ENS

ENS, the Esquema Nacional de Seguridad, is Spain's National Security Framework for information systems in the public sector, set out in Royal Decree 311/2022. Pentr's YAML declares it as name Esquema Nacional de Seguridad (ENS), version RD 311/2022. Its controls are ENS measures under the decree's own ids, with their names given in English.

Controls¶

The measures the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
op.acc.1	Identification	ATT&CK, WSTG
op.acc.2	Access Requirements	ATT&CK, WSTG, keywords
op.acc.5	Authentication Mechanism	ATT&CK, WSTG, keywords
op.exp.2	Security Configuration	WSTG, keywords
op.exp.3	Change Management	none
op.exp.4	Security Maintenance	ATT&CK, keywords
op.exp.5	Vulnerability Management	ATT&CK, WSTG, keywords
mp.com.1	Perimeter Protection	ATT&CK, keywords
mp.com.2	Communications Protection	ATT&CK, WSTG, keywords
mp.sw.1	Application Development	ATT&CK, WSTG, keywords
mp.info.1	Information Classification	WSTG, keywords
op.mon.1	Intrusion Detection	none

op.exp.3 and op.mon.1 read none: no table lists them, so each is reported not_tested on every run.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the measures it maps to. A finding tagged with one of these ids maps to every measure in its row.

Technique	Controls
T1190	mp.sw.1, op.exp.5, op.exp.4
T1078	op.acc.1, op.acc.5
T1059	mp.sw.1, op.exp.5
T1068	op.acc.2, op.exp.5
T1110	op.acc.5, op.acc.1
T1003	op.acc.5, mp.com.2
T1046	mp.com.1, op.acc.2
T1018	mp.com.1
T1021	op.acc.2, mp.com.1
T1083	op.acc.2

WSTG mappings¶

Each WSTG id in the framework's table and the measures it maps to. A finding tagged with one of these ids maps to every measure in its row.

WSTG id	Controls
WSTG-INPV-05	mp.sw.1, op.exp.5
WSTG-INPV-01	mp.sw.1, op.exp.5
WSTG-INPV-02	mp.sw.1, op.exp.5
WSTG-ATHN-04	op.acc.5, op.acc.1
WSTG-ATHN-01	op.acc.5, mp.com.2
WSTG-IDNT-04	op.acc.1
WSTG-CRYP-01	mp.com.2
WSTG-CONF-01	op.exp.2
WSTG-CONF-02	op.exp.2
WSTG-ATHZ-01	op.acc.2
WSTG-SESS-02	op.acc.5
WSTG-ERRH-01	mp.info.1

What Pentr does not attest to¶

• tested means at least one finding mapped to the measure. It does not mean the measure was assessed, met or failed. A mapping made by the keyword step can attach a measure the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the measure. It does not mean the measure passed, and it says nothing about whether the measure is in place.
• The mapping tables are Pentr's, written for the application. They are not part of Royal Decree 311/2022.
• A measure that the YAML does not declare has no row in the report.
• The YAML has no notion of a system's ENS category (BÁSICA, MEDIA or ALTA). The same measures and tables apply to every engagement that names ENS.
• A Pentr report is not an ENS conformity declaration or certification, and not an audit opinion.

The product page for this framework is ENS.