Only two Catalan public entities have certification of compliance with the National Security Scheme (ENS) at a high level: the Tarragona Water Consortium, since December 2025, and the AOC, since July 31, 2026. There are 41 in all of Spain, according to the National Cryptological Center (CCN), and only one is a local entity.
Although there are only two entities, the fact that theAOC is certified implies that more than 2.250 Catalan administrations do not have to certify on their own what the AOC has certified once for all. A small town council that works with VÀLid, e-NOTUM or DESA'L incorporates the same guarantees as a provincial council, with an independent verification that certifies that security measures are effectively applied. 86% of the AOC catalogue already operates under the ENS. The level that in the whole State has only been reached by one local entity alone is, in Catalonia, a shared starting point.
Two entities in Catalonia, forty-one throughout the State
According to the certificates of conformity published by the CCN, 41 Spanish public entities have the ENS at a high level: 23 from the institutional public sector, 11 from the General State Administration, 6 from autonomous communities and a single local entity. In Catalonia there are only two, both from the institutional public sector: the Tarragona Water Consortium (December 5, 2025) and the AOC Consortium (July 31, 2026).
The ENS distinguishes three levels: basic, medium and high. The high level corresponds to systems that manage critical information or services, and is the one that the fewest entities have accredited. Accrediting the high level involves demonstrating a wide range of technical, organisational and operational measures, and subjecting them to an independent audit. For a local entity, this can be difficult to assume with its own resources. This does not mean that Catalan local entities work without guarantees, thanks to the ENS obtained by the AOC, it means that they have them thanks to the AOC.
A small town council with the guarantees of a provincial council
What does it mean that the AOC has certified it once for all? That the effort is made in one place and the effects reach more than 2.250 administrations. When a city council uses VÀLid, e-NOTUM or DESA'L, it does not just incorporate a tool: it incorporates a service audited according to the most demanding level of the ENS, and can take advantage of its conformity in its own adaptation process.
The alternative is for each administration to certify the components of its electronic administration on its own. If only one local entity in the entire State has done it on its own, it would hardly be a realistic path for the majority of Catalan entities. With the shared model, a small city council starts from the same security base as a provincial council.
For citizens, the change is less visible, but more lasting: digital procedures with any Catalan administration are based on services that have passed an independent verification, aimed at protecting the confidentiality, integrity, availability, authenticity and traceability of information.
From three services to twenty-two in just two years
This result has a short history, and the pace explains it: from three to twenty-two services is to multiply by more than seven in two years. In 2024 there were three services with ENS: DESA'L (April), VÀLid (June) and PSIS (November). In June 2025, the AOC carried out the internal audit of all AOC services, and in July 2026, it passed theENS audit that has resulted in the certificate of the 22 services, which represent 86% of the catalog.
The roadmap, however, does not stop there. In 2026, the ENS audit of the interconnection services between xcat and SARA networks will take place; in 2027, an internal audit of 100% of AOC services will be carried out and in 2028, the ENS audit of 100% of AOC services.
