Seville concentrates the central services of the Junta de Andalucía, which means the systems a technology supplier ends up integrating with are not standalone departmental applications: they are horizontal platforms serving the whole community. The GUIA system, for unified identity management, obtained ENS conformity certification in medium category — certificate CERT-ENS-24309, issued on 26 May 2024 with a two-year validity, so that window expired in May 2026 and the Junta has not published a renewal; it is worth confirming its current status before relying on it. When you integrate with a system certified in medium category, the conformity route you will be asked for stops being a self-assessment: Article 38.1 of RD 311/2022 requires an audit for certification in medium and high categories. Summum Sistemas technically prepares that jump.
The difference between basic and medium category is not a nuance: it changes the procedure, the cost and the timeline. Article 38.1 of RD 311/2022 establishes that medium- or high-category systems «shall require an audit for certification of their conformity, without prejudice to the security audit provided for in Article 31, which may also serve for certification purposes», while basic-category systems «shall only require a self-assessment for their declaration of conformity, without prejudice to their also being able to undergo a certification audit». A supplier integrating with the Junta's horizontal platforms often discovers too late that its categorisation moves up and that the self-assessment it was counting on no longer applies. Anticipating it is the difference between planning an audit and suffering one.
Category is not inherited automatically, but it does spread through impact. Categorisation is done under Annex I, assessing the impact an incident would have on information and services across the five dimensions listed in Article 40.2: availability, authenticity, integrity, confidentiality and traceability. If your system handles identities, mediates citizen authentication or supports a service that others depend on, those dimensions score high and the category rises on its own weight. On top of that comes what arrives by contract: Article 2.3 extends the ENS to the systems of private-sector entities when, under a contractual relationship, they provide services or supply solutions to the public sector «for the exercise by these of their administrative competences and powers», and it requires tender specifications to include the requirements needed to ensure ENS conformity of the systems underpinning contractors' services, extending that caution to the supply chain.
In medium category, Annex II activates controls and reinforcements that were not required in basic, and the weight is felt above all in access control (op.acc), monitoring (op.mon), continuity (op.cont) and communications protection (mp.com). The Centro Criptológico Nacional's guides set the bar: CCN-STIC-811 recommends a DMZ in medium and high categories and zone separation, and CCN-STIC-807 sets the admissible algorithms, with SHA-256 as the minimum for medium and high and TLS 1.2 as the minimum version in any case. We carry out the risk analysis with MAGERIT modelled in PILAR, the CCN's methodology and tool; it is worth remembering that this methodology and tool belong to the CCN and do not appear in the articles of the royal decree, which does not impose a specific methodology.
Before committing to timelines, we assess whether integration with the Junta's horizontal platforms pushes your system from basic to medium. It is the decision that most conditions the budget, because it drags with it the Article 38.1 certification audit.
We apply Annex I, assessing impact across the five dimensions of Article 40.2, and carry out the risk analysis with MAGERIT modelled in PILAR, with residual risk and acceptance criteria documented.
We implement what medium category activates and basic did not require: reinforcements in access control, monitoring, continuity and communications. This includes the segmentation and DMZ that CCN-STIC-811 recommends in medium and high, and CCN-STIC-807 cryptographic configuration.
We review the system against Annex III, correct deviations and organise the evidence package in the order it is reviewed. The goal is to reach the Article 38.1 audit without findings that force a second cycle.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Category opinion before committing budget
Prior assessment of whether integration with horizontal systems certified in medium category pulls up your own categorisation, with the justification under Annex I and Article 40.2.
MAGERIT risk analysis modelled in PILAR
With MAGERIT and PILAR, from the Centro Criptológico Nacional, with asset inventory, dependencies, threats, safeguards and residual risk, updated at least annually or after significant changes.
Access-control (op.acc) reinforcements
Implementation of identification, authentication of external users and of the organisation, privilege management and remote access with the reinforcements medium category activates, which is where findings concentrate in identity integrations.
Monitoring and continuity proportionate to the category
Intrusion detection, logging and surveillance (op.mon), and impact analysis and continuity plan (op.cont) to the extent the system's category requires.
Segmentation, interconnection and cryptography
Zone and DMZ design under CCN-STIC-811, recommended in medium and high, and cryptographic configuration under CCN-STIC-807: TLS 1.2 as a minimum and SHA-256 or higher in medium and high.
Full preparation of the certification audit
Prior review against Annex III, closing of deviations and an ordered evidence package: configurations, audit logs, vulnerability-analysis results and test records.
In a medium-category file, Summum Sistemas' technical layer and Summum Calidad's management layer have to reach the audit in a coordinated way: the statement of applicability must describe the system that was actually implemented. When the two are prepared separately, the mismatch between document and system is the most common finding.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad supports ENS compliance in Seville from the management-system side: categorisation, Statement of Applicability integrated with ISO 27001 and preparation of the declaration or certification of conformity for suppliers of the Junta de Andalucía and Seville's institutions.
View service → sistemasTechnical ENS implementation in Valladolid, with the context of the Junta de Castilla y León and the Ayuntamiento de Valladolid: the same MAGERIT/PILAR/INES technical rigour adapted to the Valladolid public-procurement ecosystem.
View service →Not automatically, but it is what usually happens. Your system's category is determined under Annex I by assessing the impact of an incident across the five dimensions of Article 40.2. If your system handles identities, mediates authentication or supports a service others depend on, those dimensions score high and the category rises under its own weight. In addition, the tender may require it directly under Article 2.3.
Two things change. First, the conformity route: Article 38.1 of RD 311/2022 requires an audit for certification in medium and high, against the plain self-assessment for the declaration of conformity in basic — which, even so, may also undergo a certification audit if there is an interest in demonstrating it. Second, the content: Annex II activates controls that were not required in basic and adds reinforcements to those that already applied, numbered from R1 onwards depending on the control.
It can. Article 38.1 says so expressly: the certification audit is required «without prejudice to the security audit provided for in Article 31, which may also serve for certification purposes». Both the self-assessment procedure and the certification audit are carried out under Article 31 and Annex III, and under the terms the corresponding Security Technical Instruction sets.
RD 311/2022 does not name any specific entity or accreditation scheme in its articles. Article 38.1 refers to the corresponding Security Technical Instruction, which «shall also specify the requirements applicable to certification bodies». It is therefore worth checking the requirements in force at the time you contract the audit, rather than assuming them.
Annex II contains 73 controls across 16 families and three frameworks: organisational, operational and protection. Each control carries its required level by category, ranging from «not applicable» to application with reinforcements. The exact number that applies to you depends on the category and scope of your system, and comes out of the risk analysis: giving a figure before categorising and analysing would be making it up.
No, and it is important not to mix up the roles. We do the technical implementation and preparation: categorisation, risk analysis, Annex II controls, prior review against Annex III and the evidence package. The certification audit is carried out by a third party, under the terms the Security Technical Instruction provided for in Article 38.1 sets.