What Spain's ENS Actually Requires From Cloud Platforms Selling to the Public Sector

Spain’s National Security Framework (ENS), established by Royal Decree 311/2022, applies to public-sector information systems and private suppliers providing services or solutions to Spanish public bodies, requiring security policies, category-based controls, and documented conformity evidence. Systems are classified as BÁSICA, MEDIA, or ALTA according to the highest assessed impact across confidentiality, integrity, availability, authenticity, and traceability; BÁSICA systems may use self-assessed declarations, while MEDIA and ALTA require audits and certification from accredited bodies, generally renewed every two years. Annex II sets out 73 organisational, operational, and protection measures covering areas such as access controls, separation of duties, logging, change management, supplier oversight, encryption, backups, continuity planning, and cloud-service governance. ENS does not impose a universal Spanish or EU data-residency rule, but it requires organisations to assess data jurisdiction, encryption, key management, and cloud-provider conformity, while individual tenders or GDPR may add residency restrictions. The public body remains responsible for proving its own system’s conformity, so cloud platforms must provide usable audit evidence; the source argues that bring-your-own-cloud arrangements can simplify this by keeping accounts, logs, keys, backups, and regional choices under the customer’s control, though no platform alone makes a system ENS-compliant.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.