The ENS when an industrial plant is involved
The Spanish National Security Framework (ENS, Royal Decree 311/2022) applies to the Spanish public sector and the companies that provide it with services. If your company operates water, waste, transport or any infrastructure for a public authority, the ENS is your framework.
The ENS is often thought of as something for “public authorities and paperwork”, but that view misses the important point: much of the infrastructure operated for the public sector is industrial. Wastewater and drinking-water treatment plants, transport systems and port facilities use SCADA, PLCs and remote control, all of which fall within scope when the service is provided to a public authority.
The framework classifies each system as basic, medium or high according to the impact of an incident. The category determines which Annex II measures are mandatory and the level of rigour required. Compliance is self-declared for the basic category or certified by an accredited body for medium and high categories, and public tenders increasingly require it as a condition of contract.
| Requirement | What it means in OT |
|---|---|
| System categorisation | If the system controls an essential physical process, availability is paramount: its category increases because of the impact of downtime, not the data it handles. |
| org — Organisational framework | Security policies and owners that also cover OT. The system owner must know that the system includes an industrial plant. |
| op.pl — Planning | Documented security architecture: in OT, the zones-and-conduits diagram and asset inventory are that documentation. |
| op.acc — Access control | Named accounts, least privilege and MFA for remote access, including contractors and remote-control systems. A shared maintenance account is a direct breach. |
| op.exp — Operations | Inventory, configuration management, maintenance and change management for control systems; sufficient activity logging to reconstruct an incident. |
| op.mon — Monitoring | Intrusion detection and event management on the industrial network as well: an OT sensor and someone to monitor it. |
| op.cont — Continuity | Impact analysis, a continuity plan and regular tests that include the physical process and configuration backups for control equipment. |
| mp — Protection measures | From physical protection of control rooms to media erasure: plants have PLC cabinets in passage areas, and they are part of the scope. |
| Compliance certification | For medium and high categories, an audit by an accredited certification body every two years, supported by evidence; for basic, self-assessment and declaration. |
If you provide services to the public sector using industrial infrastructure, the usual path is:
- OT assessment — categorisation and the Annex II gap analysis begin with knowing what is there.
- IT/OT segmentation — covers most of op.pl and op.acc in the industrial environment.
- Managed IT/OT services — op.mon with analysts who understand remote-control systems.
- Managed inventory — op.exp with continuous evidence, ready for the biennial audit.