As ISTEC states of itself in a press-room notice dated 14 May 2026, the Generalitat Valenciana has its electronic trust services and certification infrastructure certified in the Esquema Nacional de Seguridad's high category: ISTEC says it has renewed «certification at the highest level of the Esquema Nacional de Seguridad» and that it is «the only instrumental public-sector entity holding this high-category certification» in the Comunitat Valenciana. We have not checked this against the CCN's catalogue of certified entities, and the notice does not publish the validity window, so we present it as the entity's own statement, not as a fact we have verified. For a technology supplier that has a very concrete reading: if your application signs, seals or validates documents against that infrastructure, you are interoperating with a high-category system, and the cryptographic and interconnection requirements that reach you are not those of an ordinary environment. Summum Sistemas technically implements the Annex II controls of RD 311/2022 that make that integration viable.
The public-sector map in the province of Valencia is made up of the Generalitat Valenciana and its consellerias, the Diputació de València, l'Ajuntament de València and the rest of the town councils, the Universitat de València and the Universitat Politècnica de València, and the health administration. All are public-sector entities for the purposes of Article 2.1 of RD 311/2022, which refers to Article 2 of Law 40/2015. What sets this market apart is not the number of buyers but the level of the horizontal system that almost everything ends up integrating with: the Generalitat's electronic signature and certification services, certified in high category. When the central link in the chain is at high category, the technical requirements come down into the tender at that level of detail.
The practical consequence lies in two guides from the Centro Criptológico Nacional that are worth having on the table from the design stage, not the audit stage. CCN-STIC-807, «Cryptology for use in the ENS», sets the admissible algorithms: TLS 1.2 as the minimum version, with TLS 1.3 recommended and TLS 1.0 and 1.1 prohibited; AES-256 in GCM mode as the recommended symmetric cipher; SHA-256 as the minimum for medium and high categories, with SHA-384 or 512 recommended for high; RSA signatures of at least 3072 bits recommended, or elliptic curve P-256 or higher; and an HSM recommended at high category. CCN-STIC-811, «Interconnection in the ENS», recommends a DMZ in medium and high categories and IDS/IPS recommended at high category, with zone separation and default-deny at the perimeter. Neither guide is the royal decree itself: they are the CCN's technical development of it, and should be cited as such.
The underlying obligation for the private company still lies in Article 2.3 of RD 311/2022, which extends the royal decree to the information systems of private-sector entities — including the obligation to hold the security policy required by Article 12, approved by the body holding the highest executive authority — when they provide services or supply solutions to the public sector, under a contractual relationship, for the exercise by these entities of their administrative competences and powers, and it also reaches the contractor's supply chain. On that basis, the work is engineering work: categorisation under Annex I assessing impact across the five dimensions of Article 40.2, risk analysis with MAGERIT modelled in PILAR, and verifiable implementation of the Annex II controls, with particular attention to mp.com, protection of communications.
We determine which parts of your solution interoperate with the regional electronic signature and certification infrastructure and what cryptographic and interconnection requirements that integration pulls in. It is the design decision that most conditions the rest of the project.
We set the category by assessing impact across the five dimensions of Article 40.2 and carry out the risk analysis with MAGERIT modelled in PILAR, the CCN's methodology and tool, documenting residual risk and acceptance criteria.
We adjust algorithms, protocol versions, key and certificate management to CCN-STIC-807, and design zones, DMZ, filtering and detection under CCN-STIC-811 to the extent the system's category requires.
We prepare the evidence package and the Article 38.1 route: self-assessment for the declaration of conformity in basic category — which may also undergo a certification audit — and an audit for certification in medium and high, both under Article 31 and Annex III.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Design of the integration with trust services
Analysis of the integration points with the electronic signature and certification infrastructure and of the technical requirements they pull in, resolved at the design stage rather than at the audit stage.
Categorisation and risk analysis
Category justified under Annex I across the five dimensions of Article 40.2, and risk analysis with MAGERIT modelled in PILAR.
Cryptographic configuration under CCN-STIC-807
Admissible algorithms and versions, key and certificate management: TLS 1.2 as a minimum with TLS 1.3 recommended, AES-256, SHA-256 or higher depending on category, and an HSM when the system is high category.
Interconnection and segmentation under CCN-STIC-811
Zoning, DMZ in medium and high categories, default-deny at the perimeter, outbound filtering and intrusion detection where the category requires it.
Protection of communications (mp.com) and media (mp.si)
Implementation of mp.com family measures — including separation of information flows on the network where required — and protection of media and information.
Evidence package and preparation for external review
Configurations, audit logs, vulnerability-analysis results and test records, reviewed in advance against Annex III before exposing the system to audit or self-assessment.
Summum Sistemas' technical layer and Summum Calidad's management layer are coordinated so the statement of applicability describes the system that was actually implemented. In integrations with trust services, where cryptographic detail is reviewed in depth, that consistency is what avoids findings in the external review.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side of ENS compliance in Valencia: categorisation, Statement of Applicability integrated with ISO 27001 and security policy for suppliers of the Generalitat Valenciana. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →Not automatically. Your category is determined under Annex I by the impact an incident would have on the information and services you handle, assessed across the five dimensions of Article 40.2. What does happen is that the specific technical requirements of the integration — algorithms, protocols, certificate management, segmentation — will be required from you at the level of the system you interoperate with, even if your overall categorisation is lower.
The CCN's CCN-STIC-807 guide, «Cryptology for use in the ENS», sets TLS 1.2 as the minimum version and recommends TLS 1.3; TLS 1.0 and 1.1 are prohibited, and only cipher suites with forward secrecy are admitted. The same guide marks AES-256-GCM as the recommended symmetric cipher and prohibits 3DES, MD5 and SHA-1. It is worth checking the guide's current version, because these parameters are updated.
According to the CCN's CCN-STIC-807 guide, HSM use is recommended for high-category systems. In lower categories the risk analysis may recommend it too when key custody is a critical point of the service. The system's category is determined under Annex I of RD 311/2022 and the Article 40 procedure.
It depends on the category. The CCN-STIC-811 guide, «Interconnection in the ENS», recommends a DMZ in medium and high categories, and places IDS/IPS as recommended at high category, as well as recommending firewalls at external connection points with default-deny and traffic logging. The concrete zone design comes out of the risk analysis and the system's scope.
No. Neither «MAGERIT» nor «PILAR» appears in the articles of RD 311/2022. The royal decree requires risk analysis and management (Article 14) but does not impose a specific methodology. MAGERIT is the reference methodology of the Centro Criptológico Nacional and PILAR its associated tool, maintained by the Centro Criptológico Nacional itself; we use them because they are the de facto standard in the Spanish public sector and because their output is traceable and recognisable to the auditor.
No. We carry out the technical implementation and prepare the case file. Determination of conformity follows the Article 38.1 route — self-assessment in basic category, which may also undergo a certification audit, and a certification audit in medium and high — and the requirements applicable to certification bodies are set out in the Security Technical Instruction provided for in that same article.