ENS security measures, evidenced at every category.

The Esquema Nacional de Seguridad (ENS) is Spain's national security framework for public sector information systems, currently defined by Royal Decree 311/2022, which replaced the original Royal Decree 3/2010. It applies to Spanish public administration entities and, importantly, to private sector suppliers whose systems provide services to them, making ENS conformity a de facto market requirement for selling technology services to the Spanish public sector. Systems are categorized BASICA, MEDIA, or ALTA based on the impact a security incident would have, and Annex II assigns security measures accordingly across three groups: organizational framework, operational framework, and protection measures. The Centro Criptologico Nacional (CCN) supports implementation with its CCN-STIC guidance series, and conformity at MEDIA and ALTA is certified by accredited certification bodies. The operational framework's security configuration and monitoring measures are configuration state at heart, which is what CISGuard verifies continuously through CIS benchmark scanning.

ENS measure op.exp.2 requires systems to be configured securely before entering service, and op.exp.3 requires that security configuration to be managed continuously thereafter. That pair describes CISGuard's core loop exactly: a hardened baseline drawn from CIS Benchmarks, scheduled scans verifying every system against it, and drift detection flagging any divergence, with the whole history preserved as evidence. The rigor scales with category: higher categories demand stronger, more continuously demonstrated measures, and CISGuard's scan frequency, coverage reporting, and historical trends give MEDIA and ALTA systems the sustained proof their audits expect. Audit logging configuration is verified for op.exp.8, and account, privilege, and authentication settings evidence the op.acc access control measures. The Framework Coverage Report presents each mapped measure area with satisfaction status, timestamps, and underlying scan results, ready for the conformity audit. Spanish public bodies and their suppliers can deploy CISGuard fully on-premises or air-gapped, keeping evidence within national infrastructure. CISGuard does not grant the ENS Certificacion de Conformidad; accredited certification bodies do, using evidence like this.