The National Security Scheme in a new edition of the TechTur Legal Series

On Tuesday, 25 November, we held a new edition of the TechTur Legal Series, the webinars on legal and fiscal matters of the Tech Tourism Cluster, led as always by the Mylegalinbox team.

During this session, the National Security Scheme (ENS) took centre stage, and we were able to address all the questions that concern the cluster’s companies in a dynamic and participatory session.

As main conclusions, we understood that:

• - The new ENS (RD 311/2022) is a cybersecurity regulation designed to cover threats such as cloud services, remote work and outsourcing.

• - ENS and GDPR are complementary: ENS protects technological systems and services, while GDPR protects personal data.

• - It is mandatory for all companies providing services or technology to the public sector.

• - Classification depends on the impact on the public service: Basic (internal declaration), Medium (ENAC certification), High (critical systems with maximum requirements).

• - The category is determined by five key dimensions: confidentiality, integrity, availability, authenticity and traceability.

• - The subcontractor chain carries as much weight as the main company: a cloud provider without ENS certification may prevent the final certification.

• - It requires a formal security policy, access controls and MFA, backups, encryption, monitoring, continuous training and exhaustive documentation.

• - The compliance process is divided into diagnosis, implementation and audit. It is manageable for SMEs with expert support.

• - Non-compliance may result in exclusion from tenders, sanctions, contractual blocks, loss of trust and dependence on certified third parties.

• - Certification provides access to public projects, strengthens professional reputation, reduces operational risks and aligns with ISO 27001.

During the session, participants had the opportunity to resolve doubts and share their views in a final debate space.

From the Cluster, we would like to thank Borja Rivas and Júlia Forn de Mylegalinbox for leading this session with clarity, precision and commitment to the sector. We also want to acknowledge the interest and participation of all attending companies.

We will be back soon with new sessions of the TechTur Legal Series!