Glossary of public sector software

Certification, security and technology procurement terms explained for IT directors in Spain's public authorities and large companies.

Custom software

Custom software is software developed specifically for an organisation's processes, as opposed to a standard product that the organisation has to adapt. It makes sense when the process is the competitive differentiator, or when the applicable regulations do not fit any product on the market.

Related: ERP

ENS (National Security Framework)

The ENS (Esquema Nacional de Seguridad) is the mandatory security framework for the information systems of the Spanish public sector and its suppliers. It lays down principles, requirements and security measures organised by system category, and ENS certification is required in most public tenders for public sector software.

Legal basis: Royal Decree 311/2022 (Real Decreto 311/2022)

ERP

An ERP is a system that integrates an organisation's management processes in a single database: purchasing, production, warehousing, invoicing and accounting. Its advantage is data consistency; its limitation is that it forces the organisation to adapt its own processes to the product's model.

Related: Custom software, Traceability

Interoperability

Interoperability is the ability of public authorities' information systems to share data and services with one another. In Spain, the National Interoperability Framework (ENI) sets the common technical standards, and compliance with it determines whether an application can be integrated with central government platforms.

Legal basis: Royal Decree 4/2010 (Real Decreto 4/2010)

ISO/IEC 27001

ISO 27001 is the international standard for information security management systems. It certifies that an organisation manages its security risks in a systematic, audited way. It complements Spain's National Security Framework (ENS) rather than replacing it: the two cover different ground, and many public tenders ask for both.

Next Generation EU

Next Generation EU is the European Union's recovery instrument, which finances, among other things, projects to digitalise the public sector. Its calls for funding impose requirements for reporting and justification, milestones and audit that shape how software development is procured and documented.

Related: Interoperability

SLA (service level agreement)

An SLA is the contractual commitment on service quality: guaranteed availability, response and resolution times by severity, and penalties if they are not met. In Spanish public contracts it usually forms part of the technical specifications (pliego de prescripciones técnicas, PPT), and monitoring it determines whether the work delivered is certified.

System category (ENS)

The category classifies each system under Spain's National Security Framework (ENS) as BASIC, MEDIUM or HIGH according to the impact an incident would have on the security dimensions: confidentiality, integrity, traceability, authenticity and availability. It determines which Annex II measures are required, and therefore the cost and scope of compliance.

Legal basis: Annex I, RD 311/2022

Traceability

Traceability is the ability to reconstruct the complete path of a product or batch along the supply chain, backwards and forwards. In the food industry it is a legal obligation and the basis of any product recall, as well as a requirement of audits such as IFS and BRC.

Legal basis: Regulation (EC) 178/2002

Related: ERP

Whistleblowing channel (Law 2/2023)

A whistleblowing channel, or internal reporting channel, is the mandatory system for reporting breaches that Spanish law requires of companies with 50 or more employees and of public sector entities. It must guarantee confidentiality, allow anonymous reports and respond within set deadlines, with fines of up to one million euros for non-compliance.

Legal basis: Law 2/2023 (Ley 2/2023)

← Blog articles