Categorization
Assess the information and services across the five security dimensions to determine the system's category: basic, medium or high.
Spain's National Security Framework · RD 311/2022
Prepare the ENS for your category, measure by measure.
If you work with the Spanish public sector, the ENS (Esquema Nacional de Seguridad, Spain's National Security Framework) is a requirement to keep doing so. Choose your category and Audexa shows only the measures and reinforcements Annex II requires of you, with their official codes, how to assess them, how to meet them and the evidence the auditor will expect.
- 73 measures and 86 Annex II reinforcements
- Basic 72 · Medium 129 · High 170 questions
- 122 mappings to ISO 27001
175 controls: measures, reinforcements, Articles 5–27 and audit
73 Annex II measures with their official code, plus 86 reinforcements
39 ENS-related policy templates
199 mappings: 122 to ISO 27001 and 77 to NIS2
What the ENS requires
No ENS conformity, no public-sector contract.
Royal Decree 311/2022 applies to the entire Spanish public sector and to private organizations that provide it with services or solutions. Systems are classified into basic, medium or high category, and the category determines which Annex II measures and reinforcements apply.
Measures and reinforcements
Organizational framework, operational framework and protection measures, with the reinforcements each category adds. Anything that doesn't apply is justified in the Statement of Applicability.
Audit or self-assessment
Medium and high categories require an audit and a certification of conformity. For the basic category, a self-assessment and a declaration of conformity are enough.
How Audexa helps
Annex II as written, filtered by your category.
The questionnaire follows the structure of RD 311/2022 exactly, from categorization to audit, with no questions your category doesn't ask for.
Assess
Only what your category requires.
Category selector
Choose Basic, Medium or High and the questionnaire narrows to 72, 129 or 170 questions according to Annex II.
Measures with official codes
org, op.pl, op.acc, op.exp, op.ext, op.nub, op.cont, op.mon and the mp measures, with their applicable reinforcements. Each question shows its measure or its article of Royal Decree 311/2022; the articles have been checked against the official text.
Focused view and Your path
With the ENS as your focus, Audexa shows you only what your category asks for and a single next step. One framework, on every plan.
From the articles to the audit
Categorization, principles and minimum requirements (Articles 5–27), compensating measures and the audit or declaration of conformity.
Document
The documentation the auditor asks for.
Statement of Applicability
Justify every measure that doesn't apply or that you cover with a compensating measure, and export it with the results.
Policies and evidence
39 ENS-related policy templates, plus evidence with an owner, review date and expiry.
CCN guidance as support
Each measure points to the CCN-STIC guides and CCN tools such as PILAR, INES, LUCÍA or CLAUDIA.
Don't start from scratch
Reuse what you already have.
From your last ENS audit
Previous audits look exactly as before. When you start a new one, their answers arrive as proposals in the new measures.
From ISO 27001 and NIS2
122 mappings to ISO 27001 and 77 to NIS2 propose reviewable answers. A person confirms them.
Action plan and re-audit
Gaps turned into tasks with subtasks, PDF and Excel reports, and a re-audit to track progress.
Points per gap
How much each gap raises your score and how much effort it takes, with the quick wins in your plan toward your target.
Some features depend on your plan and active modules.
Category selector
Your category decides how many questions you get.
Before the questionnaire you state the category you're aiming for. Audexa applies Annex II and shows only the measures and reinforcements that category requires. If you haven't determined it yet, start with the one you expect to justify; categorization is part of the questionnaire itself.
- Basic: self-assessment and declaration of conformity
- Medium and high: preparation for the certification audit
- Each measure with how to assess it, steps, expected evidence and a suggested owner
- Answers Yes, Partial, No or Not applicable, with the reason
System categoryAnnex II
- Basic72 questions
- Medium129 questions
- High170 questions
Continuity
Your previous ENS audits still count.
Audits completed with the previous catalogue look exactly as they did. When you start a new one, the answers from your last ENS audit arrive as proposals in the new measures, so you only review and confirm.
- Nothing changes in audits already closed
- Proposed answers flagged for review: a person confirms them
- Rebuilt mappings to ISO 27001 (122) and NIS2 (77)
- “How much does what I have cover?” estimate when you create the audit
New ENS auditProposals
- op.acc.1 IdentificationFrom the last ENS audit
- op.exp.8 Activity loggingTo review
- mp.info.6 BackupsFrom ISO 27001
- op.nub.1 Protection of cloud servicesNo previous answer
Smart audit
Answer the ENS with help, but you decide.
In your first ENS audit, Audexa suggests the answers it already knows, with their source: evidence, other audits, Assets, policies and tasks. Before submitting, it checks consistency with your Assets, vRadar and your evidence. It warns, never blocks, and nothing is answered or submitted on its own.
- Each question with What they ask of you, Explain it to me and its ENS reference
- Suggested answers you accept or change one by one
- Share out sections or questions: each teammate sees Only my questions
- Points per gap and a plan toward your target, with Create task on every row
ENS audit · Medium categoryFocused view
- op.acc.6 Authentication mechanism (organization users)Suggested from your evidence
- op.exp.8 Activity loggingDoesn't match your Assets
- mp.info.6 BackupsAssigned to a teammate
How it works
Three steps to arrive prepared.
Choose your category
Basic, Medium or High. Set the ENS as your focus, set the applicability of each measure and answer only what it requires.
Implement
Approve policies, assign tasks and gather evidence for every measure and reinforcement.
Get to the audit
Re-audit and arrive with your Statement of Applicability and documentation in order, or sign your declaration if you're basic.
Frequently asked questions
What people usually ask us about ENS.
Do I have to comply with the ENS as a private company?
Yes, if you provide services or solutions to the Spanish public sector within the framework's scope. Many tenders ask for ENS certification or a declaration of conformity.
Does Audexa certify me for the ENS?
No. Certification is issued by ENAC-accredited bodies. Audexa helps you implement the measures and prepare the documentation and evidence for the audit. In the basic category you can use it for your self-assessment and declaration of conformity.
How many questions does a medium-category ENS audit have?
129. Basic has 72 and high has 170. They come from the 73 Annex II measures, the 86 applicable reinforcements and the sections on categorization, minimum requirements and audit, filtered by your category.
We already ran an ENS audit in Audexa. What happens to it?
It looks exactly as before. When you start an audit with the new catalogue, its answers arrive as proposals in the new measures and you review them.
Does it help if we already have ISO 27001 or work on NIS2?
Yes. There are 122 mappings between ISO 27001 and the ENS and 77 between NIS2 and the ENS. They propose reviewable answers; they are not a legal equivalence and a person confirms them.
Which plan do I need?
The ENS framework is available from the Core plan. The Focused view with one framework is on every plan; several frameworks, goals and milestones, from Premium.
Does Audexa answer the audit for me?
No. Audexa suggests answers with their source, flags what doesn't add up and tells you which gaps raise your score the most, but a person decides every answer. Nothing is answered or submitted on its own.
Request a demo
Let's prepare your ENS.
In 30 minutes we pick your category, walk through the measures it requires and look at policies, evidence and the action plan.
- We review your system's category.
- We show you measures, reinforcements and evidence.
- We explain which plan fits you.