Madrid is a single-province autonomous community: there is no diputación, and the community itself assumes the competences that would otherwise sit at provincial level. What it does have is a concentration of public buyers hard to match — the Administración General del Estado, the Comunidad de Madrid, the Ayuntamiento, the public universities and the Madrid health service — and one feature worth exploiting: here, ENS conformity status is public and can be checked. The Ayuntamiento de Madrid publishes its conformity certificate through its Centro de Ciberseguridad, and Madrid Digital, the community's digital agency, holds an ENS certificate in medium category — ENS-2024/0013, valid until 7 February 2027 — covering the hosting of its information systems, the Plataforma Electrónica de Expedientes y Procedimientos Administrativos and remote access management to the corporate network (ARCO); its basic-category certificate ENS-2024/0011 did not cover the whole entity, only the «Paso a Producción» (go-live) service for those systems, and it was valid from 7 February 2024 to 7 February 2026. Summum Sistemas prepares the supplier's side: the technical implementation that underpins that conformity.
That certificates are public is not an administrative curiosity: it is a legal requirement and an operational advantage. Article 38.2 of RD 311/2022 requires those responsible for the information systems to publish, on the relevant websites or electronic sites, their ENS conformity declarations and certificates. For a supplier preparing a bid, that means you can know in advance the category the body you will interoperate with is certified at, and therefore anticipate the level of demand coming down into the tender. It is the difference between preparing a generic file and preparing the one that actually fits.
The supplier's obligation comes from Article 2.3, which applies the royal decree to the information systems of private-sector entities — including the obligation to hold the security policy required by Article 12 — when, under a contractual relationship, they provide services or supply solutions to public-sector entities for the exercise by these of their administrative competences and powers. The same article requires tender specifications to include the requirements needed to ensure conformity, expressly mentioning Conformity Declarations or Certificates, and extends that caution to the contractor's supply chain. In a market like Madrid's, where the buyer has its own cybersecurity teams and accumulated audit experience, the technical conversation starts at a higher level than in other territories.
The technical work, as a result, is judged by evidence, not documentation. We determine the category under Annex I, assessing impact across the five dimensions of Article 40.2 — availability, authenticity, integrity, confidentiality and traceability —, we carry out the risk analysis with MAGERIT modelled in PILAR, the methodology and tool of the Centro Criptológico Nacional, and we implement the Annex II controls, which bring together 73 controls across 16 families in three frameworks: organisational, operational and protection. Each control carries its required level by category, with reinforcements the annex itself numbers from R1 onwards. And a nuance that matters when the counterpart knows the subject: neither MAGERIT nor PILAR appears in the articles of RD 311/2022. They are CCN methodology and tool, not a requirement of the regulation; using them is a methodological choice, and it is explained as such.
Before sizing anything, we check the declarations and certificates the administration itself publishes under Article 38.2. Knowing the category of the system you are going to interoperate with is the best predictor of what the tender will require.
We define which of your systems fall in scope and set the category by assessing impact across the five dimensions of Article 40.2. The category determines the required subset of Annex II, the applicable reinforcements and the Article 38 conformity route.
We implement the technical controls leaving the associated evidence in place from day one: configurations, activity logs, vulnerability-analysis results. With a buyer that genuinely audits, evidence produced after the fact shows, and it costs the file credibility.
We prepare the appropriate route under Article 38.1: self-assessment for the declaration of conformity in basic category — which may also undergo a certification audit —, or a certification audit in medium and high. We review the system against Annex III before exposing it to external review.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Analysis of the buyer's published conformity status
Review of the declarations and certificates the receiving administration publishes under Article 38.2, to anticipate category and requirements before sizing the project.
Categorisation report under Annex I
Justification of the category with the impact assessment across the five dimensions of Article 40.2, broken down by service provided.
MAGERIT risk analysis modelled in PILAR
With MAGERIT and PILAR, from the Centro Criptológico Nacional: essential and supporting assets, threats, safeguards and residual risk, updated at least annually or after significant changes.
Annex II implementation with traceable evidence
Access control (op.acc), operation (op.exp), monitoring (op.mon) and communications protection (mp.com), each with its associated evidence and its verification criteria defined in advance.
Cryptography and interconnection under CCN-STIC
Cryptographic configuration under CCN-STIC-807 — TLS 1.2 as the minimum version, AES-256, SHA-256 or higher, HSM at high category — and zone and interconnection design under CCN-STIC-811.
Preparation for external review
Prior review against Annex III, correction of deviations and organisation of the evidence package in the order it will be reviewed, so the audit does not turn into a file hunt.
Summum Sistemas covers the technical side and Summum Calidad the management side: security policy, statement of applicability and fit with ISO 27001. In Madrid the coordination between the two layers is especially noticeable, because the buyer usually has its own cybersecurity team and quickly spots when the document and the system do not tell the same story.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side of the ENS in Madrid: categorisation, Statement of Applicability, security policy and integration with ISO 27001 for suppliers of the Comunidad de Madrid and the Ayuntamiento. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →The Comunidad de Madrid is a single-province community and takes on the competences that in other territories belong to the diputación. The public-buyer map is made up of the Administración General del Estado, the Comunidad de Madrid itself and its bodies, the Ayuntamiento de Madrid and the rest of the town councils, the public universities and the Madrid health service. All are public-sector entities for the purposes of Article 2.1 of RD 311/2022, which refers to Article 2 of Law 40/2015.
Yes, and it is worth doing before preparing your bid. Article 38.2 of RD 311/2022 requires those responsible to publish declarations and certificates of conformity on their websites or electronic sites. The Ayuntamiento de Madrid publishes its conformity certificate through its Centro de Ciberseguridad, and Madrid Digital publishes its own: ENS-2024/0013, in medium category, valid until 7 February 2027, whose scope is the hosting of its information systems, the Plataforma Electrónica de Expedientes y Procedimientos Administrativos and remote access management to the corporate network (ARCO); and ENS-2024/0011, in basic category, limited to the «Paso a Producción» service for those systems, valid from 7 February 2024 to 7 February 2026. It is worth checking the current status when preparing the bid.
There is no automatic rule. Your system's category is determined by the impact an incident would have on the information and services you handle, assessed across the five dimensions of Article 40.2 and following the Annex I procedure. Knowing the buyer's category helps anticipate the conversation and avoid over-engineering, but the categorisation of your system is your own and has to be justified.
No. It is a common misconception worth correcting: neither «MAGERIT» nor «PILAR» appears in the articles of RD 311/2022. They are the risk analysis and management methodology and its associated tool from the Centro Criptológico Nacional, maintained by the Centro Criptológico Nacional itself. They are used because they are the de facto reference in the Spanish public sector and because they produce a traceable result that the administration's technical teams recognise, not because the regulation imposes them.
It is set by Article 38.1 of RD 311/2022. Basic-category systems only require a self-assessment for their declaration of conformity, without prejudice to also undergoing a certification audit. Medium- or high-category systems require an audit for certification of their conformity. Both the self-assessment and the audit are carried out under Article 31 and Annex III.
We do the technical part: scope, categorisation, risk analysis, implementation of Annex II controls, hardening, monitoring and the evidence package. Left out is issuing the certificate, which is a third party's job; Article 38.1 refers to the corresponding Security Technical Instruction for the requirements applicable to certification bodies.