Many software suppliers still display on their website a badge for Spain’s National Security Framework (Esquema Nacional de Seguridad, ENS) that no longer proves anything. Royal Decree 311/2022 (Real Decreto 311/2022), which governs the ENS currently in force, gave twenty-four months for existing systems to be brought into compliance, and that period ended on 5 May 2024: since then, an ENS certificate issued under Royal Decree 3/2010 (Real Decreto 3/2010) has been worthless, and a certification also has a two-year validity period that needs checking. The problem is that tender specifications and procurement boards (mesas de contratación, the panels that assess bids) do not always check this, and the result is that contracts are awarded to suppliers displaying an expired badge over those that keep theirs up to date. This guide explains how conformity with the ENS is demonstrated today, how to read a certificate and a conformity mark, what questions to ask the supplier and how to draft the tender specifications so that the check happens automatically.

What changed with Royal Decree 311/2022

The ENS was created by Royal Decree 3/2010 and updated in 2015. Royal Decree 311/2022 of 3 May replaced it entirely: a new catalogue of measures, stronger continuous monitoring, specific compliance profiles and explicit provisions on public sector suppliers. Its transitional provision allowed twenty-four months for existing systems to reach full compliance, and the National Cryptologic Centre (CCN) permitted the certification procedure under RD 3/2010 to remain in use only until 5 May 2024.

The practical consequences as at 16 September 2026:

A certificate that cites Royal Decree 3/2010 is no longer compliant, whatever its date.
A certificate under Royal Decree 311/2022 is valid only if it was issued less than two years ago and has not been withdrawn.
A badge with no link to a verifiable certificate or declaration is not a conformity mark: it is an image.

How conformity is demonstrated today

The ENS distinguishes three system categories (basic, medium and high), and the way conformity is demonstrated depends on the category:

Basic category: a declaration of conformity, based on a self-assessment that verifies compliance at least every two years. The person responsible for the system signs it themselves.
Medium and high categories: a certification of conformity, based on a formal audit carried out by a certification body accredited by ENAC for the ENS (ENAC is Spain’s national accreditation body), again at least every two years.

In both cases conformity is made visible through the conformity mark governed by the CCN-STIC 809 guide (CCN-STIC is the CCN’s series of security guides), which must be published on the entity’s website with a link to the corresponding certificate or declaration. Audits follow the CCN-STIC 802 guide. And suppliers that provide services to public authorities must be in a position to produce their declaration or certification, because their systems fall within the scope of the royal decree when they process information for the public sector or provide services to it.

How to read an ENS certificate in five checks

The decree it cites. It must be Royal Decree 311/2022. If it cites 3/2010, it does not count.
The category. Basic, medium or high. A contract that requires the medium category is not covered by a basic-category declaration, however impressive it looks. Check that the category on the certificate is equal to or higher than the one the tender specifications require.
The scope. The certificate describes which systems and services it covers. A supplier may have its hosting service certified and not its software development, or the other way round. The service you are procuring has to fall within the literal wording of the scope.
The certification body and the dates. For medium and high, the body must be accredited by ENAC for the ENS, and the certificate must be less than two years old. For basic, the declaration must be signed by the person responsible and dated within the same period.
The conformity mark. It must be on the supplier’s website and link to the document. If there is no link, or it leads to an image, ask for the certificate as a PDF and verify it with the issuing body.

If the supplier cannot hand over a certificate or declaration that meets these conditions at the time of the tender, it is not ENS-compliant, whatever its website says.

What to ask the supplier before awarding the contract

Which royal decree was your certificate issued under, and on what date?
Which category and exactly what scope does it cover? Does it include the service we are tendering?
Who is the certification body, and is it accredited by ENAC for the ENS?
Where is the conformity mark published, and which document does it link to?
When is your next renewal audit, and what happens to the contract if you lose certification?
Which ENS measures apply to the specific system you will be providing to us, and how do you evidence them?

A supplier whose ENS certification is up to date answers all of this on one page and attaches the certificate. One without it steers the conversation towards ISO 27001, which is a different thing: we explain it in what ISO 27001 certifies in a software supplier, along with why it is no substitute for the ENS.

How to draft the specifications so that the check is automatic

The way to avoid expired badges is for the tender specifications to leave no room for them:

Require certification or a declaration of conformity with Royal Decree 311/2022, citing it by number, in the category that corresponds to the system being tendered, and submitted in the administrative envelope (sobre administrativo, the part of the bid that holds the bidder’s qualifying documents) as the full certificate or declaration, not a logo.
Set the category according to the system being procured, after categorising it as the ENS itself requires, and do not let the bidder choose it.
Require the scope to cover the service that is the subject of the contract, with the wording of the scope reproduced in the bid.
Require validity throughout the performance of the contract, with an obligation to renew and to report any suspension or withdrawal, and with loss of conformity as grounds for termination or a penalty.
Ask for ISO 27001 as an additional criterion, never as a substitute for the ENS.

With these five lines, a supplier with an RD 3/2010 badge rules itself out, and one that keeps its certification up to date competes on equal terms. We have a full guide on how to prepare technical specifications with ENS requirements and a comparison of what changes with the size of the supplier, where current ENS conformity is one of the criteria that put a mid-sized company on a level footing with a large integrator.

Why it matters more than it seems

A system developed or hosted by a supplier without current ENS conformity puts the public body itself in breach, not just the supplier: Royal Decree 311/2022 obliges the public sector to ensure that its systems, including those provided by third parties, comply with the framework. In the event of an audit, an incident or a claim, the contractor’s expired certificate becomes the contracting authority’s responsibility. Checking it before awarding the contract takes ten minutes.

CEDESA’s certification

CEDESA holds medium-category ENS certification, issued by OCA Instituto de Certificación (an ENAC-accredited body) under Royal Decree 311/2022, renewed on schedule, together with ISO 27001 for information security, ISO 9001 for quality and ISO 56001 for innovation management. Every system we develop for public bodies incorporates security architectures designed in accordance with the ENS, in the medium or high category each one requires, as we explain on our software for the public sector page and in the guide on what the ENS is and why your supplier must have it.

Frequently asked questions about the validity of ENS certificates

Is an ENS certificate issued under Royal Decree 3/2010 still valid?

No. Royal Decree 311/2022 gave existing systems twenty-four months to comply, and the certification procedure under RD 3/2010 could be used only until 5 May 2024. Since that date, a certificate that cites RD 3/2010 does not demonstrate conformity with the ENS.

How long does an ENS certificate last?

Two years. Both certification for the medium and high categories and the declaration of conformity for the basic category require compliance to be verified at least every two years. A certificate issued more than two years ago and not renewed is no longer valid.

What is the difference between a declaration and a certification of conformity with the ENS?

The declaration of conformity applies to the basic category and is based on a self-assessment signed by the person responsible for the system. Certification applies to the medium and high categories and requires a formal audit by an ENAC-accredited certification body. Tender specifications that require the medium category are not met by a basic-category declaration.

How do I check a supplier’s ENS certificate?

Ask for the full certificate or declaration and check that it cites Royal Decree 311/2022, a category equal to or higher than the one required, a scope that includes the contracted service, an ENAC-accredited body in the case of certification, and an issue date less than two years old. The conformity mark must be on the supplier’s website with a link to the document.

Does ISO 27001 replace the ENS?

No. ISO 27001 is a voluntary international standard that certifies a management system; the ENS is a legal obligation for the systems of the public sector and its suppliers, with a catalogue of specific measures. Tender specifications can give credit for ISO 27001 in addition to the ENS, never in its place.

Conclusion

An ENS certificate counts only if it cites Royal Decree 311/2022, is less than two years old, covers the service being procured in the required category and is issued by a body entitled to issue it. Anything else is just a badge. Checking before you award the contract protects the public body, which is answerable for the systems that third parties provide to it, and rewards the suppliers that keep their certification up to date. If you would like to see a current one and talk about your project, write to us via our contact page.