✦
Audits without surprises
A ZIP pack with every frozen document, its fingerprint, the signatures, task evidence and an integrity manifest. Generated in minutes, not weeks.
ENS Docs · Compliance by design
All your ENS documentation, in one place and ready for the audit
ENS Docs manages the policies, procedures, role appointments and records required by the Spanish National Security Framework (ENS). It controls versions, collects sign-off from management and staff, keeps track of recurring tasks and builds the evidence pack the auditor asks for in one click.
38ENS inventory documents preloaded
18templates filled in with your organisation's details
16recurring tasks with schedule and evidence
1 clickto generate the audit evidence pack
The challenge
Getting ENS certified is achievable. Keeping it up to date, year after year, is the hard part.
An organisation certified at medium category builds up dozens of documents: security policy, role appointments, risk analysis, Statement of Applicability, rules of use, procedures and minutes. They usually end up scattered across shared folders, email and spreadsheets.
Gathering the evidence by hand takes weeks before every audit, and a single gap can turn into a non-conformity.
The auditor doesn't just ask for documents. They ask for proof:
?Who approved this version, and when?
?Has every employee accepted the current rules, not last year's?
?Were the backups, the access review and the committee meeting done on schedule?
?Are the role appointments still valid after someone has changed jobs?
The solution
One tool that unifies, controls and proves
ENS Docs brings all your ENS documentation (Royal Decree 311/2022) and its full life cycle into one repository: drafting, approval, publication, staff acceptance, periodic review and archiving. Every step is recorded with the date, the person and the document's digital fingerprint.
ENS · RD 311/2022eIDASAudit trailVersioningSHA-256EvidenceOpen source
Current documents34 / 38
Pending signatures7
Overdue tasks1
Acceptance by document
Security policy · v230 / 30
Acceptable use policy · v323 / 30
Confidentiality · v128 / 30
Remote working · v119 / 30
Sample data
✦
Unifies
Inventory, versions, signatures, tasks and organisation details in one place.
✦
Controls
Approval workflows by document type, automatic reminders and escalation of delays.
✦
Proves
Tamper-evident signature log and a complete export for the auditor.
Benefits
What your organisation gains
Less time chasing signatures and documents, more confidence in front of the auditor.
✦
Fast start
The 38-document inventory and 18 templates come preloaded. Enter your organisation's details once and the documents are generated from them.
✦
No signature left behind
Every employee gets their request and automatic reminders; if they fall behind, the Security Officer is notified.
✦
Documentation always current
When a detail changes (tax ID, the person in a role, a new service), the system flags the affected documents and alerts their owner to renew them.
✦
Recurring obligations under control
Backups, patching, access reviews, committee, training and audits, each with a schedule, an owner, an outcome and evidence.
✦
Visibility for management
A compliance dashboard showing acceptance per document, approvals in progress, people with pending items and overdue tasks.
Features
Everything you need for ENS medium category
01
Versioned repository
One record per document: code, type, ENS measures covered, owner and services. Approved versions are frozen.
02
Role-based approval
Each document type knows who must approve it. It is published only once every signature is in.
03
Acceptance campaigns
When a version is published, the affected staff receive a request with a deadline. Joiners and leavers are handled automatically.
04
Documents from templates
Policy, appointments, committee, rules of use, risk analysis, suppliers, remote working and more, filled in with your details.
05
Guided Statement of Applicability
The Annex II measures with guidance, sample justifications and the document that covers each one.
06
Recurring task calendar
16 preloaded tasks with owner, due date, outcome and evidence. The next due date is calculated automatically.
07
Scheduled reviews
Each document type sets its review cycle. The owner records “no changes” or creates a new version.
08
Role-based dashboards
“My dashboard” for every person and “Compliance” for management, the Security Officer and the committee.
09
Audit export
Documents, signatures, evidence, integrity check and SHA-256 manifest. CSV lists too.
Beyond the ENS
Also your document manager and your channel to staff
What works for the ENS works for any document your organisation needs to approve, communicate and prove has been read. Stop asking “have you read it?” by email: now you know.
- Internal policies: code of conduct, data protection, whistleblowing channel, equality, device use.
- Procedures and SOPs with a single current version and an archive of earlier ones.
- Notifications with acknowledgement: you always know who has read and accepted, and who hasn't.
- Onboarding: a new starter receives everything they must accept for their role.
- Other frameworks: the same evidence approach helps with ISO 27001, ISO 9001, NIS2 or GxP environments.
My dashboard · Awaiting acceptance
Information systems acceptable use policy · v3
Deadline: 15 days · Published by the Security Officer
I have read the document and accept its contents
Open documentSign and accept
Data protection policy · v2Accepted
Sample screen
How it works
From zero to audit in six steps
We help you get started, then the tool keeps the pace for you.
01
Set up your organisation
Organisation details, logo, services and ENS roles: management, officers, committee and employees.
02
Complete the Statement of Applicability
Mark which measures apply and justify the ones that don't, with helpful examples.
03
Generate the documents
Each owner starts from a pre-filled template and completes the highlighted sections.
04
Approve with e-signature
Approvers get an email and sign from their dashboard. Once complete, the document is published.
05
Notify your staff
The acceptance campaign starts, with automatic reminders and escalation.
06
Maintain and prove
Recurring tasks, reviews, out-of-date data alerts and export for the auditor.
Who it's for
Built for ICT suppliers to public healthcare
The ENS is mandatory for Spanish public administrations and for the companies that provide them with services or technology solutions. Public hospitals, health consortia and primary care increasingly require it from their software and ICT service suppliers.
If you build or maintain systems that handle clinical or administrative data, ENS Docs helps you:
- Prove compliance in tenders and contract renewals.
- Align security documentation with health data protection.
- Make sure the whole team, including external contractors, has accepted the rules of use and confidentiality.
Organisations of 10 to 250 people
Hospitals and health consortia
Primary care
Clinical software
Laboratories
Health services
Pharma & Life Sciences
Security and guarantees
A compliance tool that complies
Simple electronic signature (eIDAS)
Each signature stores identity, date and time, IP, browser, document opening, the accepted statement and a SHA-256 fingerprint.
Chained log
Each signature includes the previous one's fingerprint, so any change, insertion or deletion is detected. Automatic daily verification.
Daily external seal
The chain's fingerprint is emailed every day so a copy is kept outside the system.
Frozen documents
A version sent for approval cannot be changed. Private files with access control.
Works with AutoFirma
If the auditor asks for an advanced or qualified signature, the signed PDF is attached to the version and its fingerprint is included.
No external dependencies
Built with open-source technology, with no licence fees or third-party dependencies, and automated tests.
ENS Docs makes compliance easier to manage and evidence. Certification is granted by an accredited body after the audit; the tool cannot guarantee it on its own.
Plans
Choose how to start
Recommended
Cloud
Hosted by healthIT. For teams that don't want to install or run servers.
Monthly fee
- Installation and email set-up
- Backups and updates
- Support
On-premise
On your server. For teams that need the data on their own infrastructure.
On request
- Installation on your server
- Initial configuration
- Training
ENS guidance
Add-on for organisations facing their first certification.
On request
- Set-up
- Review of the Statement of Applicability and documents
- Audit preparation
Frequently asked questions
What people usually ask us
Does ENS Docs certify me for the ENS?
No. Certification is issued by an accredited body after an audit. ENS Docs organises the documentation and evidence so the audit runs faster and with fewer findings.
Does it work for basic or high category?
It is designed for medium category. It also works for basic; high category would need a review of additional measures and requirements with us.
Do I have to write the documents from scratch?
No. There are 18 templates filled in with your details. You only need to complete the sections specific to your organisation, which are highlighted.
Is the electronic signature valid?
It is a simple electronic signature under the eIDAS Regulation, with a tamper-evident chained log. It is standard practice for staff acceptance of policies. For approvals that require an advanced or qualified signature, you can attach a PDF signed with AutoFirma.
What happens when someone joins or leaves?
Once they are given a role, they automatically receive their pending requests. When their account is blocked, their requests are withdrawn and their previous signatures are kept.
Can I use my own templates?
Yes. You can change the base template or edit each document's text, with a preview.
Where is my data?
On-premise, on your own server. In the cloud plan, on infrastructure managed by healthIT; our proposal sets out the hosting location and guarantees. Files are stored in a private file system with access control.
How long does it take to get started?
It depends on your starting point and the plan you choose. We agree it in the first meeting, after reviewing your current documentation.
Request a demo
Prepare for your next ENS audit with peace of mind
We'll show you ENS Docs in 30 minutes with sample data: how a document is generated, how an employee signs and what the auditor receives.