In Catalonia, a large part of access to the public sector is not decided contract by contract, but through prior framework qualification: the Consorci de Serveis Universitaris de Catalunya maintains a framework agreement qualifying providers of services related to ENS, ISO 27001 and GDPR compliance, and the Diputació de Barcelona tenders its own consultancy and support service for ENS compliance for its Direcció de Serveis de Tecnologies i Sistemes Corporatius. For a technology company, that changes the order of things: conformity stops being a formality after winning the contract and becomes a condition of entry. Article 2.3 of RD 311/2022 confirms this directly: it applies to the systems of private entities that, under a contractual relationship, provide services or supply solutions to the public sector for the exercise by these entities of their administrative competences and powers, and the article itself extends that caution to the contractor's supply chain. Summum Sistemas handles the technical side of that compliance.
The Barcelona metropolitan area concentrates an unusually high density of public buyers: the Generalitat de Catalunya and its departments, the Diputació de Barcelona, l'Ajuntament de Barcelona, l'Àrea Metropolitana de Barcelona, the consells comarcals, the public universities and the Consorci d'Administració Oberta de Catalunya (AOC), which provides shared e-government services to Catalan administrations. All are public-sector entities within the meaning of Article 2.1 of RD 311/2022, which refers to Article 2 of Law 40/2015. And all of them procure technology. The fact worth keeping in mind is that the Consorci AOC announced on 15 April 2024 the ENS conformity certification in high category of its DESA'L service, the document repository: when the service you depend on is certified in high category, the requirements that reach you by contract are not those of a basic category. The AOC does not publish the validity window of that certificate, so it is worth confirming its current status before relying on it.
Tender specifications are the mechanism through which the regulation reaches the contract. Article 2.3 of RD 311/2022 requires the administrative or technical specifications of public-sector entities to include «all the requirements needed to ensure ENS conformity of the information systems underpinning the services provided by contractors, such as the presentation of the corresponding ENS Conformity Declarations or Certificates». The same article adds that this caution extends to the contractor's supply chain. In an ecosystem like Barcelona's, where the typical product is SaaS built on third-party infrastructure, the practical consequence is that your own conformity is not enough: you must also be able to demonstrate that of the cloud provider your service relies on, because Annex II includes the op.nub «Cloud services» family and its op.nub.1 control, «Protection of cloud services», which applies from basic category and is reinforced in medium and high.
Article 2.3 also imposes an obligation that is often overlooked and is not a technical one: the private entity must hold the security policy required by Article 12, and where applicable that policy «shall be approved […] by the body holding the highest executive authority». It is not a document the systems manager can simply sign off. From there, Summum Sistemas' work is engineering work: determining the system's category under Annex I by assessing impact across the five dimensions set out in Article 40.2 — availability, authenticity, integrity, confidentiality and traceability — carrying out the risk analysis, and implementing and leaving verifiable the relevant Annex II controls. One point deserves clarifying because it is often repeated wrongly: RD 311/2022 does not name MAGERIT or PILAR in its articles. They are the methodology and tool of the Centro Criptológico Nacional, maintained by the Centro Criptológico Nacional itself, and we use them because they are the de facto reference in the public sector, not because the regulation imposes them.
Before touching a server, we define which systems fall in scope: which services you provide or want to provide to the Generalitat, the Diputació de Barcelona, l'Ajuntament, the AMB, the consells comarcals or the public universities, which qualification framework agreements affect you and what their specifications require. From that come the two things that condition everything else: the technical perimeter and the likely category.
We determine the system's category — basic, medium or high — by assessing the impact of an incident across the five dimensions of Article 40.2. On that basis we carry out the risk analysis with MAGERIT modelled in PILAR, the CCN's methodology and tool. The result is traceable: assets, threats, safeguards and residual risk, with treatment decisions documented.
We implement the technical controls appropriate to the category. For a Catalan SaaS provider, the weight usually falls on op.nub (protection of cloud services), op.ext (external services, including supply-chain protection) and mp.com, where we apply the algorithms and versions of CCN-STIC-807 — TLS 1.2 as a minimum, AES-256, SHA-256 or higher — and the segmentation guidance of CCN-STIC-811.
We leave the evidence package ready for review. The route depends on the category: Article 38.1 establishes that basic-category systems only require a self-assessment for their declaration of conformity — without prejudice to also undergoing a certification audit — while medium- or high-category systems require an audit for certification. The requirements applicable to certification bodies are set out in the Security Technical Instruction referred to in that same article.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Technical review of specifications and framework agreements
Review of the security clauses in the tenders and framework agreements that affect you in Catalonia, translated into concrete Annex II requirements and the conformity route they require: self-assessed declaration or certification by audit.
Categorisation report under Annex I
Justification of the assigned category with the impact assessment across the five dimensions of Article 40.2, documented so it holds up to review by both an auditor and the contracting administration.
MAGERIT risk analysis modelled in PILAR
Inventory and assessment of assets, threats and safeguards with MAGERIT and PILAR, the CCN's methodology and tool, with a residual-risk report and documented acceptance criteria.
Cloud layer (op.nub) and supply-chain (op.ext) compliance
Verification of the cloud provider's fit with op.nub.1 and of the inherited contractual conditions, plus treatment of op.ext.3 (supply-chain protection), which is where most SaaS providers' files fall down.
Hardening, cryptography and interconnection
System and service hardening, cryptographic configuration in accordance with CCN-STIC-807 and zone and interconnection design in accordance with CCN-STIC-811, including the DMZ that guide recommends in medium and high categories.
Article 12 security policy and evidence package
Preparation of the security policy required of the private entity by Article 2.3 — noting that it must be approved by the body holding the highest executive authority — and of the technical evidence package: configurations, logs, vulnerability-analysis results and test records.
The technical implementation carried out by Summum Sistemas is backed by the management layer provided by Summum Calidad: security policy, statement of applicability and fit with ISO 27001. In a Catalan file, where the qualification framework agreement usually asks for both at once, having both layers prepared in a coordinated way avoids the classic rework of documentation that does not describe the system actually implemented.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side of the ENS in Barcelona: categorisation, Statement of Applicability, security policy and integration with ISO 27001 for suppliers of the Generalitat and Barcelona's public entities. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →No. These are different things and should not be confused. Qualification under a framework agreement authorises you to provide certain services to the entities that have signed up to it; ENS conformity relates to your own information systems. Article 2.3 of RD 311/2022 applies the ENS to the systems of private entities that provide services or supply solutions to the public sector for the exercise by these entities of their administrative competences and powers, under a contractual relationship and regardless of the procurement instrument used to reach that contract.
It does not stop you on its own, but it does bring requirements that need to be explicitly resolved. Annex II of RD 311/2022 includes the op.nub «Cloud services» family, whose op.nub.1 control, «Protection of cloud services», applies from basic category and is reinforced in medium and high. In addition, Article 2.3 extends the conformity requirement to the contractor's supply chain. In practice you need to demonstrate how those controls are covered on the contracted infrastructure, not only on your own code.
It means that the document repository used by many Catalan administrations has passed a certification audit at the ENS's most demanding category. For a provider, the relevant fact is what it drags with it: when your service integrates with a system certified in high category, or handles the information that system holds, the requirements that reach you by contract will look more like those of that category than a basic one, even if your own isolated system could be categorised lower.
Article 2.3 of RD 311/2022 is explicit: private-sector entities within its scope must hold the security policy referred to in Article 12, and it «shall be approved, in the case of these entities, by the body holding the highest executive authority». It is not enough for the systems manager to sign it: the governing body has to approve it.
It depends on the system's category, and Article 38.1 of RD 311/2022 sets it out: medium- or high-category systems require an audit for certification of their conformity, while basic-category systems only require a self-assessment for their declaration of conformity — without prejudice to also undergoing a certification audit if it is commercially useful to do so. The requirements applicable to certification bodies are set out in the Security Technical Instruction provided for in that same article.
No. Summum Sistemas handles the technical side: categorisation, risk analysis, implementation of Annex II controls and preparation of the evidence package. Certification is issued by a third party, and Article 38.1 refers to the corresponding Security Technical Instruction for the requirements applicable to certification bodies. Our job is to get the system to that audit genuinely implemented, with the evidence in order.