must apply and manage a controlled security configuration; unpinned or vague component versions (latest, wildcards, ranges) are incompatible with a controlled configuration baseline (RD 311/2022 Annex II, configuration measures op.exp)	Scan
`ES-ENS-INTEG` Integrity Protection	Protection measures require safeguarding the integrity of information and system elements; cryptographic hashes over deployed components provide verifiable integrity evidence (RD 311/2022 Annex II, integrity protection measures mp.info/mp.sw)	Scan
`ES-ENS-OPEXT` External Services and Supply Chain	Security must be assured when services or products are contracted from third parties, which requires knowing the supplier behind each component in the system (RD 311/2022 Annex II, external resources measures op.ext)	Scan
`ES-ENS-DOC` Security Documentation	The organizational framework requires approved, maintained security documentation of the system; an identified, timestamped SBOM document contributes to that documentation set (RD 311/2022 Annex II, organizational framework measures org)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ENS-OP.ACC-1`	Access Control Policy (op.acc)
`ENS-OP.EXP-1`	Operational Security Procedures (op.exp)
`ENS-MP.IF-1`	Physical Security of Facilities (mp.if)
`ENS-MP.PER-1`	Personnel Security Measures (mp.per)
`ENS-MP.EQ-1`	Equipment Protection (mp.eq)
`ENS-MP.COM-1`	Communications Protection (mp.com)
`ENS-MP.SI-1`	Secure Storage of Information (mp.si)
`ENS-MP.S-1`	Services Security (mp.s)
`ENS-MP.SW-1`	Software Security (mp.sw)
`ENS-MP.INFO-1`	Information Classification and Handling (mp.info)

Policy templates

Written for ENS:

ENS: Privacy Notice (Spanish Public Administration)
ENS: Data Subject Rights Procedure
ENS: Information Security Policy

And 22 from the standard set, adapted to ENS.