ENS for mobile apps.

Delivering an app to a Spanish public administration? Before it goes into production it has to clear its security acceptance. We test the app and its API and give you the report for that acceptance.

Talk to our team All services

What the ENS expects from your app.

For companies delivering citizen-facing apps to a public administration, and for the administrations that operate them.

The Esquema Nacional de Seguridad (Real Decreto 311/2022) sets the security measures a public-sector system must meet. For an application, measure mp.sw.2 "Aceptación y puesta en servicio" requires that, before going into production, you verify that:

the application meets the security acceptance criteria, and
it does not degrade the security of the other components of the service.

For systems in the MEDIA and ALTA categories, that testing runs in an isolated pre-production environment. We perform the vulnerability analysis and penetration test of the mobile app and its API, and give you the report you use for the acceptance.

What we test.

Depending on the agreed scope, testing can cover:

Identity and session: whether an attacker can pass as a citizen or reuse a session.
API authorization: whether one citizen can reach another citizen's data or procedures by changing an identifier in a request.
Data on the device: personal data, tokens and keys left accessible on the phone or in its backups.
Platform attack surfaces: deep links, exported components and the integrations the app exposes.
Third-party SDKs: what the libraries in the app send off the device.

How we work.

Call: you tell us about the app, its API and the category of the system it belongs to.
Proposal: we set out the agreed scope, what we need from you, the schedule and a fixed price.
Testing: for MEDIA and ALTA systems we test in the pre-production environment. If we find something critical, we let you know right away.
Report and review: we send you the report for the acceptance and go through it with your team.
Retest: once you have fixed the vulnerabilities, we confirm they are resolved before go-live.

What you receive.

Technical report

States what we tested and the result. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and OWASP MASWE references, and how to fix it.

Executive summary

Covers the scope and build tested, the results and the priorities, for the people who decide on the acceptance.

Retest report

If you include the retest, we send a new version of the report with the status of each finding on the new build, so you reach go-live with the vulnerabilities fixed.

Why vulnit for the ENS.

We have been evaluators

Our team comes from security certification laboratories, with experience in schemes such as Common Criteria, LINCE and EMVCo SBMP. We know how acceptance and certification work decide, and we write reports with their reviewers in mind.

We contribute to OWASP MAS

We map your tests to OWASP MASVS and MASTG, the standard and testing guide our team helps write. OWASP recognized this work by naming vulnit an OWASP MAS Advocate.

Our own technology

Chameleon gives us deep visibility into what the app does inside the operating system, and protections such as root, pinning and anti-instrumentation checks are handled at the OS level by default, so our time goes into finding issues in the app.

Meet the team

ENS frequently asked questions.

Does your report give us the ENS conformity certificate?

No. The formal ENS conformity certificate is issued by an ENAC-accredited certification entity, and the decision to accept the app belongs to your organization. What we provide is the testing evidence: the vulnerability analysis and penetration test that measure mp.sw.2 calls for, which you use for the acceptance and which your audit can rely on.

Does our app need to be in the CPSTIC catalogue or LINCE-certified?

Generally no. The CPSTIC catalogue and its LINCE or Common Criteria certification apply to products that provide a security function, such as firewalls, VPNs or identity products, not to an ordinary citizen-facing application. If your app itself is a security product, the formal certification is done by a CCN-accredited laboratory, and we can test it beforehand so you reach the evaluation ready.

Do you need source code?

No. By default, testing is black-box: we attack the app with the same information an attacker would have, using the same build that goes to citizens. The ENS does not require a source code audit for mp.sw.2, even at the ALTA category. If you share the source code, we review it too.

Can you test in our pre-production environment?

Yes. For MEDIA and ALTA systems the ENS expects the testing in an isolated pre-production environment, and that is where we work.

Are backend APIs included?

They can be, and we generally recommend it: much of the risk of a citizen-facing app lies in its API. We decide it with you case by case.

Do you test iOS as well as Android?

Yes. We test both, to the same depth. On Android we work with Chameleon; on iOS we test on physical devices. If your app runs on both platforms, we deliver one report per platform.

How long does it take and what does it cost?

It depends on the number of apps and platforms, the complexity of the app and the backend interfaces in scope. We send you a proposal with a fixed price and the schedule. It usually takes one to two weeks per platform, report included.

How do you handle confidentiality?

We agree confidentiality terms before you share builds or documentation. We have a standard NDA, but if you prefer to use yours, we are happy to review it.

Preparing an app for ENS acceptance?

Tell us about the app and the category of the system. We reply within one business day to arrange a scoping call.

Talk to our team