National Security Framework controls: every review, with its evidence
An agent prepares the periodic reviews of the controls in Spain's National Security Framework (ENS): it reads the data, flags the deviations and leaves the evidence written. A person signs it off.
The problem
“The controls are written down, but nobody reviews them when they are due.” Spain's National Security Framework (ENS) requires reviews that repeat: activity logs, access, configuration, suppliers, security advisories. Each has its period and its evidence.
It happens in any company that works for the public sector and in any public body with a small systems team. The reviews get done for the first few months. Then they pile up, and when the audit approaches, the evidence for the whole year has to be rebuilt.
How it is done today
The person responsible for security logs into each server, exports logs, skims them by eye and notes in a spreadsheet that the review is done. If there is an urgent project that week, the review is skipped.
What gets found depends on who looks and how much time they have. And the evidence is usually a row written in a hurry, without the data it came from.
How we solve it
- Scheduled jobs on your servers collect the data for each control and leave a summary that is already sanitised. No AI is involved there.
- When each review is due, the agent reads that summary: activity logs and incidents every week, metrics and the dashboard every month, access and configuration every quarter.
- A program calculates the figures and detects the deviations. A missing summary or a job that did not run is a deviation too.
- The agent writes the report: the figures, each deviation explained and the decision waiting for you on each one.
- It leaves the row for the review register as a draft, with the fingerprint of the data it comes from and the sign-off left blank.
- With the same method it tracks suppliers' service level agreements, security defect advisories and expiry dates, and prepares the papers for the security committee.
Result
In our own company we work with the controls of Spain's National Security Framework and we are in the process of being audited. The periodic reviews are prepared by an agent, and each one is left with its evidence and a person's sign-off.
What it takes
Timeline
It depends on how many periodic controls you have defined and where their data lives today. It is set up control by control, starting with the reviews that repeat most often. The exact timeline comes out of the assessment.
Data and access
Your statement of applicability and the list of controls with their period. The review register you use today. And permission to install on your servers the jobs that collect the data: the agent does not log into them.
Your tools
Your servers, your security file and the repository where you keep the evidence. The format of the register is yours.
How it is built
The agent never accesses a server or a dashboard. The data reaches it already collected and sanitised: no IP addresses, no customer data, and people shown by initials or role.
The figures are calculated by a program, not by the AI model. The model does not add, round or estimate: what is not on record is written as “to be determined”.
Each row of the register carries the cryptographic fingerprint of the input data. An auditor can check that the evidence comes from that data and no other.
If the data contains something unsanitised or in an unexpected format, the program rejects it and says so. Nobody fixes it by hand.
What the agent reads is data, not instructions: text inside a log that looks like an order is treated as a warning sign and flagged.
Frequently asked questions
Is this the same as ENS certification?
No. Certification is granted by an accredited body after an audit. This makes sure the periodic reviews are done when they are due and that each one leaves its evidence.
Does the agent decide whether something is an incident?
No. It flags the deviation and asks. Opening an incident, blocking an account or accepting a risk is decided by a person.
Does the agent have access to my servers?
No. The data is collected by scheduled jobs on your servers, with no AI. The agent receives a sanitised summary.
Does it work if I have not defined my controls yet?
They have to be defined first. Alignment with the National Security Framework is covered in our security section. This is the tracking that comes afterwards.
What does Julditec do?
We implement the agent, adapt it to your company, train your team and maintain it. The day-to-day work is done by the agent; deciding and approving stays with your team.
Related automations
Deadlines
What expires in your company, in one list, with timely alerts and reminders to third parties already drafted.
Signed documents
Reports and documents as PDFs with your branding and a digital signature, with nothing printed or filled in by hand.
Part of Legal and compliance