Public Administration suppliers
ENS at the system's category (Basic, Medium or High), with reviewable evidence for tenders and public contracts.
See ENS adaptation →REQUIREMENTS AND APPLICABILITY
What rule affects you and how to avoid duplicate work.
ISO 27001 provides international recognition; ENS is key for the Spanish public sector; NIS2 raises European standards for governance, continuity, incidents and supply chain. If they are designed together, they share controls and evidence.
| Criterion | ISO 27001 | ENS | NIS2 |
|---|---|---|---|
| What it is | International standard for information security and ISMS. | Mandatory Spanish framework for the public sector and its ICT suppliers. | European directive to strengthen cybersecurity of critical sectors and supply chains. |
| Who it applies to | Any company that wants to protect information, sell more trust or access demanding customers. | Public Administrations and private companies that provide services to the AAPP. | Essential or important entities and suppliers that may be affected by contractual requirements. |
| Mandatory | It is not always mandatory, but more and more clients require it as a requirement. | Yes when applied by RD 311/2022 or by public specifications and contracts. | It depends on sector, size, activity and national transposition; It is advisable to analyze applicability as soon as possible. |
| Indicative timeline | The schedule is agreed after assessment and depends on scope, maturity, internal availability and third parties. | ||
| Combination | It is advisable to address them in the same roadmap: inventory, risks, controls, evidence, incidents and suppliers can be reused. | ||
By sector
What usually applies depending on your activity.
This is the usual starting point; the diagnosis confirms what really applies to you.
Technology, software and managed services
ISO 27001 to build trust with B2B clients, together with cloud security, suppliers and web and API pentesting.
See ISO 27001 consulting →Industry and supply chain
NIS2 when the sector or a client requires it: critical suppliers, continuity and incident response.
See NIS2 adaptation →Health, education and professional services
GDPR as the baseline: access control, incident logging, security by design and role-based training.
See secure development →Finance and regulated environments
DORA: third-party risk, continuity and traceable controls that an audit can review.
Read about DORA →Websites, apps and platforms
Beyond compliance: pentesting and code review (OWASP Top 10) to reduce real risk.
See pentesting →Next step
Not sure which standard applies to you?
We review your sector, clients and contracts, and tell you what applies and where to start.