Bizkaia has no ordinary-regime diputación provincial: it has a Diputación Foral, with its own competences and structure, and a public IT company — Lantik, S.A.M.P. — that concentrates a large share of the foral territory's information systems. That detail, which looks administrative, decides how you get in: the real technical counterpart for many of the territory's technology contracts is not the department, it is the foral company. And Lantik publishes on its website an ENS conformity certificate — ENS-2018/0011, medium category — alongside its ISO 27001 certificate SI-0007/2011 (checked on 13 August 2026). Lantik does not publish that certificate's validity window, so it is worth confirming its current status before relying on it. When the system you are going to interconnect with has been certified for years, the questions you will face at the technical stage are not generic ones. Summum Sistemas handles that part: the real implementation of the Annex II controls of RD 311/2022 on your systems.
The public sector subject to the ENS around Bilbao has several layers, and it is worth not mixing them up. There is the Gobierno Vasco and its departments; there is the Diputación Foral de Bizkaia, with its own foral regime and its public companies, Lantik among them; there is the Ayuntamiento de Bilbao; there is the Universidad del País Vasco / Euskal Herriko Unibertsitatea; and there is Osakidetza, the Basque health service. All are public-sector entities for the purposes of Article 2.1 of RD 311/2022, which refers to Article 2 of Law 40/2015. What distinguishes them for a supplier is the procurement circuit and who acts as the technical counterpart, not the level of regulatory demand: the ENS is the same in Bilbao as anywhere else in Spain.
The obligation for the private company arises from Article 2.3, and its wording is direct: the royal decree also applies to the information systems of private-sector entities, «including the obligation to hold the security policy referred to in Article 12, when, in accordance with applicable regulations and under a contractual relationship, they provide services or supply solutions to public-sector entities for the exercise by these of their administrative competences and powers». That same article requires tender specifications to include the requirements needed to ensure conformity, «such as the presentation of the corresponding ENS Conformity Declarations or Certificates», and extends that caution to the contractor's supply chain. There is also a date that has already passed: the sole transitional provision gave pre-existing systems — expressly including those of private-sector contractors — twenty-four months to achieve full compliance, counted from entry into force on 5 May 2022.
In a project that is going to interconnect with already-certified foral platforms, the technical weight shifts to two places. The first is access control, the op.acc family of Annex II, because identification and authentication between systems of different organisations is where findings concentrate. The second is op.ext, external services, including op.ext.3, supply-chain protection. On top of that comes interconnection itself: the Centro Criptológico Nacional's CCN-STIC-811 guide recommends a DMZ in medium and high categories and places IDS/IPS as recommended at high category, and CCN-STIC-807 sets the admissible algorithms — TLS 1.2 as the minimum version, AES-256, SHA-256 or higher, with an HSM recommended at high category. Neither guide is the royal decree: they are the CCN's technical development, and are cited as such.
We determine who you are actually signing with and which system you really need to interoperate with: Gobierno Vasco, Diputación Foral de Bizkaia and its public companies, Ayuntamiento de Bilbao, UPV/EHU or Osakidetza. The foral circuit has its own instruments, and the technical requirement that ends up in the contract depends on which of them you go through.
We apply Annex I to set the category — basic, medium or high — assessing impact across the five dimensions of Article 40.2. We carry out the risk analysis with MAGERIT modelled in PILAR, the CCN's methodology and tool; the royal decree does not impose a methodology, but this is the CCN's reference and the one the administration's technical teams recognise.
We implement the op.acc family measures — identification, authentication of external users and of the organisation, remote access — and design interconnection under CCN-STIC-811: zoning, a DMZ where the category advises it, filtering and logging. Cryptographic configuration follows CCN-STIC-807.
We handle op.ext, including supply-chain protection, which is the most underestimated control when the product integrates third-party components. And we close with the evidence package that supports the Article 38 conformity route: self-assessment in basic category, certification audit in medium and high.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Technical reading of the foral tender specification
Translation of the specification's security clauses into concrete Annex II controls and the required conformity route, distinguishing what the regulation asks for from what the contracting body adds.
Categorisation report under Annex I
Impact assessment across availability, authenticity, integrity, confidentiality and traceability, with the justification Article 40.2 requires and the detail broken down by service provided.
MAGERIT risk analysis modelled in PILAR
Carried out with MAGERIT and PILAR: essential and supporting assets, dependencies, threats, safeguards and residual risk, updated at least annually or after significant changes, as the security policy sets.
Access control (op.acc) for federation with foral platforms
Implementation of identification and authentication, privilege management and remote access, with particular attention to authenticating external users and the organisation when there is federation between systems of different entities.
Interconnection and cryptography under CCN-STIC
Zone, DMZ and filtering design under CCN-STIC-811, and cryptographic configuration under CCN-STIC-807: TLS 1.2 as a minimum, AES-256, SHA-256 or higher, and an HSM when the category is high.
Supply chain and evidence package
Treatment of op.ext.3 over the third-party components and services your solution integrates, and compilation of the technical evidence package: configurations, audit logs, vulnerability-analysis results and continuity-test records.
Summum Sistemas handles the technical side and Summum Calidad the management side: security policy, statement of applicability and fit with ISO 27001. In Bizkaia the detail matters because the counterpart has usually had ISO 27001 and the ENS integrated for years, and spots at once when the documentation and the implemented system do not describe the same thing.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side of the ENS in Bilbao: categorisation, Statement of Applicability, security policy and integration with ISO 27001. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →The foral regime changes the competence framework and the procurement circuit, not the Esquema Nacional de Seguridad. RD 311/2022 applies to the whole public sector in the terms of Article 2 of Law 40/2015, and to private entities that provide services or supply solutions to it under a contractual relationship, for the exercise by these of their administrative competences and powers (Article 2.3). The categories, the Annex II controls and the Article 38 conformity routes are the same. What changes in practice is who you negotiate with and which specific systems you have in front of you.
No. The certificate attests to the conformity of that entity's systems, not yours. What does happen is that interconnecting with a certified system usually tightens what is required of you: you will be asked to demonstrate your own conformity and, depending on the category, specific op.acc and interconnection controls. Article 2.3 of the royal decree also extends the requirement to the contractor's supply chain, so third-party components you integrate also enter the conversation.
The sole transitional provision of RD 311/2022 gave pre-existing systems twenty-four months from entry into force — expressly including those of private-sector contractors — to achieve full compliance, and the regulation entered into force on 5 May 2022. The practical effect of not being compliant is less about sanctions than about access: tender specifications must require conformity under Article 2.3, and without it a bid may fall at the technical stage or lead to breaches during execution.
INES (Informe Nacional del Estado de Seguridad, National Security Status Report) is the CCN platform through which the state of security of systems is reported at least once a year. It does not replace the declaration or the certification of conformity. For a company, its usefulness is to organise the data on how far controls have been implemented before exposing yourself to an external review.
Annex II of RD 311/2022 contains 73 controls organised into 16 families and three frameworks: organisational, operational and protection. How many apply to you depends on the system's category and your scope: each control carries a required level by category — from «not applicable» to application with reinforcements, which the annex itself numbers from R1 onwards. That is why the right order is to categorise first and analyse risk afterwards; counting controls before that says nothing useful.
No. We carry out the technical implementation and prepare the system and the evidence. Conformity is determined under the Article 38.1 route — self-assessment in basic category, which may also undergo a certification audit, and a certification audit in medium and high — and the requirements applicable to certification bodies are set out in the Security Technical Instruction provided for in that article.