Implementation of the National Security Scheme

The implementation of the National Security Scheme follows a very marked scheme, where a series of minimum elements that must be present are transferred .

Information security policy

In addition to the elements already mentioned above, it must be specified who or who will assume the following roles.

1.            Responsible for the information : responsible for the treatment and purposes of the information stored and processed, establishing the security requirements that must exist.

2.            Responsible for the service : responsible for establishing the security requirements of the services, especially in relation to the availability dimension.

3.            Responsible for security : responsible for the management of information security in the organization.

4.            Responsible for the system : responsible for the maintenance and operation of the organization's information systems.

5.            System security administrator : in charge of the technical part of the implementation and maintenance of security measures.

Systems categorization

The importance of the information and services within the identified scope should be assessed . To arrive at such an assessment, the impacts that would occur if there were any problem in terms of confidentiality, availability, integrity, authenticity and traceability must be identified .

Once this assessment has been made, the provisions of the National Cryptological Center's security guides would be followed in order  to know what security measures should be implemented to, at least, comply with the identified confidentiality, availability, integrity, authenticity and traceability requirements.

Risk analysis

If we adhere to the provisions of Annex II of the National Security Scheme, the risk analysis carried out must include the following elements depending on the categorization of the system:

1.            Basic category : at least an informal analysis should be carried out, where the most important system assets are identified, the threats that are most likely to occur, the security controls that would correspond to such threats and what the residual risks would be that would remain in the system.

2.            Medium category : at least a semi-formal analysis must be carried out, where in addition to identifying the most important assets, threats, controls and the resulting residual risk, each of these elements must be assessed and quantified.

3.            High category : a formal analysis must be carried out, where in addition to the elements discussed in the medium category, existing vulnerabilities in the specific context of the organization that would make the identified threats could take place must be identified.

Statement of applicability

Once the category of the system is clear, the security controls to be implemented must be identified , taking into account the security dimensions discussed and the needs that may exist in each of them. In Annex II of the National Security Scheme , there are tables with security controls, in order to identify which ones should be implemented.

System inadequacies

Once the security measures to be implemented have been identified, an assessment will be made of the degree of compliance with such measures . With this result, the plan to adapt to the regulations can be designed.

Security improvement plan

With the entry of the previous point, it will be possible to proceed to design the Improvement Plan that corrects the deficiencies detected in the system.

Thus, the information that should be included in such plan is the following:

1.            Actions to carry out.

2.            Responsible for the execution of the same.

3.            Responsible for supervision.

4.            Implementation deadlines.

5.            Estimated costs of the actions.

Finally, it should be noted that the National Security Scheme underwent a modification in 2015, the same being described in Royal Decree 951/2015, of October 23, modifying the ENS .

Among other updates are the following:

1.            Continuous management of security as a key aspect, requiring it 24 hours a day.

2.            Formalization of the security measures to be implemented in a Declaration of Applicability Document.

3.            Introduction of the Technical Safety Instructions, which will regulate specific safety requirements that must be contemplated by the Public Administrations.

4.            Investigation of security incidents with the evidence that is necessary for it.