What is ENS?
The Spanish National Security Framework (ENS), governed by Royal Decree 311/2022, sets minimum security requirements for public-sector systems and their suppliers. The system category (BASIC, MEDIUM or HIGH) is not assigned automatically because clinical data exists: it follows an impact analysis on confidentiality, integrity, traceability, authenticity and availability.
ENS categories (summary)
| Category | Typical context (indicative) |
|---|---|
| BASIC | Limited impact on security dimensions |
| MEDIUM | Moderate impact on one or more dimensions |
| HIGH | High impact on at least one dimension |
A public tender may require a specific category, but the system’s category must be justified with risk analysis and a statement of applicability — not a generic rule such as “clinical data = HIGH”.
Common controls in social care
- Encryption at rest and in transit.
- Strong authentication for privileged roles.
- Logging and traceability of access to sensitive information.
- Backups and restoration testing.
- Documented continuity and incident management.
- Least-privilege access control.
- Periodic review of processors and subprocessors.
OmiCare and ENS
OmiCare is built with security by design and is working towards ENS Medium category alignment. We do not claim ENS certification or a higher category until the process — and any audit — is complete.
Primary production infrastructure is hosted in the European Union.