When it fits
Technology companies, managed service providers, software vendors and contractors delivering systems or services within the scope of the Spanish ENS who already work on it and want to know whether the implementation will withstand the certification audit.
Why look closer
Royal Decree 311/2022 establishes an information security framework for covered systems and services. Requirements and conformity mechanisms differ by categorisation and circumstances.
What's included
- Scope and ENS category determination
- Independent review against RD 311/2022, not a from-scratch build
- Policy and documentation review
- Mapping against your existing ISO 27001: what already counts, what needs adapting
- Technical evidence review and remediation plan
- Mock audit and certification-audit preparation
Can the software do all of this?
Automated ENS checklists save time, but if a system's impact is categorised incorrectly the entire downstream assessment may be misleading. Policy uploads also do not prove recoverability.
How it works
- Asynchronous document reviewYou upload policies, risk assessment and evidence to a secure data room. Review happens flexibly, without blocking your team.
- Bundled interview slotsInstead of days on site: precisely timed calls of 45 to 60 minutes, bundled into a maximum of 2–3 days.
- Report and closing meetingWritten findings plus a virtual review meeting.
Your result
A written report with prioritised findings, a remediation plan and preparation for the certification audit.
Scope and limits
Preparation is carried out independently. Formal certification, where applicable, is issued by an accredited certification body.
We are auditors and consultants, not lawyers. This service is not legal advice.