In the province of Málaga, public-sector technology procurement is not concentrated in a single body: it is spread across the province's town councils, the Diputación Provincial, the Junta de Andalucía through its territorial delegation, the Universidad de Málaga and the Andalusian health service. The Diputación de Málaga provides technical assistance to the province's local entities for their Esquema Nacional de Seguridad compliance, and the Ayuntamiento de Málaga itself publishes on its electronic site its ENS conformity certificate in basic category. That draws a market with one very concrete feature: most of the systems you will interoperate with are basic category, and there the conformity route is a declaration, not a certification. Summum Sistemas implements the technical side that underpins it.
Working with local administrations has technical consequences worth understanding before sizing a project. Medium and small town councils rarely have their own cybersecurity team; they rely on technical assistance from the Diputación and on external suppliers. In practice, that means a large share of the burden of demonstrating conformity falls on the supplier. And RD 311/2022 provides for this: Article 2.3 applies the royal decree to the information systems of private-sector entities — including the obligation to hold the security policy required by Article 12 — when they provide services or supply solutions to public-sector entities, under a contractual relationship, for the exercise by these of their administrative competences and powers, and it requires tender specifications to include the requirements needed to ensure that conformity, expressly mentioning Conformity Declarations or Certificates.
Basic category is the real entry point of this market, and it deserves precision because it is misread in two directions. On one hand, «basic» does not mean little: Annex II of RD 311/2022 contains 73 controls across 16 families and three frameworks, and a substantial part of them is already required at that category, including op.nub.1, «Protection of cloud services», which applies from basic category. On the other hand, «basic» does change the conformity route, and that makes the process cheaper and shorter: Article 38.1 establishes that basic-category systems only require a self-assessment for their declaration of conformity — without prejudice to also undergoing a certification audit — while medium- or high-category systems require an audit for certification. For a technology SME wanting to get into municipal procurement, that difference is what makes the project viable.
In a municipal environment, the technical work concentrates where the actual findings are: the op.exp family of the operational framework — asset inventory, security configuration, change management, protection against malicious code, activity logging — and op.acc access control. On top of that, risk analysis with MAGERIT modelled in PILAR, the methodology and tool of the Centro Criptológico Nacional, and cryptographic configuration under CCN-STIC-807. Categorisation is done under Annex I, assessing impact across the five dimensions listed in Article 40.2: availability, authenticity, integrity, confidentiality and traceability. None of this changes from province to province; what changes is the scale at which it is applied and the budget behind it.
We define the perimeter without inflating it. In projects with town councils, a poorly defined scope is the leading cause of cost overruns: a system that would be basic category if properly delimited ends up categorised as medium, with the change in conformity route that implies.
We set the category by assessing impact across the five dimensions of Article 40.2 and following the Annex I procedure. The justification is documented, because it is the first thing reviewed whenever someone questions a basic-category classification.
We focus where the findings actually are in municipal environments: op.exp (inventory, security configuration, change management, protection against malicious code, activity logging), op.acc (access control) and mp.com, with cryptography set to CCN-STIC-807.
We prepare the self-assessment that Article 38.1 requires for the declaration of conformity in basic category, carried out under Article 31 and Annex III, with the evidence package that supports it.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Scope delimitation and justified categorisation
ENS perimeter defined and category argued under Annex I, with the impact assessment across the five dimensions of Article 40.2 documented service by service.
MAGERIT risk analysis modelled in PILAR
With MAGERIT and PILAR, the CCN's methodology and tool: assets, threats, safeguards and residual risk, sized to the system's real scale rather than a generic template.
Operational measures (op.exp) implemented and verifiable
Asset inventory, security configuration, change management, protection against malicious code and activity logging, which are the controls reviewed first in a municipal environment.
Access control and communications protection
Implementation of op.acc — identification, authentication, privilege management — and of mp.com, with CCN-STIC-807 cryptographic configuration: TLS 1.2 as the minimum version, AES-256, SHA-256 or higher.
Cloud compliance (op.nub) even at basic category
Verification of op.nub.1, «Protection of cloud services», which already applies from basic category: contractual conditions with the provider and the real split of responsibilities.
Self-assessment and declaration-of-conformity file
Preparation of the self-assessment under Article 31 and Annex III, and of the file supporting the declaration of conformity set out in Article 38.1 for basic category.
Summum Sistemas carries out the technical implementation and Summum Calidad the management side: security policy, statement of applicability and regulatory file. In municipal projects, where budgets are tight, preparing both layers at the same time avoids paying twice for the same information-gathering exercise.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side: categorisation, Statement of Applicability, security policy and integration with ISO 27001. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →No. It means the conformity route is lighter, not that the controls disappear. Annex II of RD 311/2022 contains 73 controls across 16 families and three frameworks, and a substantial part is already required at basic category — including op.nub.1, «Protection of cloud services». What changes with the category is the required level for each control and the applicable reinforcements, which the annex itself numbers from R1 onwards.
Each party for its own. The local entity is responsible for its own systems, and for that it has the technical assistance the Diputación de Málaga provides to the province's local entities. You are responsible for yours: Article 2.3 of RD 311/2022 applies the ENS to the systems of private entities that provide services or supply solutions to the public sector, under a contractual relationship, for the exercise by these entities of their administrative competences and powers. In practice, when the client has no team of its own, the supplier ends up carrying the technical conversation.
Article 38.1 of RD 311/2022 draws the line clearly: basic-category systems only require a self-assessment for their declaration of conformity, while medium- or high-category systems require an audit for certification. Both procedures are carried out under Article 31 and Annex III. A basic-category system may voluntarily undergo a certification audit if it is commercially useful.
Article 38.2 of RD 311/2022 requires declarations and certificates of conformity to be published on the relevant websites or electronic sites. That obligation applies to those responsible for the information systems within the scope of Article 2. In commercial practice, showing your conformity is also a sales argument with a town council that needs to demonstrate its own.
Yes. Annex II control op.nub.1, «Protection of cloud services», applies from basic category and is reinforced in medium and high. In addition, Article 2.3 extends the conformity requirement to the contractor's supply chain. You need to document how that control is covered on the contracted infrastructure and what share of responsibility you take on relative to the cloud provider.
No. We carry out the technical implementation and prepare the self-assessment and the evidence package. Certification is issued by a third party, and Article 38.1 refers to the corresponding Security Technical Instruction to specify the requirements applicable to certification bodies.