The Esquema Nacional de Seguridad (RD 311/2022): categorisation, security levels, required controls and what public-sector contracting demands.
Phishing simulations are only useful if you measure the right things. How to design realistic campaigns, which metrics matter, and how results count as ISO 27001 and ENS evidence.
Vulnerability scans and penetration tests answer different questions. What each one covers, how often to run them, and what ISO 27001 and ENS expect, using PHP2Shell as a worked example.
What an ISO 27001 Statement of Applicability must contain, how to decide which Annex A controls apply, how to justify exclusions and what auditors test in it.
What a virtual CISO is, what it handles in practice, how it differs from a full time CISO or an MSSP, and the signs a company needs one.
What has to keep running between one ENS audit and the next: operational measures, the records an auditor will ask for, changes that bring the audit forward, and who runs it.
A 2026 comparison of GlobalSuite, Complaion and Qalea for Spain's ENS: what each does well, who each is built for and who does each stage of the scheme.
How an ENS audit works: what sets the scope and category, when accredited certification is required, and the evidence the auditor checks in each framework.
A practical guide to choosing compliance software in Spain, built around the two questions that actually decide it: framework coverage including ENS, and whether the platform operates your security.
A Spanish public tender just demanded the ENS and you have never dealt with it. The two decisions that set cost and timeline, and what to do in a fortnight.
Where ISO 27001 and the Esquema Nacional de Seguridad genuinely overlap, where they do not, and how to build one management system that satisfies both.
How the Esquema Nacional de Seguridad decides whether your systems need a self-assessed declaration or a certification audit by an accredited body.
Leave us your data and we will get in contact with you shortly.
