In brief: ENS (Spanish National Security Framework) conformity is proven in two ways depending on the system's category: a self-assessed declaration of conformity in the BASIC category, and a conformity certification issued by an ENAC-accredited certification body in the MEDIUM and HIGH categories. None of this requires the auditor to have an office in Barcelona — the documentary review is done remotely, and the field visit only when the scope calls for it. Price depends on category, scope, number of sites and prior maturity, not on a fixed price list. I work from Valladolid and Las Palmas preparing companies across Spain, Catalonia included, for this audit: gap analysis, pre-audit and support on certification day.
An ENS audit in Barcelona is carried out by a certification body accredited by ENAC (the Spanish National Accreditation Body), not by a "local" auditor: these bodies operate across the whole of Spain, and their location does not limit your choice. In the BASIC category, self-assessment is enough; in the MEDIUM and HIGH categories, third-party conformity certification is mandatory and must be repeated at least every two years. Here I explain who can audit, the phases of the process, what determines the price, and how I prepare that audit for clients from outside Barcelona.
My name is Ángel Ortega Castro, and I help companies with the gap analysis and audit of the ENS. I work from Valladolid and Las Palmas, and I take on projects across the whole of Spain, Catalonia included. If you have landed here searching for an "ENS auditor in Barcelona", you are probably facing a tender specification that requires it, or about to. I am going to tell you how it really works: who can sign off your certificate, what is done remotely and what in person, how the price is calculated, and what depends on you to pass the audit the first time.
Who can audit the ENS in Barcelona (quick answer)
Not just anyone can audit the ENS, and the "in Barcelona" nuance matters less than it seems. What changes is not the city, but the category of your system and the type of conformity you need:
- BASIC category. Self-assessed conformity in the BASIC category is allowed: the organisation itself verifies that it complies and publishes its declaration of conformity. No external body needs to sign it, although it is worth having someone with sound judgement review it before you sign off on it.
- MEDIUM and HIGH categories. Conformity certification is mandatory and can only be issued by a certification body accredited by ENAC for the ENS scheme. That accreditation is what guarantees the auditor is independent and competent; without it, a "certificate" has no value before a contracting authority.
ENAC accreditation is national: the body that certifies you in Barcelona is the same one that certifies in Madrid, Bilbao or Valladolid. There is no separate register of "ENS auditors for Barcelona" apart from the rest of Spain. To check who is recognised, you can review the list of ENS-certified companies and compare categories, scope and validity. And if you want the regulatory detail on how often the review is repeated and who carries it out, I cover it in the article on how often the conformity audit is repeated and who performs it, based on Annex III of the ENS, which regulates the conformity audit.
Does the auditor have to be based in Barcelona? On-site and remote audits
No. The auditor's location does not limit your choice and, in practice, a good part of the work does not even require anyone to set foot in your office. It helps to separate the two parts of the process:
- What is done remotely. The documentary review — security policy, risk assessment, statement of applicability, procedures, evidence — is carried out remotely without any loss of quality. This is the bulk of the hours in a well-prepared audit.
- What usually requires a physical presence. Field verification (checking that what is documented is genuinely applied: physical access control, technical rooms, staff interviews, tests on specific systems) may require an on-site visit, especially in the HIGH category or when there are significant physical premises to protect.
The fact that the process allows for both remote and on-site work is exactly what makes the auditor's postcode irrelevant. Choosing a body for geographic proximity, rather than for its track record and experience in your sector, is optimising for the wrong variable. What genuinely helps is knowing the Catalan landscape well enough to understand what the tender specifications from the Generalitat and local authorities require — and that is solved with expertise, not physical proximity.
Phases of an ENS audit: from documentary review to certification
A conformity audit always follows the same sequence, whether your company is based in Barcelona or anywhere else. This table summarises each phase and where it takes place:
| Phase | What it involves | Where it happens |
|---|---|---|
| 1. Scope and planning | Defining which systems and services are audited, the applicable category and the schedule | Remote |
| 2. Documentary audit | Reviewing the management system documentation: policy, risk assessment, statement of applicability and procedures | Remote |
| 3. Field audit | Verifying that what is documented is applied: interviews, operational evidence and technical tests | On-site or remote, depending on category and scope |
| 4. Findings report | Documenting non-conformities and observations, classified by severity | Remote |
| 5. Corrective action plan | Resolving non-conformities within the agreed deadline | Internal work + remote review |
| 6. Certificate issuance | The accredited body issues the certification (or you publish the declaration, in BASIC), typically valid for two years | Remote |
Total duration varies widely: a few weeks for a small BASIC-category scope, up to several months for complex HIGH-category systems, always factoring in the time needed to resolve non-conformities. The timeline is set mainly by how well prepared you are for phase 2, not by the auditor's schedule.
How much does an ENS audit cost, and what determines the price
I am not going to give you a fixed figure, because that would mean making up your case. The cost of an ENS audit does not follow a price list; it depends on a handful of factors that increase or reduce the auditor's working days. These are the ones that genuinely move the needle:
| Factor | How it affects the cost |
|---|---|
| System category | The higher the category (BASIC, MEDIUM or HIGH), the more Annex II measures to verify and the deeper the audit |
| Scope | Number of systems, services and processes included: the broader it is, the more hours required |
| Number of sites | Several significant physical locations can multiply field visits |
| Technological complexity | In-house developments, cloud services or many applications extend verification |
| Prior maturity | Having ISO 27001 or a well-done gap analysis in place reduces findings and, therefore, cost and time |
| Pre-audit | An additional expense that usually pays for itself: it catches gaps before the official audit and avoids repeating phases |
To get a realistic and consistent sense of the ranges involved, cross-reference these factors with what I explain in the article on the process and costs of ENS certification. The practical rule is simple: every euro you invest in arriving prepared for the audit is a euro you do not spend on repeating phases and resolving non-conformities.
ENS for suppliers to Catalan public bodies: what the tender specifications require
The most common reason a Catalan company seeks ENS certification is a tender specification. If you provide, or want to provide, services to the Generalitat, the provincial councils (Barcelona, Girona, Tarragona or Lleida) or town councils, it is increasingly common for the contract to require you to prove conformity with the ENS, because you handle information or systems belonging to a public administration. The Consorci Administració Oberta de Catalunya (AOC), which coordinates e-government in Catalonia, is pushing precisely in that direction.
Two keys to reading the tender specification correctly:
- The category is set by the tender or the system, not by you. One contract may require MEDIUM-category conformity and another HIGH; certifying at the wrong level neither helps you bid nor saves you money. Check exactly what the tender specification requires before you take any action.
- The obligation cascades down. If you subcontract part of the service, your relevant subcontractors are also covered by it. It is worth planning for this in your own contracts.
I cover all of this in more detail in the guide on what the ENS requires from public administration suppliers in tenders and specifications. The underlying idea: the ENS is no longer just a public-sector matter; it is, increasingly, the key to entering its supply chain.
Working with an ENS consultant remotely (and on-site when needed)
I want to be transparent with you here, because this is where I see the most confusion. There are two distinct roles that cannot be mixed:
- The certification body is the one that audits and issues the certificate in MEDIUM and HIGH. It must be independent and accredited by ENAC. Because of that independence requirement, whoever helps you get ready cannot, at the same time, be the one who certifies you.
- The consultant — my role — is the one who prepares you: builds the management system, carries out the risk assessment, drafts the statement of applicability, fixes what fails and accompanies you through a pre-audit so you reach certification without surprises.
I work from Valladolid and Las Palmas, and that is precisely the advantage I offer you honestly: almost all of my work with you is remote — documentation, risk assessment, meetings, evidence review — and I travel to your premises when the project calls for it, in Barcelona or wherever you are. I am not selling you neighbourhood proximity; I am telling you that the ENS does not need your consultant to live in your city to do it well, and it does need someone who knows what they are doing. If that kind of preparation is what you are looking for, that is exactly what my ENS consulting service covers, designed for companies that want to bid for or become suppliers to the public administration.
How to prepare for the ENS audit to pass it the first time
Audits are not passed by luck: you either arrive prepared or you do not. These are the points I always review before putting a client in front of the auditor:
- A living risk assessment. Up to date, consistent with the system's category and traceable to the measures you have implemented.
- An honest statement of applicability. One that reflects what you genuinely apply, with justification for what you exclude. A dressed-up document falls apart at the field stage.
- Dated evidence. Incident management records, continuity test results and recent outcomes. Undated documents raise more suspicion than they avoid.
- Pre-audit. A dress rehearsal that catches non-conformities before the official auditor finds them, while they are still cheap to fix.
If you want the detail of this phase, I expand on it in the article on how to prepare for and pass the conformity audit. Preparation is, by far, the variable that most influences whether the audit is short, cheap and free of surprises.
Conclusion: choose based on expertise, not proximity
Getting audited for the ENS while based in Barcelona holds no geographic mystery: the certification is signed by a body accredited by ENAC that operates across the whole of Spain, most of the work is remote, and the price depends on your category, your scope and how prepared you arrive, not on distance. What decides the outcome is the quality of your prior preparation, and that is something you can control.
If you are facing a tender specification that requires the ENS, or you want to get ahead of it before it arrives, tell me about your case and we will look at it together, with no obligation.
Do you need to prepare for and pass the conformity review? Learn about my ENS audit service for companies and administrations across Spain, Catalonia included.
Frequently asked questions about ENS audits in Barcelona
Who can audit the ENS?
In the MEDIUM and HIGH categories, conformity certification can only be issued by a certification body accredited by ENAC (the Spanish National Accreditation Body) for the ENS scheme; that accreditation guarantees its independence and competence. In the BASIC category, self-assessment is allowed: the organisation itself verifies compliance and publishes its declaration of conformity, without needing a third party.
Can the ENS audit be carried out remotely from Barcelona?
For the most part, yes. The documentary review (policy, risk assessment, statement of applicability, procedures) is carried out remotely without any loss of quality. Field verification may require an on-site visit depending on the category and scope, especially in the HIGH category or when there are significant physical premises involved. The auditor's location does not limit your choice.
How long does an ENS audit take?
It depends on the scope and category: from a few weeks for a small BASIC-category scope to several months for complex HIGH-category systems, always factoring in the time needed to resolve non-conformities. The timeline is set mainly by how well prepared you are for the documentary phase, not by the auditor's schedule.
What happens if the audit finds non-conformities?
A corrective action plan is opened with a deadline to resolve them; the certificate is issued once the major non-conformities have been corrected. Catching them beforehand with a pre-audit reduces both cost and time, because they are far cheaper to fix before the official audit than after it.
Do I need the ENS to bid for contracts with the Generalitat or Catalan town councils?
More and more tender specifications require it from suppliers whose service handles information or systems belonging to the Catalan Administration. Before taking any steps, check the specific tender document and, above all, the category it requests (BASIC, MEDIUM or HIGH): certifying at the wrong level neither helps you bid nor saves you money.
Sources
- Royal Decree 311/2022 (ENS) · BOE.
- CCN-CERT · Spanish National Security Framework and conformity.
- ENAC · Spanish National Accreditation Body.
- National Cryptologic Centre (CCN) · CCN-STIC guides.
- Consorci Administració Oberta de Catalunya (AOC).
Content written by Ángel Ortega Castro for angelortegacastro.com. This is general guidance; for your specific case, check the requirements of your tender or contract and the current text of Royal Decree 311/2022 in the BOE.