the accesskey _ mod _ content

Introduction

La transformación digital del Sector Público ha de ir acompañada de medidas organizativas y técnicas de seguridad que protejan la información manejada y los servicios prestados, proporcionadas a los riesgos provenientes de acciones malintencionadas o ilícitas, particularmente de las ciberamenazas, errores o fallos y accidentes o desastres.

The Law 39/2015, 1 October, Common Administrative procedure of public administrations (Opens in new window) recoge entre los derechos de las personas en sus relaciones con las Administraciones Públicas, establecidos en su artículo 13, el relativo “a la protección de datos de carácter personal, y en particular a la seguridad y confidencialidad de los datos que figuren en los ficheros, sistemas y aplicaciones de las Administraciones Públicas”. A la vez que la seguridad figura entre los principios de actuación de las administraciones públicas, así como la garantía de la protección de los datos personales, según lo establecido en la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público (Opens in new window) en su artículo 3 que trata los principios generales relativos a las relaciones de las administraciones por medios electrónicos.

Para dar respuesta a todo lo anterior, el artículo 156 de la Ley 40/2015 recoge el National security scheme (NHIS) “ aims to establish security policy in the use of electronic media in the scope of this law, and consists of the basic principles and minimum requirements that adequately information security treated ”.

El ENS fue establecido anteriormente por el artículo 42 de la Ley 11/2007 y está regulado por el Royal Decree 3/2010, of January 8th (Opens in new window) , which was modified by the Royal Decree 951/2015 (Opens in new window) to update it in the light of experience in their implantation of the evolution of technology and cyber threats and international regulatory context and European.

The technical safety instructions , de obligado cumplimiento, son esenciales para lograr una adecuada, homogénea y coherente implantación de los requisitos y medidas recogidos en el Esquema y, particularmente, para indicar el modo común de actuar en aspectos concretos: Report of the state of security; Notification of security incidents; Audit of safety; Line with the national security Scheme; Adquisición de productos de seguridad; Criptología de empleo en el Esquema Nacional de Seguridad; Interconexión en el Esquema Nacional de Seguridad; y Requisitos de seguridad en entornos externalizados.

The guides of security by the National PKIX Centre, called CCN-STIC guides (Opens in new window) and available in the Portal del CCN-CERT (Opens in new window) help with best compliance with the national security Scheme, in particular, the collection of guides of the series 800.

The ENS was developed in the light of the state of the art and the main referents in safety of information from the European Union, OCDE, national and international standardization, like in other countries, etc.

El ENS es el resultado de un trabajo coordinado por el Ministerio de Política Territorial y función Pública junto con el Centro Criptológico Nacional (CCN) y la participación de todas las AA.PP., a través de los órganos colegiados con competencias en materia de administración digital. También se ha tenido presente la opinión de las asociaciones de la Industria del sector TIC.

Goals

El Esquema Nacional de Seguridad (ENS) persigue los siguientes objetivos :

  • Crear las condiciones necesarias de seguridad en el uso de los medios electrónicos through measures to ensure the safety systems, data, communications, and electronic services, allowing the exercise of rights and duties through these means.
  • Promote continuing management security .
  • Promote prevention detection and correction, for better resilience in the scene of cyber threats and cyber attacks.
  • Promote a homogeneous treatment security to facilitate cooperation in the provision of public services digitales when participating various entities. This means providing the common elements that guide the performance of public Sector entities in safety of information technologies; also provide a common language to facilitate interaction, as well as the communication of the requirements of information security industry.
  • Serve as a model of good practices, in line with the recommendations of the ‘ OCDE Digital Security Risk Management for Economic and Social Prosperity - OECD Recommendation and Companion Document

En el Esquema Nacional de Seguridad se concibe la seguridad como una actividad integral, en la que no caben actuaciones puntuales o tratamientos coyunturales, debido a que la debilidad de un sistema la determina su punto más frágil y, a menudo, este punto es la coordinación entre medidas individualmente adecuadas pero deficientemente ensambladas.

Elements of the national security Scheme

The main elements of ENS are as follows:

  • The basic principles a considerar en las decisiones en materia de seguridad (arts. 4-10).
  • The minimum requirements allow adequate protection of information (arts. 11-26).
  • The mechanism for achieving compliance with the basic principles and minimum requirements through security measures provided the nature of the information and services to protect (arts. 27, 43, 44, annex I and Annex (II).
  • The use of common infrastructure and services (art. 28).
  • Safety guides (art. 29).
  • The instructions security techniques (art. 29 and additional provision 4th).
  • Electronic communications (arts. 31-33)
  • The audit of safety (art. 34 and Annex (III).
  • The response to security incidents (arts. 36 and 37).
  • The use of certified products (art. 18., annex II and annex V).
  • The line (art. 41).
  • The training and awareness (additional provision first).

The principal mandate of ENS is established in Article 11 ‘ minimum requirements of security ’, whereby “ all the higher level of public administrations should formally have its security policy that articulates continued management of security, which shall be adopted by the holder of the corresponding upper Body ”, which was established in base to the basic principles and will run through the minimum requirements.

Scope

The Scope the national security Scheme is the public Sector, as established in Article 2 of laws 39/2015 and 40/2015 on the field subjective and what is stated on the public sector institutional. Are excluded from its scope systems dealing with classified information regulated by law 9/1968 of 5 April, on official secrets and its rules of development.

Alignment with national security Scheme

An orderly adequacy to national security Scheme requires treatment of the following issues, expressed very succinctly:

ENS alignment to the figure

Accordance with ENS

The ENS in its Article 41 on ‘ Publication in accordance ’ notes that the bodies and public entities give publicity in the corresponding electronic headquarters declarations of conformity, and the hallmarks of security of those who are creditors, obtained with regard to compliance with ENS. After the entry into force of laws 39/2015 and 40/2015 affects all public Sector entities in Spain, as well as private Sector operators providing solutions and services, not only of security, or interested in the certification of conformity with the ENS.

The ‘ Technical safety instruction in accordance with the ENS » Establishes criteria and procedures for the conformity assessment, as well as for advertising of that line. Precise obtaining mechanisms and publicity declarations of conformity and of the hallmarks of security obtained with regard to compliance with ENS.

More information

Fill the form Contact (Opens in new window) to send your request for information.

General access point
General access point