Technical Implementation of the ENS in Seville for Public-Sector Suppliers

Article 2 of RD 311/2022 extends the ENS obligation to the information systems of private entities providing services or solutions to public-sector bodies subject to the Framework. The Diputación de Sevilla and the Ayuntamiento de Sevilla are subject to the ENS as public administrations. If your systems handle data belonging to either of them, host software they use, or exchange information with their systems, ENS compliance is mandatory and may be a technical-solvency requirement in procurement tender specifications.

Yes. Both are public universities and therefore public-sector bodies subject to the ENS. Their digital-service contracts — software development, system hosting, student or research data processing, cloud services — pass on the ENS compliance obligation to the private suppliers involved. Their tender specifications increasingly include specific clauses requiring proof of compliance with the Framework.

PILAR is the risk analysis tool developed by the CCN that implements the MAGERIT methodology in a structured way, with catalogues of assets, threats and safeguards aligned with Annex II of RD 311/2022. It generates reports in the format conformity auditors expect, with reproducible results comparable across reviews. A hand-built spreadsheet analysis is not prohibited, but it makes it harder to trace threats, risks and applied controls, which tends to generate findings during an ENAC audit.

Annex II of RD 311/2022 covers 73 controls organised into three frameworks and 16 families: the organisational framework (4 controls), the operational framework — 7 families and 33 controls, including the op.nub family for cloud services — and the protection controls — 8 families and 36 controls. Which controls are mandatory depends on your system's category (basic, medium or high), determined by the CIDAT impact analysis. Summum Sistemas carries out that diagnostic to determine exactly which subset applies to your company.

The op.nub family within the operational framework of Annex II sets out the security requirements specific to cloud computing services: cloud provider assessment, environment segregation, access management and the cloud services supply chain. It applies whenever the in-scope system uses IaaS, PaaS or SaaS infrastructure. For ICT suppliers of the Junta de Andalucía or other Seville public bodies operating on public cloud infrastructure, this family must be explicitly addressed in the risk analysis and the implementation plan.

No. For basic-category systems, the declaration of conformity is issued by the organisation itself through self-assessment, under CCN-STIC 809. For medium- or high-category systems, the certificate is issued by an inspection body accredited by ENAC under UNE-EN ISO/IEC 17065. Summum Sistemas does not issue any certificate — that is the exclusive remit of ENAC-accredited bodies — we implement the Annex II technical controls, produce the evidence package and prepare your systems to pass that process with confidence.