ENS Technical Implementation in Salamanca

The USAL is a public university integrated into the Spanish public university sector and, as such, falls within the ENS scope defined in Article 2 of RD 311/2022. When the USAL contracts technology services — academic management software, cloud infrastructure, systems maintenance or data processing — the supplier's systems fall within the scope of Article 2.3 of RD 311/2022. The category of each system is determined under Annex I for the supplier's own system; it is not copied from that of the affected university system. Operating without that compliance can prevent the company from being awarded new contracts with the USAL or any other public body in Salamanca.

Summum Sistemas handles the technical and operational side: MAGERIT risk analysis, PILAR modelling, systems hardening, access-control and monitoring configuration, cloud-service adaptation to the ENS op.nub profile, and preparation of the technical evidence package. Summum Calidad handles the normative and documentary side: information security management system, Statement of Applicability, security policy in accordance with Article 12 of RD 311/2022, and coordination of the declaration or conformity certification. In an integrated project, both teams work in parallel so that security engineering and the management system are coherent and free of duplication.

We primarily use PILAR and INES, both developed by the Centro Criptológico Nacional. PILAR is the risk analysis and management tool that implements the MAGERIT methodology: it models assets, threats and vulnerabilities, calculates intrinsic and residual risk, and generates risk and ENS compliance reports in the format required by compliance auditors. INES is the ENS self-assessment tool: it measures the degree of compliance with each Annex II measure before implementation begins, identifies the highest-impact gaps and produces the maturity report that serves as the starting point for the work plan.

The op.nub family (use of cloud services) is one of the seven families in the operational framework of Annex II of RD 311/2022. It governs the requirements that cloud computing services used in ENS-subject systems must meet: the cloud provider must have its own ENS conformity level or equivalent, and the client — in this case the technology supplier to Salamanca's public sector — must verify and document that conformity. It is a particularly relevant family because many suppliers to the Diputación, the Ayuntamiento or the USAL host their solutions on public or private cloud infrastructure, and ENS compliance requires that layer to meet the standard's requirements as well.

The duration depends on the system category, infrastructure complexity and the security baseline in place. For basic-category systems with relatively straightforward infrastructure, the MAGERIT analysis, Annex II measure implementation and evidence package preparation can be completed in three to five months. For medium- or high-category systems with more complex infrastructure or extensive cloud components, the project typically requires eight to fourteen months. In both cases, the timeline is significantly shorter if the company already has documented security practices in place, even without ISO 27001 certification.

No. Conformity certification for medium- or high-category systems can only be issued by an inspection body accredited by ENAC in accordance with the UNE-EN ISO/IEC 17065 standard. For basic-category systems, the self-assessed declaration of conformity is issued by the organisation itself following the CCN-STIC 809 procedure. Article 38.1 of RD 311/2022 adds a nuance that is often lost: a basic-category system only requires a self-assessment for its declaration of conformity, without prejudice to its also being able to undergo a certification audit. Summum Sistemas is not an ENAC-accredited body and does not act as a conformity auditor: our role is to prepare systems from the technical side so that they pass that process with the greatest possible assurance, not to issue the certificate.