Public administrations
Working with Spanish public administrations
What the National Security Framework requires of a supplier, and where Corpshore currently stands against that requirement.
In summary: Royal Decree 311/2022 extends Spain's National Security Framework to private suppliers serving the public sector. Systems categorised medium or high require certification issued by an accredited body. Corpshore does not hold that certification today, so it cannot take on scope that requires it. It can deliver services aligned with the framework, act as a subcontractor under a certified prime, and support the documentation of your process.
This page exists to answer the question a public procurement lead asks first, rather than leaving it to the third meeting: whether we are certified under the National Security Framework.
We are not. The rest of the page explains what that means in practice, which part of the work we can take on today, and which part would need a certified supplier.
Our position, plainly
Royal Decree 311/2022 regulates the National Security Framework and binds the Spanish public sector and the private operators that serve it, regardless of where those operators are established.
Alignment is not certification, and the difference decides tenders. We work aligned with the framework: we apply equivalent controls for access control, traceability, incident management and information protection, and we document how. What we do not have is a certificate issued by a certification body accredited by the Centro Criptológico Nacional.
Where a tender requires that certification for the contracted scope, you will need a supplier who holds it for that part. We would rather say so on the first page you read than after you have spent time in a commercial conversation.
The three categories and what each requires
The National Security Framework classifies systems into three categories according to the impact an incident would have. What is required of a supplier changes with the category, which is why the first useful question is not whether we are certified but which category your system falls into.
| Category | What it requires | What we can take on |
|---|---|---|
| Basic category | Accepts a declaration of conformity based on self-assessment, with no mandatory involvement of an accredited certification body. | We can participate, providing control documentation and the declaration corresponding to our scope. |
| Medium category | Requires a certificate of conformity issued by an accredited certification body. | We cannot take on scope requiring the certificate. We can act as a subcontractor under a certified prime, for the part of the service outside that scope. |
| High category | Requires a certificate of conformity issued by an accredited certification body, with a more demanding set of measures. | We cannot take on scope requiring the certificate. Any participation would be as a subcontractor on tasks outside the certifiable scope. |
What we cannot do today
This list matters as much as the next one. A supplier that publishes only what it can do forces the public buyer to discover the limits during the procedure, which is the worst moment to find them.
- Present ourselves as a supplier certified under the National Security Framework, because we are not.
- Take on, in our own right, the scope of a contract whose system is categorised medium or high and whose tender documents require ENS certification.
- Issue an ENS declaration of conformity carrying the weight of a certificate. Only an accredited certification body can do that.
- Advise on the legal interpretation of tender documents. We work alongside your legal services and do not replace them.
What we can deliver today
Within those limits there is real work we can take on for a public administration or for the winner of a public contract.
Subcontracting under a certified prime
We deliver the operational service inside the scope the prime contractor governs with its own certification, under whatever subcontracting conditions the tender documents and Law 9/2017 permit in each case.
Services outside the scope of a categorised system
Not every public sector contract handles information subject to medium or high categorisation. Informational citizen contact, administrative support and processes that do not touch categorised systems may fall outside that scope.
Multilingual and co-official language support
Coverage in Castilian, Catalan, Galician and Basque, a common requirement in regional and local tenders and one that frequently decides an award more than price does.
Documentary support for compliance
We document our own controls and provide the evidence your team needs for its risk analysis and for the contract file. That is support for your process, not certification of ours.
Campaign peaks and administrative deadlines
Surge capacity sized against a known calendar, such as an application window, a grant call or a seasonal campaign, rather than against an annual average.
Public procurement: how this fits a contract file
Law 9/2017 on Public Sector Contracts governs the technical standing that may be required and the conditions under which subcontracting is permitted. Where tender documents require ENS certification as a standing requirement, that requirement attaches to the contract scope and cannot be substituted by a self-declaration.
If you are preparing a contract file and want to assess whether part of the service could be delivered on the model described, the useful conversation starts with two facts: the ENS category of the system, and whether the tender permits subcontracting of the operational part.
We do not advise on the interpretation of tender documents or on preparing the file. That sits with your legal and procurement services.
Sources
Frequently asked questions about the public sector
Are you certified under the National Security Framework?
No. We work aligned with the framework, which is not the same as certification. ENS certification can only be issued by a body accredited by the Centro Criptológico Nacional, and it is mandatory for systems categorised medium and high.
Can you work with a public administration at all, then?
Yes, within specific limits: as a subcontractor under a certified prime, or on services falling outside the scope of a system categorised medium or high. What we cannot do is take on scope requiring certification in our own right.
Do you plan to certify?
We do not publish a certification timetable while no confirmed one exists. Announcing a date that later slips is exactly the kind of claim this page avoids. If certification is obtained, this page will state the date and the body that issued it.
Do you cover the co-official languages?
Yes. We provide support in Castilian, Catalan, Galician and Basque. It is a frequent requirement in regional and local tenders, and the multilingual support page sets out how each desk is sized.
Where would the service data be handled?
It depends on what the tender requires. Where data residency in Spain or the European Economic Area is required, the service is delivered from within that area. The compliance and security page explains how that is decided and what each delivery model involves.
Preparing a contract file?
Write to us with the ENS category of the system and whether the tender permits subcontracting, and we will tell you frankly whether there is a part of the scope we could deliver.