Your ENS conformity, control by control, with the evidence in front of you.
For public administrations and suppliers with limited IT: HodeiShield scores 74 controls of its own, based on Annex II of RD 311/2022, by basic, medium and high category, and shows what is missing before the audit.
- ENS (Medium) certified, no. 34/5704/26/09103 · Hodeitek S.L., with a scope that includes the HodeiShield SaaS service
- Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path
What the ENS requires, in brief
The ENS sets the principles and minimum security requirements for public-sector information systems and for those who serve the public sector.
Informational summary, not legal advice. Consult the official text and the guides of Spain's National Cryptologic Centre (CCN).
- Category by impact
- Each system is categorised as Basic, Medium or High from the level of five dimensions: availability, authenticity, integrity, confidentiality and traceability.
- Annex II measures
- Measures are grouped into an organisational framework, an operational framework and protection measures. The higher the category, the more measures apply and the more demanding they are.
- External services and the supply chain
- The operational framework covers external services: contracting, day-to-day management and supply-chain protection. This is where your suppliers enter your conformity.
- Demonstrable conformity
- Basic-category systems issue a declaration of conformity; Medium and High systems go through a certification audit.
Three categories, each demanding more than the last
The category follows the highest level among the five dimensions. HodeiShield stores it in your system profile and scores the measures that apply; deciding the category is up to you.
Basic
Comply and declare
The entry level. Conformity is assessed and a declaration is issued.
Medium
Comply and certify
More measures, more demanding versions of the existing ones, and a formal audit to certify conformity.
High
Highest demand
Measures at their highest level of demand and the same certification audit.
HodeiShield scores all three categories across the set of 74 controls based on ENS Annex II.
From each ENS obligation to a HodeiShield capability
What the platform does with each requirement and where it falls in the cycle.
Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.
- Obligation:
Categorise the system and set its profile
Annex I
What HodeiShield does:You record your system's category and security dimensions; that profile decides which measures apply. Deciding the category is yours.
Docs · Compliance (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Apply the security measures for the category
Annex II
What HodeiShield does:Breaks the ENS into HodeiShield's 74 controls, scores each one by basic, medium and high category and shows aggregate progress.
Docs · Compliance (opens in a new tab)PhaseSENSEPREDICTScopeDirect - Obligation:
Back each measure with evidence
Annex II
What HodeiShield does:Every piece of evidence has an owner, a validity date and a status; expired evidence stops counting until renewed. Evidence is uploaded or linked by hand.
Docs · Compliance (opens in a new tab)PhaseSENSEScopeDirect - Obligation:
Control external services and the supply chain
Operational framework (op.ext)
What HodeiShield does:Dependency graph, token-based supplier questionnaires, periodic external scanning, daily CVE sync and supplier SBOMs. Service-level agreements are yours to negotiate.
Docs · Risk engine (opens in a new tab)PhaseSENSEPREDICTScopePartial - Obligation:
Keep systems updated and watch for vulnerabilities
Operational framework
What HodeiShield does:The endpoint agent reports 172 checks as signed observations. The open baselines it includes do not yet feed the ENS score.
Docs · Endpoint agent (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Prioritise and plan the road to conformity
Continuous improvement
What HodeiShield does:A roadmap prioritised by control weight and effort. HodeiAI can propose an entry in the risk register; a person with a write role approves it.
Docs · HodeiAI (opens in a new tab)PhasePREDICTACTScopeDirect - Obligation:
Show your status to a customer or contracting body
Declaration / certification
What HodeiShield does:Trust Center and an ATTEST attestation with the band per framework, verifiable offline. It proves integrity and origin, not that the evidence is true.
Docs · ATTEST verifier (opens in a new tab)PhaseATTESTScopePartial - Obligation:
Conformity audit and certification
Medium and High categories
What HodeiShield does:Carried out by an accredited certification body. HodeiShield prepares your evidence; it does not audit or certify.
PhaseOutside the cycleScopeNot covered
What HodeiShield does not do with the ENS
So you decide with the full picture.
It does not certify your organisation's ENS
Hodeitek S.L. is certified at ENS Medium category and the scope includes HodeiShield, but that does not certify your organisation. HodeiShield is also not in the CPSTIC catalogue, which is a different thing.
It does not audit or declare conformity for you
The score guides your work. The declaration or certification of conformity is issued by you or by an accredited body.
It does not collect evidence from the cloud by itself
Documentary evidence is uploaded or linked. Cloud collectors are planned, not operational.
It does not tell you that you are audit-ready
Audit readiness depends on your evidence. HodeiShield shows what is missing and what expires, nothing more.
Questions about the ENS
Straight answers, with their limits.
Is HodeiShield ENS-certified?
Yes. Hodeitek S.L. is certified at ENS Medium category (certificate no. 34/5704/26/09103, OCA Instituto de Certificación) and the certification scope includes the HodeiShield SaaS service. That does not certify your organisation's ENS: HodeiShield measures your posture. The CPSTIC catalogue is a different thing and we do not claim it.
Which category applies to me?
Your organisation sets it under Annex I: the highest level among the five security dimensions. HodeiShield stores the result in your system profile but does not decide it for you.
I supply a public administration. Does the ENS affect me?
The ENS also reaches private entities that provide services or solutions to the public sector. Which category and measures apply depends on the system and the contract; your public customer or your advisers can pin that down.
Does it replace the certification audit?
No. It organises your evidence and shows what is missing so you reach the audit with fewer surprises. Certification is granted by an accredited body.
Does endpoint telemetry count towards the ENS score?
Not yet. The agent's open baselines are shown as endpoint evidence, but they do not feed the compliance score.
Where is the data hosted?
In the EU: application, database and storage managed by OVH in Gravelines (France). Cloudflare, in the US, acts as DNS, CDN and TLS on the request path.
Measure your ENS with a generalist IT person in the room
In the demo we load a sample system profile and walk through the controls, the evidence and the roadmap.
No commitment. We also tell you what HodeiShield does not cover.