Cybersecurity for Spanish public administration — ENS adequacy, NIS2 compliance and recurring operations on the client's side

Yes. Spanish RD 311/2022 establishes the ENS obligation for the entire Spanish public sector, including city councils, autonomous communities, provincial councils, autonomous bodies, state agencies, public foundations and linked entities. The applicable category (Basic, Medium or High) depends on impact across DICAT dimensions and on services provided to citizens.

No. The official ENS audit is performed by an ENAC-accredited certification body (in many projects, ACCM). Hard2bit is a consultant: we implement, adapt, prepare evidence and accompany clients during the audit with the certification body. Separation between certifier and consultant is the right model and what serious public-sector buyers expect.

Yes. We adapt effort and modality to size: for small municipalities, Basic category with self-assessment plus vCISO is typical; for mid-sized ones, Medium with ENAC-accredited audit. Provincial councils or island councils often offer shared platforms worth leveraging to avoid duplicate effort.

It's a common, manageable scenario when handled well. ENS adequacy responsibility lies with the public entity (it's the data controller and system owner), not the specific provider. The change requires updating inventory, contracts, access, keys and traceability of the new services; the audit must accept the transition if documented. We accompany that transition without breaking the cycle.

Spanish public administration is an essential sector under NIS2 when it exceeds national transposition thresholds. ENS and NIS2 coexist and share most evidence if the project is designed with shared traceability. We explain it in the framework comparison.

We work with Spanish public-sector entities at ENS High category, which covers most institutional non-classified scenarios. For classified information processing (under ENS or specific defense regulation), additional accreditation requirements apply and are assessed case by case before scope is committed.

Typically between 6 and 12 months to walk into audit with a clean sample, depending on category, number of in-scope systems, technical maturity and internal staff availability. Entities with ISO 27001 already in place or that reuse parent-administration platforms can shorten the timeline significantly.

Yes. The 24/7 retainer includes activation in minutes, preventive hours bundle and prior readiness onboarding on the entity's architecture. Designed especially for municipalities and small entities where in-house DFIR doesn't exist and ransomware doesn't wait for office hours.

Yes. The CCN-STIC body of guidance from Spain's National Cryptologic Centre is the standard technical reference for implementing ENS in real Spanish public-sector systems. We use it as operational basis for hardening, per-product configuration, incident management and security architecture, complemented with internal guidance and project experience.

When applicable (responsible regional ministry, ministry, provincial council, NIS2 competent authority or CCN-CERT for incidents), we prepare reporting in the format useful for that interlocution. The formal line with the parent administration is always handled by the public entity; we provide the technical information and necessary evidence.

The e-government portal and citizen services (citizen census, tax collection, registry, appointments) are usually the most exposed assets and have the highest reputational impact when down. We treat them as critical scenarios in DICAT categorization, in pentesting and in continuity plans. An e-government portal outage is an event citizens see and councils judge.

We operate with strict confidentiality commitment as standard practice. We don't publish nominative references of public-sector clients on landing pages or public materials. Specific details handled in direct conversation.