I am Ángel Ortega Castro, an independent ENS consultant with active presence in the Canary Islands. I guide companies in Las Palmas de Gran Canaria through compliance with the Esquema Nacional de Seguridad (ENS) — Spain's national cybersecurity framework for public-sector suppliers, governed by RD 311/2022 — so they can bid and provide services to the Gobierno de Canarias, the Cabildo de Gran Canaria and the city council with full regulatory assurance.
Las Palmas de Gran Canaria hosts an unusually dense concentration of public administration within the archipelago. Institutions from all three tiers of government have their headquarters or regional offices here, and all are required to comply with the Esquema Nacional de Seguridad (ENS) under RD 311/2022 (BOE-A-2022-7191, of 3 May). That obligation extends expressly to the supply chain: any private company providing ICT-related services or solutions to these bodies must demonstrate ENS conformity.
The Gobierno de Canarias maintains numerous regional departments, autonomous bodies and agencies in Las Palmas de Gran Canaria, including the Servicio Canario de Salud, the Servicio Canario de Empleo and the Agencia Tributaria Canaria. All of these manage information systems that process data for millions of residents and fall within the scope of the ENS. When they procure digital services — software development, infrastructure management, cloud computing, technical support or technology consulting — tender specifications require suppliers to accredit their conformity with the regulation.
The Cabildo de Gran Canaria, the island council responsible for roads, social services, tourism, the environment and economic development, is one of the largest public contracting authorities on the island. Its ICT tenders increasingly include ENS conformity requirements as a criterion of technical standing. The same applies to the Ayuntamiento de Las Palmas de Gran Canaria, the most populous municipality in the Canary Islands, with dependent entities such as EMALSA (water and sanitation) and Guaguas Municipales: any supplier processing data or managing systems for these bodies falls within the mandatory scope of the ENS.
The Universidad de Las Palmas de Gran Canaria (ULPGC), a public university with several campuses across the island, is also subject to the ENS in its academic, administrative and research information systems. Companies providing software or technology services to the ULPGC must therefore factor in ENS requirements from the very start of any procurement process.
Regional departments, autonomous bodies and agencies based in Las Palmas. Their ICT suppliers must accredit ENS conformity.
Island council with broad competences. ICT tenders include ENS conformity as a criterion of technical standing.
The most populous municipality in the Canary Islands, with its own dependent entities. Suppliers are reached by the ENS supply-chain obligation.
Public university subject to the ENS. Companies providing software and services to the ULPGC fall within the scope of the obligation.
The Canary Islands are not part of the EU VAT territory. The indirect tax applicable in the archipelago is the IGIC (Impuesto General Indirecto Canario) — the Canarian General Indirect Tax — governed by Ley 20/1991, with rates generally lower than mainland VAT. This feature of the Régimen Económico y Fiscal (REF) de Canarias affects invoicing for the service, but in no way affects the regulatory obligation itself.
RD 311/2022 applies across the entire national territory, including the Canary Islands, with identical technical and documentary requirements. The system category, the measures in Annex II and the conformity process are the same regardless of where the company is registered. What differs is that, when working with a Canarian company, the consulting invoice is issued with IGIC rather than VAT. This is a practical and accounting matter, not a difference in regulatory scope. It is also worth noting that certain companies operating under the Zona Especial Canaria (ZEC) that provide services to the public sector are equally subject to the ENS for the systems affected by that contractual relationship.
My ENS consulting is exactly the same for Canarian companies as for those on the mainland: gap analysis, categorisation, risk assessment (MAGERIT), compliance plan, Statement of Applicability and implementation of measures. The complete ENS guide covers every step of the process.
The compliance process follows the ENS framework phases and the CCN-STIC guides published by the National Cryptology Centre. Each phase produces a deliverable that builds on the previous one. I work with you from start to finish: I do not hand over documents and disappear.
| Phase | What we do | Reference and deliverable |
|---|---|---|
| Phase 01 Gap analysis |
Differential analysis between your current situation and ENS requirements. Definition of scope and the information systems in scope, including those serving Canarian public bodies. | Gap analysis / diagnostic report showing the real distance from compliance. |
| Phase 02 Categorisation |
Assessment of systems across the five security dimensions (CIDAT) and assignment of category: basic, medium or high. | Annex I of the ENS. Determines the applicable category based on the potential impact of an incident. |
| Phase 03 Risk assessment |
Identification of assets, threats and safeguards using the MAGERIT methodology. | MAGERIT risk assessment report and risk treatment plan. |
| Phase 04 Compliance plan + SoA |
Security policy, selection of measures and drafting of the Statement of Applicability (SoA / DdA), justifying each applicable control. | Guide CCN-STIC 806. Compliance plan and statement of conformity. |
| Phase 05 Implementation |
Deployment of Annex II measures: organisational, operational and protection framework. Hands-on support for your team in Las Palmas. | Implementation of Annex II measures with auditable evidence. |
| Phase 06 Audit readiness |
Pre-assessment review and support throughout the conformity process. For medium or high category systems, preparation for the audit by the ENAC-accredited body. | Annex III. I prepare your organisation; the certificate is issued by the accredited body. |
A system's category is determined by assessing the impact that a security incident would have across the five CIDAT dimensions (confidentiality, integrity, availability, authenticity and traceability). The dimension with the highest level determines the overall category. This is not a subjective estimate: it is the result of a technical analysis of each specific system.
When an incident would cause limited harm to the organisation's functions or to individuals. Common in lower-criticality digital services.
When an incident would cause serious harm. At least one dimension reaches the medium level.
When an incident would cause very serious or irreparable harm. At least one dimension reaches the high level.
For basic category systems, conformity is accredited through a self-assessed declaration of conformity: the organisation itself verifies compliance against the CCN-STIC guides. I prepare all the documentation and evidence so your declaration is robust and will withstand scrutiny from any Canarian public contracting authority.
For medium or high category systems, the regulation requires certification by an ENAC-accredited body under standard ISO/IEC 17065:2012. I prepare your organisation to pass it; the certificate is issued by the accredited body, never by the consultant. That honesty is what sets genuine advisory apart from hollow promises.
You do not receive a PDF that nobody ever opens again. You receive the documentary and technical body that sustains conformity and that the Cabildo, the Gobierno de Canarias or any other Canarian public body needs to see in the tender specifications.
I am Ángel Ortega Castro, an independent consultant specialising in regulatory compliance and information security, with active presence in the Canary Islands. I guide companies in Las Palmas de Gran Canaria and across Gran Canaria through compliance with the Esquema Nacional de Seguridad (ENS), so they can operate with full assurance in the archipelago's public procurement market.
I understand the Canarian administrative ecosystem: the Gobierno de Canarias, the island councils (Cabildos) and the major municipalities each have their own procurement cycles and their own technical standing requirements. My work is to translate RD 311/2022 into concrete decisions for your team and leave your organisation self-sufficient in maintaining conformity once the project concludes.
I am transparent about what I can and cannot do: I prepare and align your organisation for conformity; certification in medium or high category is issued by an ENAC-accredited body. That clarity from day one is what distinguishes genuine advisory from a promise without substance.
Developers, system integrators and SaaS providers serving regional departments or agencies of the Gobierno de Canarias who need to accredit ENS conformity to renew or extend their public contracts.
Organisations in Las Palmas submitting offers to the Cabildo de Gran Canaria, the city council or their dependent entities, and finding the ENS listed as a technical standing requirement in the tender specifications.
Companies developing applications, managing infrastructure or providing data services to the Universidad de Las Palmas de Gran Canaria that must accredit ENS compliance under current or future contracts.
There is no single figure, and you should be cautious of anyone who provides one without understanding your situation. The investment depends on the scope (how many systems), the category (basic, medium or high), your current maturity and whether you need accredited certification or whether a self-assessed declaration of conformity suffices.
Bear in mind that consulting invoices in the Canary Islands are issued with IGIC (not VAT). For medium or high category systems, the consulting fee must be supplemented by the cost of the ENAC-accredited certification body, which is an independent third party that invoices separately for the audit.
Yes, when the services or solutions they offer involve an ICT component and form part of the supply chain of those bodies. RD 311/2022 extends the ENS obligation to private suppliers of the public sector, regardless of whether the contracting authority is the central government, a regional government, an island council or a municipality. The Cabildo de Gran Canaria and the Ayuntamiento de Las Palmas de Gran Canaria are themselves subject to the ENS; their suppliers inherit the obligation for the systems in scope.
Yes. The Universidad de Las Palmas de Gran Canaria is a public-sector university entity and, as such, is obligated by the ENS for its information systems. That obligation is passed on to suppliers through tender specifications. A software or cloud services company wishing to work with the ULPGC must include ENS alignment as part of its technical proposal.
Only in how invoices are issued. The Canary Islands apply the IGIC (Impuesto General Indirecto Canario) instead of VAT; when I work with a company based in the archipelago, the service invoice is issued with IGIC. The ENS compliance process itself — gap analysis, categorisation, risk assessment, compliance plan, implementation and conformity — is identical to that for any company on the Spanish mainland. RD 311/2022 makes no territorial distinction.
It depends on the category of the system. For basic category systems, conformity is accredited through a self-assessed declaration signed by the organisation itself. For medium or high category systems, the regulation requires a certificate issued by an ENAC-accredited body under standard ISO/IEC 17065. As a consultant, I prepare you for conformity under either route; for medium and high category, the certificate is issued by the accredited third party, not by the consultant.
There is no fixed category: it is determined by assessing the real impact of a security incident across the five CIDAT dimensions of the specific system. That said, many providers of lower-criticality digital services — document management, web portals, productivity tools — fall into the basic category. Systems processing sensitive citizen data, managing critical infrastructure or supporting essential functions may reach medium or high. The initial gap analysis is the only rigorous way to determine this.
Yes. The ENS obligation derives from the contractual relationship with the public sector, not from the geographic location of the supplier. A company headquartered in outside the Canary Islands that provides ICT services to the Gobierno de Canarias is equally subject to RD 311/2022. What may vary is the tax treatment of the invoice, which you should review with your tax adviser.
First call at no cost and with no commitment. We assess your scope, your category and the Canarian public bodies you work with or want to work with, and I provide a fixed proposal. If we are not a good fit, you walk away with a useful initial diagnosis to begin your ENS compliance journey.