Primary references
Use the original standards below to check terminology and requirements. These references explain the standards; they do not endorse CISGuard or independently verify its product coverage.
← Home
Spain Compliance Automation
ENS, CCN, and Spanish NIS2, continuously evidenced.
CISGuard automates the technical-controls layer underpinning ENS (Esquema Nacional de Seguridad), the Spanish NIS2 transposition, and AEPD/RGPD technical measures, covering ENS Categoría ALTA / MEDIA / BÁSICA from a single CIS scan.
Quick Facts
Spain compliance at a glance, in one place.
The regulators, frameworks and deployment options that shape compliance in Spain.
- Primary cybersecurity authority
- Centro Criptológico Nacional (CCN)
- Privacy regulator
- AEPD (Agencia Española de Protección de Datos)
- Frameworks
- ENS, NIS2 (Spanish transposition), RGPD/LOPDGDD, ISO 27001
- ENS categories
- BÁSICA, MEDIA, ALTA (three certification levels)
- ENS scope
- Mandatory for Spanish public sector + supply chain
- ENS ALTA
- Most demanding Spanish certification, air-gapped acceptable
- Sovereign cloud
- OVH (ES), Telefónica, Acens, Open Telekom Cloud (ES)
- Deployment
- On-premises in Spain or EU sovereign cloud
Regulatory Landscape
Compliance in Kingdom of Spain.
Spain operates the most prescriptive national-cybersecurity certification scheme in the EU. ENS (Esquema Nacional de Seguridad), administered by CCN (Centro Criptológico Nacional), is mandatory for Spanish public sector and the supply chain that serves it. ENS defines three categories (BÁSICA, MEDIA, ALTA) corresponding to data-sensitivity tiers, with explicit technical and organizational requirements at each level. ENS ALTA in particular is one of the most demanding national certifications globally. The Spanish NIS2 transposition (Real Decreto-ley) expands the scope of NIS-style obligations to essential and important entities. AEPD (Agencia Española de Protección de Datos) supervises RGPD with parallel enforcement to the broader EU GDPR regime. The technical-controls layer for ENS, NIS2, and RGPD is largely common (CIS benchmarks, ISO 27001 derivatives) and CISGuard maps a single scan to all three.
Frameworks
Frameworks CISGuard maps for Spain.
Each scan generates per-framework reports showing satisfied / partial / not-met status.
| Framework | Scope | Authority |
|---|---|---|
| ENS | Esquema Nacional de Seguridad (BÁSICA / MEDIA / ALTA) | Centro Criptológico Nacional (CCN) |
| NIS2 (Spanish transposition) → | Real Decreto-ley implementing EU NIS2 | CCN + sector regulators |
| RGPD / LOPDGDD → | EU GDPR + Spanish Organic Data Protection Law | AEPD |
| ISO/IEC 27001 → | International ISMS standard | ENAC-accredited certification bodies |
| Real Decreto 311/2022 | ENS regulation reform (May 2022) | CCN |
Data Residency
Sovereignty and residency, solved by architecture.
ENS certification requires technical evidence aligned with CCN's detailed control catalog. ENS ALTA in particular requires either Spanish-region deployment or air-gapped operation depending on data sensitivity. The Spanish NIS2 transposition adds 24-hour incident notification to CCN. AEPD's enforcement methodology examines technical-measures evidence in the format CISGuard produces. CISGuard's on-premises and EU sovereign cloud deployment (with Spanish-region options) satisfies these requirements; air-gapped operation is supported for ENS ALTA classified workloads.
Deployment Options
Three ways to deploy in Spain.
Option 01
On-premises in Spanish data center
Single-tenant deployment in customer-controlled Spanish infrastructure. Standard for public sector, telecoms, and ENS ALTA-pursuing enterprises.
Option 02
Spanish or EU sovereign cloud
OVH (Spain region), Telefónica Cloud, Acens, or Open Telekom Cloud (Spain). Aligned with ENS expectations for cloud service provider deployment.
Option 03
Air-gapped (ENS ALTA classified)
For ENS ALTA classified workloads where outbound connectivity is prohibited. CIS benchmark updates ship via signed media; zero outbound network required.
Frequently Asked
Spain questions, answered directly.
Does CISGuard support ENS BÁSICA, MEDIA, and ALTA categories?
Yes. CISGuard's ISO 27001 Annex A mapping covers the technical-controls layer of ENS across all three categories. The Framework Coverage Report includes per-category satisfaction status, allowing organizations pursuing ENS ALTA certification to validate the strictest controls while maintaining the broader BÁSICA/MEDIA evidence for non-classified workloads.
How does CISGuard support the Spanish NIS2 transposition?
The Real Decreto-ley transposing NIS2 into Spanish law designates CCN as a primary operational authority. CISGuard automates Article 21 technical risk-management measures continuously, with drift detection feeding the 24-hour incident notification window via SIEM integration. ENS-certified organizations satisfy substantial NIS2 technical obligations through existing ENS evidence.
Will CCN accept CISGuard evidence during ENS certification audits?
That is CCN's decision. CISGuard does not map ENS directly; its CIS benchmark results, scan timestamps and exception register serve as technical evidence, including for surveillance audits between full certification cycles.
Is CISGuard compatible with Spanish sovereign cloud?
Yes. CISGuard deploys cleanly on OVH (Spain region), Telefónica Cloud, Acens, Open Telekom Cloud (Spain), and AWS/Azure Spanish regions. The architecture is portable across hypervisors and cloud platforms because scanning happens via native target control surfaces, with no cloud-vendor lock-in.
Does CISGuard help with AEPD enforcement and DPIA technical measures?
Yes. RGPD Article 32 + LOPDGDD require technical and organisational measures appropriate to risk. CISGuard's continuous CIS benchmark posture, drift detection logs, and Framework Coverage Reports provide the technical-measures evidence AEPD enforcement actions and DPIA reviews require. Article 30 records-of-processing supporting evidence is auto-generated from scan output.
Ready to deploy in Spain?
Our compliance engineers have helped organizations across Spain achieve regulatory readiness through a seamless, fully managed deployment.