You sell to the Spanish public sector. Here is what the ENS expects of your pentest.

What the ENS is and who it applies to

The Esquema Nacional de Seguridad (Royal Decree 311/2022) sets the security measures that public-sector systems must meet — and those of the private providers that serve them, for the systems involved in that service. That is why you see it in tenders: without a Declaration or Certificate of Conformity, you don't get in.

Systems are classified as Basic, Medium or High category. For Basic, a self-assessment is enough. For Medium and High you need a formal audit, repeated at least every two years, by an accredited certification body.

What role the pentest plays

The ENS requires you to manage technical vulnerabilities and to verify periodically that the security measures work. A manual penetration test of the in-scope system is the usual way to evidence that, and it is what the certification body expects to find in the file: what was tested, with which method, what was found and what was fixed.

Where does it say so literally? With the words "penetration testing", in two places in Annex II of Royal Decree 311/2022: in the monitoring measure op.mon.3, reinforcement R6 "Security inspections" ([op.mon.3.r6.3] Penetration tests), mandatory only for the High category; and in op.nub.1.2, for third-party cloud services, at every category. For a SaaS there is a third measure that weighs more: mp.s.2 "Protection of web services and applications" requires security audits of the web application at every category — black-box or white-box (R1 or R2) at Basic and Medium, white-box plus reinforcement R3 at High — during development and before production, at a frequency set in your audit procedure. A black-box audit of your application is, in practice, a web-application pentest. So at Medium the certification body won't ask you for "a pentest" under op.mon.3, but it will ask for the application security audit under mp.s.2 — and the report with retest is the most direct way to give it. The detail, measure by measure and category by category, is in the 2026 guide.

What the ENS does not say is "one pentest per quarter". The frequency is set by your risk analysis and your audit cycle. An annual test with retest, plus an interim test if your system changes a lot, is what fits the two-year cycle without gaps.

The scope follows your statement of applicability

The certification body audits the system as you have delimited it. If the pentest covers something else, you have a report but not evidence. That is why I align the scope with your statement of applicability before the test — the same application, the same environment, the same roles — and that is what the attestation letter (TPM) records.

What the certification body gets

• The attestation letter: scope, method, period, outcome.
• The retest statement per round: what was fixed.
• On request: the methodology in detail and answers to their questions, free of charge.

The technical report stays with you. The auditor doesn't need the findings to check that you have resolved them; that is what the statement is for.

About language

Report and attestation letter are delivered in English (I also work in German). Many certification bodies accept that as is; if yours requires the evidence in Spanish, tell me in the scoping call and we'll see whether it fits.

What about NIS2 or DORA?

They ask for the same thing in other words: recent evidence of security testing, vulnerability management and verified remediation. A test with an attestation letter and a retest statement answers all three.

A note on dates: as of September 2026, Spain has still not published the law transposing NIS2 in the official gazette (BOE), and the European Commission referred Spain to the Court of Justice of the EU in July 2026 over the delay. What reaches a SaaS provider today is not an obligation of its own but the questionnaire of a customer who is under NIS2 and has to monitor its suppliers — and that questionnaire is answered with the attestation letter, not the report.