I am Ángel Ortega Castro, an independent ENS consultant active in Tenerife. The Esquema Nacional de Seguridad (ENS) — Spain's national information security framework, governed by RD 311/2022 — is the entry requirement for any company that wants to tender with the Cabildo de Tenerife, the Ayuntamiento de Santa Cruz de Tenerife or the Universidad de La Laguna. I guide you through every phase of the alignment so you can bid on Canarian public contracts with real guarantees.
For technology companies operating in Tenerife, the island's public procurement market combines considerable volume, administrative complexity and a growing digitalisation agenda that brings concrete information security obligations. Three bodies account for the bulk of that demand.
The island government manages roads, inter-urban transport, social services, the environment and tourism promotion through Turismo de Tenerife. Its ICT tenders in document management, data platforms and cybersecurity are frequent and island-wide in scope.
The provincial capital and co-capital of the Canary Islands leads smart-city projects: urban telemetry, transparency portals, citizen-participation platforms and integrated management of municipal services with external providers.
Founded in 1792, the ULL is one of the oldest universities in Spain. It manages a virtual campus, research management systems, institutional repositories and communications networks. As a public university, its systems fall under the ENS — as do those of its ICT suppliers.
The Servicio Canario de la Salud (Hospital Universitario de Canarias and Hospital Universitario Nuestra Señora de la Candelaria), the ITER (Instituto Tecnológico y de Energías Renovables), the Autoridad Portuaria de Santa Cruz de Tenerife and the Gobierno de Canarias departments based on the island complete the contracting ecosystem.
Any company supplying digital services, technology infrastructure or information management to any of these bodies is part of the public sector's supply chain and is subject to the ENS alignment obligation. For a broad overview of the regulatory framework before reading on, I recommend the complete ENS guide and the ENS consulting for companies service page.
Real Decreto 311/2022 (BOE-A-2022-7191), of 3 May, states explicitly that private companies providing services or solutions to the public sector under a contractual relationship must align with the Esquema Nacional de Seguridad. The obligation does not distinguish whether the company is headquartered in Tenerife, on the mainland or anywhere else in Spain: the key question is whether there is a contract with a public administration.
For a Tenerife-based company, this means that if you supply management software to the Cabildo de Tenerife, develop platforms for the Ayuntamiento de Santa Cruz, provide cloud services to the ULL, maintain the ICT infrastructure of an island public hospital or take part in digitalisation projects for any of the mancomunidades across the north or south of the island, your organisation is part of that supply chain and must demonstrate ENS conformity.
That requirement is materialising in procurement documents: with growing frequency, the technical specifications of ICT service tenders issued by Tenerife's public sector include ENS conformity as a technical solvency requirement or as an admission criterion. A company unable to demonstrate it is excluded before price or technical proposal are even assessed.
The Canary Islands apply the Impuesto General Indirecto Canario (IGIC) instead of VAT. The general rate is 7 %. For mainland Spanish companies wishing to tender in Tenerife, this difference matters when structuring the financial offer and managing invoicing obligations. For Canarian companies tendering outside the archipelago, the reverse applies: those contracts are subject to VAT. The IGIC does not alter the obligation to comply with the ENS — the standard is nationwide — but it is worth factoring in when calculating the total cost of an island tender or evaluating whether it is commercially worthwhile to establish a permanent presence in the Canary Islands to compete for local public contracts.
The engagement follows the sequence set out in the CCN-STIC guides: no improvisation, no skipped steps. Each phase produces a deliverable that builds on the previous one, from the initial gap diagnosis through to the documentation you need to demonstrate conformity to any Tenerife public body or wider Spanish administration.
| Phase | What we do | Reference & deliverable |
|---|---|---|
| Phase 01 Gap diagnosis |
Differential analysis between your current situation and the ENS requirements. Definition of scope and the information systems affected by your activity with the island's public sector. | Diagnostic report showing the real gap from compliance, with prioritised findings. |
| Phase 02 Categorisation |
Assessment of systems across the five security dimensions (CIDAT) and assignment of a category: basic, medium or high. | Annex I of the ENS. Determines the applicable category and the conformity route. |
| Phase 03 Risk analysis |
Identification of assets, threats and safeguards using the MAGERIT methodology (supported by tools such as PILAR). | MAGERIT risk analysis report and risk treatment plan. |
| Phase 04 Compliance plan + SoA |
Security policy, control selection and drafting of the Statement of Applicability (SoA), with justification for each applicable control. | Guide CCN-STIC 806. Compliance plan and declaration of conformity. |
| Phase 05 Implementation |
Deployment of the selected controls: organisational, operational and protection frameworks. Hands-on support for your team throughout the process. | Implementation of the Annex II controls with documented evidence. |
| Phase 06 Audit / certification |
Pre-audit review. For medium or high categories, support during the accredited-entity audit. I prepare; the audit is conducted by an independent third party. | Annex III. I prepare the ENS audit pack; the certificate is issued by an ENAC-accredited entity. |
How long does it take? Timelines depend on the category and the maturity of the system. I break this down in the guide to ENS alignment timelines.
A system's category is not chosen arbitrarily: it is calculated by assessing the impact a security incident would have across the five CIDAT dimensions — confidentiality, integrity, availability, authenticity and traceability. The dimension with the highest rating determines the system category. For a Tenerife public-sector supplier, this depends on which systems you manage and what data you process.
When an incident would cause limited harm to the organisation's functions, assets or the individuals involved. The most common category for providers of internal management software without large-scale processing of sensitive data.
When an incident would cause serious harm: at least one dimension reaches the medium level. Common for providers handling citizens' personal data or health-sector systems.
When an incident would cause very serious, potentially irreparable harm: at least one dimension reaches the high level. Applicable to critical infrastructure or systems handling particularly sensitive data.
Choosing the right category is essential — both to avoid over-engineering the project and to ensure you meet the requirements of a tender specification. I help you decide in the guide to ENS categories and how to choose yours.
For basic-category systems, conformity is demonstrated through a self-assessed declaration of conformity: the organisation itself verifies compliance against the CCN-STIC guides. I prepare the documentation and the evidence so that the declaration is robust and can withstand scrutiny from the Cabildo, the Ayuntamiento, the ULL or any other island contracting authority.
For medium or high categories, conformity requires certification by an entity accredited by ENAC under UNE-EN ISO/IEC 17065:2012. I prepare your organisation to pass the audit with the smallest possible margin for error; the certificate is issued by the accredited entity, never by the consultant.
For a full explanation of the certification process, read the guide to ENS certification: process, requirements and costs. If you are unsure whether you need ENS or ISO 27001, I compare both frameworks in ENS or ISO 27001 for public-sector tenders.
You do not get a report that no one opens again. You get the documentary and technical body of evidence that sustains conformity and that the Cabildo, the Ayuntamiento, the ULL or any other Tenerife contracting authority needs to see when requiring ENS accreditation.
I am Ángel Ortega Castro, an independent consultant specialising in regulatory compliance and information security. I guide public administrations, ICT providers and companies tendering with the public sector through their alignment with the Esquema Nacional de Seguridad (ENS). I am active in the Canary Islands and work with Tenerife companies that want to access the island's public market or maintain their contracts with the Cabildo, the Ayuntamiento de Santa Cruz, the ULL and other island bodies.
My approach is one of genuine, person-to-person support: I do not hand you a manual and disappear. I work alongside you at every phase, translate the standard into concrete decisions and leave your team capable of sustaining conformity once the project ends.
I am honest about what I can and cannot promise: I prepare and align your organisation for conformity; the certificate is issued by an ENAC-accredited entity. That transparency, combined with rigorous application of the current standard (RD 311/2022, Annexes I–IV and the CCN-STIC guides), is what sets me apart from anonymous consultancies.
Companies supplying document management, ERP, data platforms or cybersecurity solutions to the Cabildo de Tenerife or its autonomous bodies. The technical specifications of these tenders are increasingly listing ENS conformity as a mandatory technical solvency requirement.
Companies that develop or maintain virtual campus platforms, research management systems, institutional repositories or network infrastructure for the Universidad de La Laguna. As a public university, the ULL passes ENS conformity obligations on to its ICT service providers.
Organisations from the rest of Spain bidding on public contracts issued by the Ayuntamiento de Santa Cruz, the Cabildo or other island bodies. ENS conformity is the technical entry requirement; the IGIC is the tax element that must be handled in the financial offer.
There is no single figure. The investment depends on the scope (number of systems), the category (basic, medium or high), your starting maturity and whether you need accredited certification or a self-assessed declaration suffices. Tenerife companies contracting with a provider established in the Canary Islands will apply IGIC (general rate of 7 %) rather than VAT.
On top of the consulting investment, medium and high-category projects require the separate fee charged by the ENAC-accredited certification entity, which is independent of my fees and billed directly by the auditing third party.
With growing frequency, yes. The technical specifications of ICT service contracts issued by the Cabildo de Tenerife and other island public bodies are including ENS conformity as an admission criterion or technical solvency requirement, in line with what RD 311/2022 demands of public-sector supply chain providers. Failure to demonstrate conformity can mean disqualification before price or technical proposal are even evaluated.
Yes. The ULL is a public higher education institution subject to the ENS, and suppliers providing software, cloud infrastructure or information management services to it are reached as part of its supply chain. This covers virtual campus platforms, research management systems, institutional repositories and any solution that processes institutional or personal data belonging to the university community.
In the Canary Islands, VAT does not apply: the indirect tax on transactions is the IGIC, at a general rate of 7 %. An ENS consulting engagement contracted with a provider established in the Canary Islands will be taxed at IGIC; if the provider is mainland-based, the territorial scope of the tax may lead to a different treatment. In any case, the IGIC does not affect the obligation to comply with the ENS — the standard is national — but it must be factored in when structuring the financial offer for island public tenders.
It depends on the specific system and the impact a security incident would have across its five security dimensions (CIDAT). A provider of internal management software without access to sensitive data may fall into the basic category; one handling large volumes of citizens' personal data or systems linked to critical infrastructure may reach medium or high. Categorisation is the first step of the process and we determine it together during the initial diagnosis. More detail in the guide to ENS levels and how to choose your category.
No, if the tender document requires conformity as a condition. The obligation under RD 311/2022 applies to any company providing services to the public sector, regardless of where it is headquartered. Mainland companies wishing to tender in Tenerife must demonstrate the same conformity as any Canarian company. They should also anticipate the tax particularities of the Régimen Económico y Fiscal de Canarias (REF) — IGIC instead of VAT — when structuring their financial offer.
First call at no cost and no commitment. We assess your scope, your category and the type of public bodies you work with or intend to work with on the island. If there is a fit, I send you a fixed proposal. If not, you still walk away with a useful initial diagnosis.