I am Ángel Ortega Castro, an independent ENS consultant based in Valladolid. I guide companies in the city and province through compliance with the Esquema Nacional de Seguridad (ENS) — Spain's national information security framework, governed by RD 311/2022 — so they can tender and work with the Junta de Castilla y León, the City Council, the Provincial Council or the Universidad de Valladolid (UVa) without being excluded from procurement documents.
Valladolid occupies a singular position on the map of public procurement in Spain. It is the capital of Castilla y León and the seat of the Junta de Castilla y León, the largest regional government in the country by land area. That means the city is home to a significant share of the public-sector demand for digital services across the autonomous community: from the maintenance of information systems belonging to individual ministries (consejerías) to the operation of e-government platforms used by the entire network of regional bodies.
Beyond the Junta de Castilla y León, three major local contracting authorities add to the picture. The Diputación Provincial de Valladolid manages digital services for the municipalities across the province. The Ayuntamiento de Valladolid runs an active digital transformation agenda — expressed in a steady stream of tenders for software, connectivity and cybersecurity. And the Universidad de Valladolid (UVa), as a public university, operates sensitive systems — academic records, research platforms, its own e-administration infrastructure — and carries exactly the same ENS obligations as any other public body.
Around this ecosystem of administrations, a cluster of technology companies has grown: system integrators, software developers, managed-service providers and specialist consultancies that work — or aspire to work — with one or more of these bodies. For all of them, the ENS is no longer optional. RD 311/2022 (BOE-A-2022-7191, 3 May 2022) extends its reach to the supply chain, and procurement documents routinely include ENS conformity as a technical solvency requirement. Falling short of the ENS means, in practice, being disqualified from the tender.
ICT contracts issued by the ministries and bodies of the Junta de Castilla y León require ENS conformity. Having it opens the door; lacking it closes it.
The Ayuntamiento de Valladolid and the Diputación Provincial are including ENS conformity in their technical specifications with growing frequency.
The Universidad de Valladolid, with campuses in Valladolid, Palencia, Soria and Segovia, is subject to the ENS and passes that requirement on to its ICT suppliers.
Companies that complete their alignment now position themselves ahead of competitors who have not yet begun. Current ENS conformity strengthens any commercial proposal.
If you want to understand the regulatory framework before starting, I recommend reading the complete ENS guide and the details of the ENS consulting for companies service.
The ENS applies to the entire public sector and to private companies that provide services to it under contract. In the Valladolid context, that affects a wide range of companies in the city and province.
Some concrete examples of profiles that need to achieve conformity:
The transitional provision of RD 311/2022 gave existing systems 24 months to achieve compliance; that deadline expired on 5 May 2024. New systems or systems undergoing significant change must comply from day one. If your company has not yet started, every new tender published on the contracting authority's profile is a reminder that the margin is shrinking.
The process follows the sequence set out in the CCN-STIC guides, from the initial diagnosis through to preparation of the declaration of conformity or the formal audit. The goal is for your company to reach conformity in an orderly way, with solid documentation that you can present to the Junta de Castilla y León, the Ayuntamiento or any other contracting authority.
| Phase | What we do | Reference & deliverable |
|---|---|---|
| Phase 01 Gap diagnosis |
Differential analysis between your current situation and the ENS requirements. Definition of scope and the information systems within it. | Diagnostic report showing the real distance from compliance and the priority gaps. |
| Phase 02 Categorisation |
Assessment of systems across the five security dimensions (CIDAT) and assignment of a category: basic, medium or high. | Annex I of the ENS. Determines the level of rigor required and the applicable conformity route. |
| Phase 03 Risk analysis |
Identification of assets, threats and safeguards using the MAGERIT methodology. | Risk analysis report and risk treatment plan. |
| Phase 04 Compliance plan + SoA |
Security policy, selection of controls and drafting of the Statement of Applicability (SoA), with justification for each applicable control. | Guide CCN-STIC 806. Compliance plan and declaration of conformity. |
| Phase 05 Implementation |
Deployment of the Annex II measures: organisational, operational and protection frameworks. Step-by-step support for your team. | Implementation evidence per measure, ready for audit. |
| Phase 06 Final conformity |
Pre-conformity review. For basic category: support for the self-assessed declaration. For medium or high: support throughout the accredited-entity audit. | Annex III. I prepare the conformity pack; the medium/high certification is issued by a third party accredited by ENAC. |
A system's category is not chosen arbitrarily: it is calculated by assessing the impact of a security incident across the five security dimensions — confidentiality, integrity, availability, authenticity and traceability (CIDAT). The dimension with the highest rating determines the resulting category.
When an incident would cause limited harm to the organisation's functions, assets or the individuals involved. The most common category for providers of auxiliary services.
When an incident would cause serious harm: at least one dimension reaches the medium level. Common in administrative management systems or those handling sensitive data.
When an incident would cause very serious, potentially irreparable harm: at least one dimension reaches the high level. Critical systems or those handling particularly sensitive data.
For basic-category systems, conformity is demonstrated through a self-assessed declaration of conformity: the organisation itself verifies compliance against the CCN-STIC guides. I prepare the documentation and the evidence so that the declaration is robust and can withstand scrutiny from any contracting authority.
For medium or high categories, conformity requires certification by an entity accredited by ENAC under UNE-EN ISO/IEC 17065:2012. I prepare your organisation to pass the audit with confidence; the certificate itself is issued by the accredited entity, never by the consultant.
I do not leave you a PDF that nobody ever opens again. I deliver the documentary and technical body of evidence that underpins conformity — the exact package that an auditor, the Junta de Castilla y León, the Ayuntamiento de Valladolid or any other contracting authority needs to see in a tender submission.
I am Ángel Ortega Castro, an independent consultant based in Valladolid specialising in regulatory compliance and information security. I know the Castilian-Leonese public procurement ecosystem well: the timelines, the tender specifications and the typical requirements of bodies such as the Junta de Castilla y León, the Diputación Provincial de Valladolid, the Ayuntamiento and the UVa.
My approach is one of genuine, person-to-person support: I do not hand you a manual and disappear. I work alongside you at every phase, translate the regulation into concrete decisions and leave your team with the capacity to maintain conformity once the project is closed.
I am straightforward about what I can and cannot do: I prepare and align your organisation for conformity; certification in medium or high categories is issued by an entity accredited by ENAC. That honesty, combined with rigorous command of the current framework — RD 311/2022, Annexes I–IV and the CCN-STIC guides — is what sets me apart from generic consultancies.
System integrators and software developers holding contracts with the Junta de Castilla y León or its dependent bodies who need to demonstrate ENS conformity to renew or expand those contracts. They typically fall into the basic or medium category.
Technology companies based at the Parque Tecnológico de Boecillo or in the city itself that provide maintenance, cybersecurity or ICT support services to the Diputación Provincial, the Ayuntamiento de Valladolid or the UVa, and need to start or complete their alignment before the next tender is published.
Private organisations in Valladolid or the province that have operated exclusively in the private sector and want to expand their portfolio towards the public administration. ENS conformity is the first technical solvency requirement they will encounter in any tender document.
There is no single figure, and you should be cautious of anyone who quotes one without understanding your situation first. The investment depends on the scope (how many systems), the category (basic, medium or high), your starting level of maturity and whether you need accredited certification or a self-assessed declaration is sufficient.
For medium or high categories, you should also factor in the cost of the ENAC-accredited certifying entity, which is independent of my fees and is invoiced directly by the third party conducting the conformity audit.
Yes. The Junta de Castilla y León, as a regional administration, is fully subject to the ENS and passes that obligation on to its ICT suppliers and contractors. If your company provides — or aspires to provide — digital services to any of its ministries or dependent bodies, conformity with RD 311/2022 is a technical solvency requirement that tender documents already include as standard. I explain this in more detail in the ENS consulting for companies service page.
Yes. The Universidad de Valladolid (UVa) is a public university that manages information systems subject to the ENS — academic records, e-administration platforms and research systems. As a public-sector entity, it can require its ICT service providers to demonstrate conformity with RD 311/2022, particularly in contracts involving access to or processing of the university's information systems.
Yes. Both the Ayuntamiento de Valladolid and the Diputación Provincial are local entities subject to the ENS under RD 311/2022. They can — and are increasingly doing so — include ENS conformity as a technical solvency requirement in their ICT tenders. If your company works or wants to work with either of these bodies, it is wise to start the alignment process before the next tender is published.
It depends on the impact that a security incident would have on the systems you manage: if the harm would be limited, the category is basic; if serious, medium; if very serious, high. The category is determined during the categorisation phase by applying Annex I of RD 311/2022. Many providers of auxiliary services or management software fall into the basic category, with a self-assessed declaration of conformity as the applicable route.
Yes — and it is the smartest decision. Starting the alignment before entering a tender means you can demonstrate conformity from the very first specification that requires it, without last-minute pressure. The process has a minimum duration of several weeks — even months for more complex systems — so beginning early prevents being ruled out simply for lack of time.
Both frameworks are compatible and share a significant proportion of controls. If your company already holds or is working towards ISO 27001, that work carries over into the ENS alignment and vice versa. The ENS is mandatory for anyone working with Spanish public administrations; ISO 27001 is voluntary and internationally recognised. For tendering with the Junta de Castilla y León, the Ayuntamiento de Valladolid or the Diputación Provincial, the ENS is what the tender document requires.
First call at no charge and with no commitment. We assess your scope, the likely category of your systems and the type of contracting you are pursuing. If we are a good fit, I send you a fixed proposal; if not, you leave with useful guidance to get started.