Spain's National Security Framework (ENS), regulated by Royal Decree 311/2022, is mandatory for every public sector body, including town halls, provincial councils, county councils and their dependent entities. It also applies to the technology providers that serve them.

Many small and mid-sized town halls share the same challenge: limited IT staff, lots of external access (remote employees, maintenance contractors, management software vendors) and an old VPN nobody dares to touch.

What does the ENS require for remote access?

The ENS describes measures, not products. The most relevant ones for remote access are:

ENS measure	What it means in practice
op.acc – Access control	Each person only reaches what they need (least privilege)
op.acc.6 – Authentication	Multi-factor for remote access and privileged accounts
op.exp.8 – Activity logging	Know who accessed what, and when
mp.com – Communications protection	Encrypted traffic and network segmentation
op.ext – External services	Control and limit vendor and third-party access

The problem with a traditional VPN

A classic VPN connects the user to the entire municipal network. If a vendor laptop or an employee's credentials are compromised, an attacker can move into the census, accounting, records or file servers. Internet-facing VPN appliances have also been among the most exploited entry points in recent years.

That clashes with the least privilege and segmentation principles the ENS requires.

Zero Trust (ZTNA): an approach aligned with the ENS

With ZTNA (Zero Trust Network Access):

Each user or vendor sees only authorised applications, not the whole network.
Access is granted after verifying identity (with MFA) and, optionally, device posture.
Everything is logged, which makes audit evidence easier.
No ports or VPN appliances need to be exposed to the Internet.

Typical case: the management software vendor

A town hall has a vendor maintaining its tax management application. With a VPN, that vendor usually has full network access, around the clock. With ZTNA, they get access only to that server, with MFA, optionally limited to set hours, and every session is logged — exactly what measure op.ext asks for.

Getting started without a big project

Inventory remote access: who connects from outside, and to what.
Identify external vendors and review their permissions.
Enable MFA on all remote access.
Replace the VPN with per-application access, starting with vendors.
Keep the logs as evidence for the ENS audit.

How ConnectaSec helps

ConnectaSec is a ZTNA platform built for small and mid-sized organisations, with primary infrastructure in Barcelona and a company certified in ENS and ISO 27001. It provides per-application access with MFA, vendor control and activity logs, with simple pricing: €5/user/month including 5 devices, and a dedicated gateway from €40/month.

If your town hall is preparing for ENS compliance, request a demo.

This article is for information only and does not replace advice from an ENS auditor or consultant.