Information security management system
ISO/IEC 27001:2022 implementation
We implement your information security management system (ISMS) in accordance with ISO/IEC 27001:2022 and integrate it with the ENS when it also applies to you. We have been certified to ISO/IEC 27001 since 2020.
The standard
What ISO/IEC 27001 is
ISO/IEC 27001 is the international standard that defines the requirements for an information security management system. It is based on risk analysis and continual improvement: the organisation decides which controls it needs, applies them, measures their effectiveness and reviews them.
The current version, from 2022, organises its Annex A into 93 organisational, people, physical and technological controls. It is a common certification among technology companies that handle third-party data, and a good foundation for those who also have to comply with the ENS.
ENS + ISO/IEC 27001
A single system to comply with both schemes
The ENS and ISO/IEC 27001 share the same risk management logic. When integrated, you work with a single risk analysis, a common policy and documentation that serves for both audits.
| Aspect | ENS (RD 311/2022) | ISO/IEC 27001:2022 |
|---|---|---|
| Nature | Mandatory for the public sector and its suppliers (RD 311/2022). | Voluntary international standard. |
| Approach | Security measures determined by the system's category. | Management system with controls selected according to the risk analysis. |
| Measures or controls | Annex II: organisational and operational frameworks and protective measures. | Annex A: 93 organisational, people, physical and technological controls. |
| Key document | Statement of Applicability. | Statement of Applicability (SoA). |
| Conformity | Declaration (BASIC) or certification (MEDIUM and HIGH) by an accredited body. | Certification by an accredited body. |
| Audits | At least every two years. | Three-year cycle with annual surveillance audits. |
Methodology
ISMS implementation phases
-
Context and scope
Interested parties, legal and contractual requirements, and ISMS scope, aligned with the ENS scope where applicable.
-
Leadership and policy
Management commitment, security policy, objectives and roles.
-
Risks and SoA
Risk assessment and treatment and Statement of Applicability for the Annex A controls.
-
Deployment
Controls, procedures, training and awareness, and evidence log.
-
Internal audit
Internal audit and management review before certification.
-
Certification
Support during stages 1 and 2 of the certification body's audit.
Our own experience
Certified to ISO/IEC 27001 since 2020
We obtained the certification because our day-to-day work involves data from public and private sector organisations, and we maintain it alongside the ENS MEDIUM category. That is the system we use to develop the custom software and the solutions we install for our clients.
View our certifications
Frequently asked questions
Questions about ISO/IEC 27001
If I already have ISO/IEC 27001, do I comply with the ENS?
Not automatically. Much of the work can be reused (risk analysis, policy, controls and documentation), but the ENS has its own measures depending on the category and its own conformity process. That is why it makes sense to implement them in an integrated way.
Is ISO/IEC 27001 mandatory for working with the public sector?
It is not required by law, unlike the Spanish National Security Framework, but some tender specifications require it or score it as an award criterion.
What changed in the 2022 version of the standard?
Annex A went from 114 controls in 14 domains to 93 controls grouped into four themes: organisational, people, physical and technological. Eleven new controls were added, such as threat intelligence, information security for cloud services, secure coding and data leakage prevention.
How long does ISO/IEC 27001 certification last?
The certificate has a three-year cycle, with annual surveillance audits and a recertification audit at the end of the cycle.
Do you want to get certified to ISO/IEC 27001?
We propose an implementation plan integrated with the ENS and tailored to your organisation's scope.
