Tanium wins Spain's top security certification for cloud

Tanium has gained ENS Alta certification for its cloud service in Spain, placing the company in the highest tier of the country's national security framework.

The certification applies to Tanium Cloud under Spain's Esquema Nacional de Seguridad, a regime that sets standards for information systems used by public sector bodies and organisations linked to critical infrastructure and essential services.

ENS Alta is the framework's top classification and is required for the most sensitive environments. The assessment is independently validated by the Centro Criptológico Nacional, or CCN, which reviews whether a supplier meets the technical, audit and organisational controls set out in national rules.

The decision is significant for Tanium's position in Spain's public sector market. It means the company can now offer its software-as-a-service platform to central government ministries, regional administrations and other bodies that must meet the strictest security requirements under Spanish law.

Compliance with ENS is mandatory across the Spanish public sector, and its influence is spreading beyond government. Businesses in regulated sectors are increasingly treating ENS Alta controls as a benchmark when selecting suppliers, particularly as European cyber and operational resilience rules widen the number of organisations under tighter scrutiny.

Those pressures include the transposition of the NIS2 directive and the application of the Digital Operational Resilience Act, or DORA. Both have pushed more organisations to seek systems and vendors that support stronger security controls, documented oversight and audit evidence.

Security review

The CCN's review covers a broad set of controls under CCN-STIC guidance, including asset management, access control, cryptography, incident response, business continuity, system integrity and supply chain security.

The process also examines security design, development practices and operational procedures. For buyers in the public sector and tightly regulated industries, that level of scrutiny offers external validation beyond a vendor's self-assessment.

Tanium said the certification gives Spanish customers a way to align technology procurement more closely with their own ENS compliance obligations. In practice, that centres on gathering evidence for audits, maintaining visibility across IT estates and reducing reliance on multiple tools and vendors.

The company argued that one of the main operational issues for organisations subject to ENS is the work required to produce audit-ready documentation, a process that often involves manual data collection across different systems and can take weeks.

Under its model, customers can pull the same evidence from a single console, which Tanium said can cut preparation time and reduce the cost and risk associated with compliance checks.

Regulatory overlap

Tanium also framed the certification around the overlap between ENS, NIS2 and DORA. Many organisations face obligations under more than one framework and have historically managed them through separate products, audit records and supplier relationships.

Its platform allows those requirements to be handled through one deployment and one audit trail, according to the company. Tanium also argued that using fewer agents and systems can reduce operational complexity and narrow the potential attack surface created by a fragmented toolset.

The company also highlighted the importance of asset visibility, arguing that organisations need a near-complete, current inventory of devices and systems to support compliance, incident response and risk management, particularly in sensitive or heavily regulated environments.

Pedro Diaz, Chief Revenue Officer at Tanium, linked the certification to both public sector trust and the company's commercial ambitions in Spain.

"As someone who grew up in Spain, this certification carries real meaning for me beyond the commercial milestone. ENS Alta certification defines which platforms can be trusted with the most sensitive public sector environments and I'm proud Tanium meets this standard," Diaz said.

He added that the approval changes what Spanish customers can do with the platform.

"For Spanish public sector organisations and essential service operators, this means they can now deploy the Tanium Autonomous IT Platform knowing it has been independently validated at the highest level of the national framework. Spain is a strategically important and growing market for us, and this certification accelerates our ability to serve the organisations that keep critical infrastructure running, with the real-time visibility, autonomous execution and audit-ready compliance evidence their ENS programs demand," Diaz said.

The certification gives Tanium a formal entry point into one of Europe's more demanding national security regimes, where external validation by the CCN carries weight with public buyers and regulated operators alike.