Accredited certification bodies

The accreditation framework has been developed by ENAC in close collaboration with the General Secretariat for Digital Administration (Ministry of Economic Affairs and Digital Transformation) and the National Cryptologic Centre (CCN).

In the case of systems classified as LIMITED DIFFUSION (LD) or equivalent, an entity must be accredited by ENAC in the scope of application of the National Security Framework in accordance with the UNE-EN ISO/IEC 17065:2012 standard in order to certify compliance with STIC requirements. In addition, security auditing entities must have a valid Company Security Clearance (HSEM in Spanish initials).

Compliance with STIC requirements in the field of classified systems (LD) may also be certified among those auditing entities that comply with one of the following options (CCN-STIC-101):

1. Be an entity, organ, body, agency and unit linked to or dependent on the Public Administrations whose competencies include the development of information systems audits, as stated in its creation regulations or structural decrees and whose due impartiality is guaranteed.
2. Exceptionally, be a company validated by the CCN, which has demonstrated sufficient technical capability to carry out STIC audits/inspections on systems handling classified information.

It would be desirable to try to ensure that all systems (those already certified and those in the process of certification) reach 05.05.2024 with a RD 311/2022 certificate or are in the process of obtaining one, for which the National Cryptologic Centre (CCN) urges accredited Certification Entities to advise their clients on such matters, which will undoubtedly avoid possible situations of expiry of Certifications and will improve confidence in the information systems within the scope of application of the ENS certified in accordance with the new RD.

As indicated in the Security Guide CCN-STIC CCN-CERT IC-01/19 ENS: General Audit and Certification Criteria, when an exceptional situation arises -such as the one caused by Covid-19-, which advises the opening of a temporary hiatus in the relationship between Certification Bodies and their clients, or the temporary extension of the Certificates of Conformity issued, the CCN may, in the exercise of its powers, extend the validity of the Certificates of Conformity by issuing a communication or after the analysis of each specific case that, in this regard, is submitted for its consideration.