ENS consulting and implementation in Madrid — local, on-site, audit-ready

Yes. Hard2bit has two offices in the Community of Madrid: Leganés (south of Madrid) and Las Rozas (west). We have operated since 2013. For meetings, steering committees, owner workshops or accompaniment during ENAC-accredited audit, we can be on-site.

No. The official ENS audit is performed by an ENAC-accredited certification body (in many Madrid projects, ACCM). Hard2bit does everything before and alongside: implementation, adequacy, risk analysis, evidence, accompaniment during the official audit and post-certification sustainment. The separation is the right one — a single provider should not be both certifier and consultant.

Yes. We work both with public bodies (municipalities and regional bodies) and with private tech providers holding contracts with Madrid public administrations. Knowledge of the ecosystem (tenders, timelines, counterparts) reduces friction during the project.

The regulatory framework is the same (RD 311/2022), but scope and approach differ. In public bodies, ENS usually applies to the entire system and categorization tends to be Medium or High. In private companies, ENS applies to the system or service under the public-sector contract, and scope can be defined with criterion. Methodology adapts to the case.

Typically 6 to 12 months to walk into audit with a clean sample, depending on category (Basic, Medium or High), number of in-scope systems, technical maturity and client team availability. Organizations with ISO 27001 in place can shorten timelines by reusing controls.

We work on demand with municipalities, autonomous bodies and entities tied to Madrid local government. For small municipalities, Basic with self-assessment is typical; for medium and large, Medium with ENAC audit. We adapt effort and timeline to the actual scope.

Both modes, depending on client preference and project phase. For initial diagnosis, key workshops, steering committees and accompaniment during the official audit, we recommend on-site whenever possible (Madrid makes this easy due to proximity). For documentation review, technical configuration and monthly reporting, remote.

Hard2bit is a client of ACCM: they audit and certify our own ENS HIGH every 2 years under ENAC accreditation. That professional relationship gives us real knowledge of the process from the audited side. We are not part of ACCM or ENAC; we are consultants who know the process from the outside.

Yes, and it usually pays off. A well-designed implementation allows reuse of policies, inventories, risk analysis, controls, evidence and reporting across ENS, ISO 27001, NIS2 and DORA. We explain how in the four-framework comparison.

For accompaniment during ENAC-accredited audit, owner workshops, executive sessions or close work with technical teams, on-site presence changes the outcome. Having the consultant 30 minutes away by car shortens feedback cycles and removes coordination friction when what matters happens in the room. Madrid is also the densest public-administration ecosystem in Spain — knowing that ecosystem matters.

It depends on target category (Basic, Medium, High), number of in-scope systems, starting maturity, documentation and technical scope, timeline and on-site/remote modality. The initial diagnostic session is always the first step to scope a proposal. Request it without commitment.

Yes. NIS2 coexists with ENS in many sectors (healthcare, energy, transport, public administration). We design projects with multi-framework lens to reuse evidence and reduce effort. The team covers ENS, ISO 27001, NIS2 and ISO 22301 with the same base methodology.