National Security Framework

Data centers must assess and implement security controls corresponding to one of three ENS certification levels: Basic (minimal criticality systems), Medium (moderate risk systems handling sensitive data), or High (critical infrastructure systems with national security implications).

Each level prescribes a specific subset of the 75 available controls with escalating technical rigor—for example, High level requires cryptographic key management using certified algorithms, while Basic level may allow simplified authentication.

Data center operators must document their assigned level through formal assessment by accredited evaluators and maintain compliance through annual re-certification activities.

ENS mandates establishment of a formal Security Management Organization within data center operations, including appointment of a Chief Information Security Officer, creation of information security committees, and delegation of security responsibilities across infrastructure, operations, and personnel functions.

This requirement extends beyond technical controls to encompass governance processes: documented security policies, risk management procedures, and formal change management procedures specifically addressing how infrastructure modifications undergo security impact assessment before implementation.

Data centers must implement cryptographic protections for sensitive government data using algorithms approved by Spain's National Cryptologic Center, specifically excluding non-validated or foreign cryptographic standards without explicit authorization.

Requirements include hardware security module (HSM) deployment for cryptographic key generation and storage, documented key lifecycle management procedures, and quarterly key rotation schedules for systems classified at Medium or High levels.

All cryptographic implementations must comply with Spanish Royal Decree standards and undergo technical validation before deployment.

ENS specifies detailed physical security requirements including restricted access zones with multi-factor biometric authentication, 24/7 video surveillance with minimum 90-day retention, environmental monitoring (temperature, humidity, power stability) with automated alerts, and segregated cabling infrastructure for critical systems.

Data centers must implement perimeter security, visitor management protocols requiring identity verification and escort procedures, and physical asset inventory controls with tamper-evident sealing for critical components.

Implementation requires role-based access control (RBAC) with formal role definition, principle of least privilege enforcement, and mandatory multi-factor authentication for administrative access to government systems.

ENS specifies that all access decisions must be logged with user identification, timestamp, and action performed; these logs must be retained for minimum 12 months and protected from tampering.

Privileged account management must include segregated administrative workstations, session recording for sensitive operations, and quarterly access reviews with documented justification for each permission.

Data centers must establish documented incident response procedures aligned with Spanish National Security protocols, including 24/7 security monitoring capabilities, automated alerting for critical events, and mandatory incident reporting to the Centro Criptológico Nacional within defined timeframes for security breaches involving government data.

Requirements include maintaining security incident logs with forensic integrity, conducting root cause analysis for Medium/High level incidents, and implementing corrective actions with evidence of effectiveness.

ENS mandates quarterly vulnerability assessments and annual penetration testing by independent qualified assessors, with documented remediation of identified vulnerabilities within specified timelines based on severity classification.

Data centers must maintain configuration management databases showing baseline configurations for all systems, implement automated security scanning tools approved for government use, and conduct annual system security reviews demonstrating measurable improvement in security posture metrics.

All personnel with access to government systems must undergo background security clearance processes, receive mandatory annual security awareness training, and sign formal information security agreements.

Third-party contractors and service providers must contractually commit to ENS compliance, undergo equivalent vetting procedures, and be subject to surprise security audits.

Data centers must maintain personnel access records documenting authorization dates, privilege levels, and termination procedures that include immediate credential revocation and physical access card deactivation.