Where can I check Innguma's certificates?

Which certificates does Innguma hold?

• National Security Framework (ENS), MEDIUM category. Certificate no. 34/5704/24/05039, issued by OCA Global (accredited by ENAC), valid until June 2028, in accordance with Royal Decree 311/2022. Scope: the systems that support the managed watch services^[1].
• UNE 166006:2018. Certificate no. 34/5705/25/01139, issued by OCA Global, valid until January 2028. Scope: Innguma’s watch and intelligence system^[2].

What is the difference between accreditation and certification?

They are two different levels of trust. Certification is issued by a certification body after auditing a company: it states that a system meets a standard or a scheme. Accreditation is granted by ENAC, the National Accreditation Body, to that certification body: it states that the body is competent to certify. Under the ENS, certification of systems in the MEDIUM or HIGH category can only be issued by a body accredited by ENAC under the standard UNE-EN ISO/IEC 17065:2012^[3]. Checking a certificate therefore means checking both things.

Which details should you review on a certificate?

1. Holder: that the company name matches the company you are contracting with.
2. Certificate number, so that it can be cited and looked up.
3. Standard or scheme and its edition, for example UNE 166006:2018 or Royal Decree 311/2022.
4. Scope: which systems, services or processes it covers. A certificate does not necessarily cover all of a company’s activity.
5. Category, in the case of the ENS: BASIC, MEDIUM or HIGH.
6. Dates of issue and validity.
7. Certification body and, where the scheme requires it, its accreditation.

How is it confirmed, step by step?

1. Download the certificate from the Security and trust page and note its number, scope and validity.
2. Check the certification body on the CCN list. The list of ENS certification bodies published by the National Cryptologic Centre distinguishes between accredited bodies and those in process, and includes OCA Global as accredited since 30 October 2020^[4].
3. Search ENAC’s directory. It allows accredited bodies to be searched by company or by standard, and has a section on temporary suspensions and withdrawals of accreditation^[5].
4. Review the ENS certification register. The CCN publishes a list of public and private entities whose information systems have been certified under the ENS^[6].
5. Ask the certification body for confirmation. OCA Global issued both certificates and handles enquiries through its website^[7].

What signs should make you doubt?

• Only a logo or a badge is shown, without the certificate. Guide CCN-STIC 809 establishes that the ENS conformity badge must include a link to the certification, and that the certification remain accessible on the organisation’s website^[3].
• The validity date has passed, or the certificate is more than two years old without evidence of a new audit: the ENS requires an ordinary audit at least every two years (Article 31)^[8].
• The scope describes other systems or services from the ones you are going to contract.
• The ENS category is lower than the one the specification requires.
• The certification body of an ENS certificate in the MEDIUM or HIGH category does not appear as accredited.

When is it worth checking again?

At least at three moments: before awarding or signing, at each contract renewal, and as the validity date approaches. In Innguma’s case, the UNE 166006 certificate is valid until January 2028 and the ENS certificate until June 2028. If a public tender requires the ENS, keep in the file the PDF and the date on which you checked it.