ENS compliance in Las Palmas de Gran Canaria: integrated with ISO 27001

Yes. Article 2 of RD 311/2022 establishes that the ENS applies to Spanish public-sector entities and to private entities providing them with services or solutions when the information systems of both parties are interconnected or when the private company processes information on behalf of the Administration. The Gobierno de Canarias, the Cabildo de Gran Canaria, the Ayuntamiento de Las Palmas de Gran Canaria and the ULPGC are all public-sector entities subject to the ENS, so their technology and digital service suppliers must comply. The procurement specifications of these administrations already include this requirement on a regular basis.

The Canarian Economic and Fiscal Regime, which includes IGIC instead of mainland VAT and a set of specific tax incentives, does not modify the scope or requirements of the ENS: RD 311/2022 applies equally across the entire national territory, including the Canary Islands. What may have an impact is system categorisation if your company manages REF tax data on behalf of the Canarian regional administration, as the impact on availability and confidentiality of that data may raise the system category to medium or high.

The bodies with the largest volume of technology procurement in Las Palmas de Gran Canaria are the Gobierno de Canarias — through the Consejería de Hacienda and the network of ministerial departments — the Cabildo de Gran Canaria, the Ayuntamiento de Las Palmas de Gran Canaria and the ULPGC. All are public-sector entities subject to the ENS and publish their tenders on the Plataforma de Contratación del Sector Público. ENS compliance requirements appear most frequently in the technical specifications of tenders for ICT services, systems maintenance, software development and cloud services.

Summum Calidad approaches ENS compliance from an information security management system perspective: policy, risk analysis, proportionate control selection, evidence documentation, review cycles and continuous improvement. This approach is complementary to, not a substitute for, the implementation of technical measures. Technical cybersecurity — hardening, monitoring, encryption — is coordinated by Summum Sistemas, which works in parallel with our team. The result is an integrated project covering both the normative-documentary and the technical-operational planes under a single coordination.

For a mid-sized company providing ICT services to public bodies in Las Palmas de Gran Canaria with existing security practices, basic-category compliance can be completed within three to six months. If the system reaches medium or high category — common when handling tax data under the REF, population register data or electronic office systems for the Canarian administration — the full process including the conformity audit before an ENAC-accredited entity typically takes between nine and eighteen months. Having a prior ISO 27001 certification significantly reduces that timeline.

Beyond strict mandatory compliance, ENS compliance — especially when integrated with ISO 27001 — means implementing a mature information security management system that improves operational resilience, facilitates incident response and strengthens trust with private clients who also demand security guarantees from their technology suppliers. In an island market where business reputation circulates within relatively close-knit networks of contacts, demonstrating ENS compliance distinguishes a company in the local market and opens doors both in public procurement and in the private sector with demanding clients.