What does Innguma's ENS certification cover?

What is the National Security Framework?

The National Security Framework (ENS) sets the security policy for the use of electronic means in the Spanish public sector. It is regulated by Royal Decree 311/2022, of 3 May, which replaced Royal Decree 3/2010. Its latest amendment, in the second additional provision, comes from Royal Decree 1125/2024, of 5 November, and has been in force since 7 November 2024^[1].

It is not limited to administrations. Article 2.3 extends it to the information systems of private-sector entities that provide services or solutions to public-sector entities, and requires the specifications of those contracts to include the requirements needed to ensure conformity with the ENS^[1]. That is why a technology provider to an administration usually needs a declaration or certification of conformity.

How is the category of a system determined?

The category is set by assessing the impact that an incident would have on five security dimensions: availability, authenticity, integrity, confidentiality and traceability (Article 40 and Annex I)^[1]. A system is in the MEDIUM category when some dimension reaches the MEDIUM level, which corresponds to serious harm, and none reaches the HIGH level. The higher the category, the more demanding the measures in Annex II and the way conformity must be demonstrated:

Source of the table: Article 38 of Royal Decree 311/2022^[1] and ENAC criteria^[2].

Who certifies, and how often is it audited?

• Accreditation of the certifier. In the MEDIUM and HIGH categories, the certification must be issued by an entity accredited by ENAC under the standard UNE-EN ISO/IEC 17065:2012. Without that accreditation it cannot issue conformity certifications^[2][3].
• OCA Global. The list of ENS certification bodies published by the National Cryptologic Centre (CCN) includes OCA Global (OCA Instituto de Certificación, S.L.U.) as an accredited entity since 30 October 2020^[4].
• Periodic audit. Systems are audited ordinarily at least every two years, and extraordinarily after any substantial modification, which restarts that period (Article 31)^[1].
• Badge and publicity. CCN-STIC guide 809, in its April 2026 edition, establishes that the conformity badge must include a link to the certification, and that the certification remain accessible on the organisation’s website or electronic headquarters^[3].

What exactly does Innguma’s certificate say?

• Certificate: no. 34/5704/24/05039.
• Scheme: National Security Framework, Royal Decree 311/2022.
• Category: MEDIUM.
• Scope: the information systems that support the managed watch services.
• Certification body: OCA Global, accredited by ENAC.
• Validity: until June 2028.

The full certificate can be consulted in PDF^[5].

How do you read the scope of an ENS certificate?

An ENS certificate covers the systems listed in its scope, at the category indicated, and for its validity period. When assessing any provider, check those three items on the certificate itself, not only on the badge:

1. Scope: which systems or services it covers. If what you contract is not described there, that certificate does not cover it; ask before signing.
2. Category: it must be equal to or higher than the one required by the specifications or by your risk analysis.
3. Validity: the validity date and, if more than two years have passed since issue, evidence of the following audit.
4. Certifier: that it appears as accredited on the CCN list.

Why does it matter if you are not a public administration?

For an administration, contracting a technology service requires the provider to comply with the ENS at the appropriate category. For a private company, the certificate is independent evidence that the systems handling its watch information, which is often strategic and not public within the organisation, apply audited security measures. In addition, Innguma integrates with the client’s Active Directory for corporate sign-in and centralised additions and removals, processes data in line with the GDPR, and does not train AI models on its customers’ data.