When we first shared TICGAL’s ISO 27001 journey, we were completely honest about what it takes to build a bulletproof security culture, whether meeting global benchmarks or aligning with Spain’s Esquema Nacional de Seguridad (ENS). Drafting our entire Information Security Management System (ISMS) in Galician was a point of local pride, but changing daily habits—saying a permanent goodbye to mysterious USB sticks, ditching root passwords over SSH, and obsessively locking screens, took a genuine collective mindset shift.

The great news? That discipline has paid off. We recently completed our official audit under the updated UNE-EN ISO/IEC 27001:2022 standard, and the auditors gave us a complete stamp of approval.

What Is the ENS, and Why Is It stricter than ISO 27001:2022?

For those unfamiliar with Spanish regulatory acronyms, the Esquema Nacional de Seguridad (ENS) is Spain’s mandatory cybersecurity framework governed by RD 311/2022. It is overseen by the Centro Criptológico Nacional (CCN), the official national body responsible for safeguarding public administration systems.

While ISO 27001:2022 is a voluntary international standard that lets organisations define their own risk tolerance, the ENS is a legal mandate designed specifically for public sector bodies and the technology vendors supplying them. In simple terms: ISO 27001 asks you to manage your risks, but the ENS tells you exactly how to defend your systems.

It is noticeably stricter and far more prescriptive than ISO 27001:2022, setting compulsory technical baselines detailed in official CCN-STIC guides for logging, access control, cryptographic key management, and system resilience. If an organisation wants to host digital services, manage IT help desks, or process data for Spanish governmental bodies, proving ENS compliance is nonnegotiable.

Raising the bar: Setting sights on ENS Medium

We have never been interested in collecting certificates just to hang them on the wall. For a team based in Pontevedra delivering open-source GLPI solutions, mobility apps, and IT service management across the globe, tackling the national public sector standard is the natural next step.

We aimed straight for the ENS Medium category. Unlike the Basic level,which allows organisations to self-assess,the Medium category requires a rigorous external audit by an accredited certification body. Fortunately, because our ISO 27001:2022 foundation already satisfies most organizational requirements, a crosswalk explicitly mapped out by CCN-STIC guidance, we are well positioned to meet these stricter government controls.

What This Means for our Clients

We believe in productising our internal hard work. By elevating our infrastructure to meet ENS Medium expectations and CCN standards, we pass those exact security benefits straight on to the organisations that rely on us. Have you heard about Suply Chain? We are part of the chain.

Whether you use our hosted GLPI environments, Gapp mobile solutions, or custom IT integrations, you get software that is pre-hardened against threats and fully prepared to satisfy government-level scrutiny. Local roots, global standards, and an aim to zero compromise on security.