Aragón resolved its e-government by concentrating it in a single public entity: Aragonesa de Servicios Telemáticos (AST), which announced on 11 May 2026 the renewal of its Esquema Nacional de Seguridad certification in high category, a category it has held, according to AST itself, since 2018. In that same notice AST describes the scope: «all of the technology services managed by AST», not just hosting of e-government applications. AST does not publish the certificate's expiry date, so it is worth confirming its current status before relying on it. Translated for a supplier: if your application is going to live on that platform, you are not reaching an ordinary hosting service, you are reaching an environment certified at the ENS's highest category, and the requirements passed on to you are the ones that underpin that certification. Summum Sistemas prepares your side of that technically.
This is the scenario in which Article 2.3 of RD 311/2022 is seen most clearly. The regulation applies to the information systems of private-sector entities that, under a contractual relationship, provide services or supply solutions to public-sector entities «for the exercise by these of their administrative competences and powers», and it expressly includes the obligation to hold the security policy required by Article 12 — which for these entities «shall be approved […] by the body holding the highest executive authority». And it adds something that becomes decisive in a centralised hosting model: tender specifications must include the requirements needed to ensure conformity, and «this caution shall also extend to the supply chain of those contractors». In other words, what you integrate counts too.
In Annex II, that scenario places the weight on two families of the operational framework. The first is op.ext, external services, whose controls include supply-chain protection (op.ext.3) and system interconnection (op.ext.4) — both graded by category, with supply-chain protection required at the highest category. The second is op.nub, cloud services, whose op.nub.1 control, «Protection of cloud services», applies from basic category and is reinforced in medium and high. On top of that, being hosted on a certified platform does not transfer its certification to your application: it certifies the environment, not your software. Your conformity remains your own, and the split of responsibilities between what the platform covers and what you cover has to be written down, because that is exactly what gets reviewed.
The rest of the Aragonese public map is completed by the Gobierno de Aragón and its departments, the Diputación Provincial de Zaragoza, the Ayuntamiento de Zaragoza, the Universidad de Zaragoza and the regional health administration; all are public-sector entities for the purposes of Article 2.1 of RD 311/2022, which refers to Article 2 of Law 40/2015. The technical method is the same for all of them: categorisation under Annex I assessing impact on the five dimensions of Article 40.2 — availability, authenticity, integrity, confidentiality and traceability —, risk analysis with MAGERIT modelled in PILAR, the methodology and tool of the Centro Criptológico Nacional, and verifiable implementation of the Annex II controls, which bring together 73 controls across 16 families and three frameworks.
We determine what the hosting platform covers and what stays on your side. In a certified environment, the responsibility boundary is the document that gets reviewed most: without it, controls turn up that nobody has implemented because each party assumed they were the other's.
We set your system's category by assessing impact across the five dimensions of Article 40.2, and we carry out the risk analysis with MAGERIT modelled in PILAR, documenting residual risk and treatment decisions.
We implement and document the external-services and cloud controls: day-to-day management of the outsourced service, supply-chain protection, system interconnection and protection of cloud services, each at the level the category requires.
We compile the evidence package and prepare the Article 38.1 route: self-assessment for the declaration of conformity in basic category — which may also undergo a certification audit — and an audit for certification in medium and high, under Article 31 and Annex III.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Responsibility-split document with the platform
Explicit delimitation of which Annex II controls the hosting environment covers and which stay on your side, which is the piece that prevents responsibility gaps in certified environments.
Categorisation report under Annex I
Justification of the category with the impact assessment across the five dimensions of Article 40.2, broken down by service provided.
MAGERIT risk analysis modelled in PILAR
With MAGERIT and PILAR, from the Centro Criptológico Nacional: assets, dependencies, threats, safeguards and residual risk, updated at least annually or after significant changes.
External services (op.ext) and supply chain
Treatment of day-to-day management of the outsourced service, supply-chain protection and system interconnection, at the level appropriate to the category.
Protection of cloud services (op.nub)
Verification of op.nub.1 and of the contractual conditions with the cloud provider, including the part of the shared-responsibility model that falls to you.
Hardening, cryptography and evidence package
Hardening under CCN-STIC guides, cryptographic configuration under CCN-STIC-807 and compilation of evidence: configurations, audit logs, vulnerability analyses and test records.
Summum Sistemas handles the technical side and Summum Calidad the management side: security policy, statement of applicability and regulatory file. In a centralised hosting model, that coordination is what lets you explain, with one voice, what the platform covers and what you cover.
Summum Sistemas' main ENS service: a complete view of the technical support for ENS compliance for suppliers of the Administration, with the full catalogue of control families, CCN methodologies and available conformity routes.
View service → calidadSummum Calidad handles the regulatory and management side: categorisation, Statement of Applicability, security policy and integration with ISO 27001. Sistemas' technical work and Calidad's documentary work are coordinated to cover the ENS in full.
View service →No. The certification covers that entity's systems and its declared scope — in the case of the Aragonese regional platform, hosting of e-government applications — not your application. Article 2.3 of RD 311/2022 applies the ENS to the systems of private entities that provide services or supply solutions to the public sector, under a contractual relationship, for the exercise by these entities of their administrative competences and powers. Your conformity remains your own; what your project does inherit is the environment's level of demand.
Article 2.3 of RD 311/2022, after requiring tender specifications to include conformity requirements, states that «this caution shall also extend to the supply chain of those contractors». Annex II turns it into a specific control: op.ext.3, «Protection of the supply chain», within the external-services family, graded according to the system's category. In practice this means identifying and controlling the third-party components, libraries and services your solution integrates.
In the conformity file itself and in the contract. Annex II includes specific controls for external services — day-to-day management, supply-chain protection, system interconnection — and for cloud services (op.nub.1), and all of them require you to be able to demonstrate how they are covered. When the split is not written down, orphan controls are the usual result: neither party implements them because each assumed the other had it covered.
Annex II control op.nub.1, «Protection of cloud services», applies when the system uses cloud computing services, and its requirement starts at basic category, with reinforcements in medium and high. If your deployment is entirely on your own infrastructure or on hosting that does not constitute a cloud service, the applicability analysis may differ; that is determined when defining the scope, not by default.
Not for pre-existing systems. The sole transitional provision of RD 311/2022 gave twenty-four months to systems within its scope that pre-dated its entry into force — expressly including those owned by private-sector contractors — to achieve full compliance. The regulation entered into force on 5 May 2022. New systems must comply from the moment they go into production.
No. We carry out the technical implementation: scope, categorisation, risk analysis, Annex II controls, the split of responsibilities with the platform and the evidence package. Certification is issued by a third party; Article 38.1 of RD 311/2022 refers to the corresponding Security Technical Instruction for the requirements applicable to certification bodies.