Compliance: ENS, ISO 27001 and GDPR

It is the Spanish regulatory framework that establishes the principles and security requirements for the information systems of the public sector and its suppliers.

It is the international reference standard for information security management systems (ISMS). It certifies that an organization manages security systematically.

We cannot guarantee certification because the decision is made by the certifying body. What we do is a rigorous gap analysis, implement technical controls and generate evidence to make the process viable.

It is an assessment that compares the current state of your organization with the requirements of the regulatory framework, identifying the specific gaps that need to be solved.

ENS is mandatory for the Spanish public sector and its suppliers; ISO 27001 is a voluntary international standard applicable to any organization. They share many controls but have different scope and focus.

NIS2 is the European cybersecurity directive for essential sectors (energy, health, transport, digital). DORA is the European digital resilience regulation for the financial sector. Both require technical safety controls.

Both. We implement the real technical controls (hardening, encryption, monitoring, access) and generate the documentation and evidence for the audit.

Yes. We are available during the audit to resolve technical doubts and present the evidence we have prepared.

It depends on the current state and the framework. A typical ENS or ISO 27001 preparation requires several months of work. We give you a plan with milestones and deadlines.

It depends on the scope, regulatory framework, and current state of the organization. After the initial gap analysis, we give you a closed proposal with phases and budget.