AuthPoint Earns ENS High Qualification from Spain’s National Cryptologic Centre
Every MSP has heard the question in some form: how do you know this actually works? For most security products, the honest answer is a mix of vendor documentation, analyst reports, and your own experience. All useful, but none of it is a verdict from someone with no stake in the result.
Spain’s public sector works differently. When government agencies there buy security products, they look to CPSTIC, a catalog run by Spain’s National Cryptologic Centre (CCN). The CCN is part of the National Intelligence Centre and is responsible for securing the country’s public sector IT. If a product isn’t on the list, the conversation ends there.
WatchGuard AuthPoint, our multi-factor authentication solution, is now in that catalog, qualified at ENS High. ENS stands for Esquema Nacional de Seguridad, Spain's National Security Framework, which sets the security requirements for public sector systems. High is its most demanding category. It’s the only MFA solution from an MSP-focused vendor listed.
Here’s why it matters outside Spain too, starting with how hard this list is to get on.
What it takes to get in
Getting into CPSTIC isn’t quick, and it isn’t easy. Every product has to pass an evaluation by an independent, accredited lab against the CCN’s security requirements before it can be listed. It took serious work from our engineering and product teams to get there.
That’s a level of scrutiny no customer can replicate on their own. The lab doesn’t take the datasheet’s word for anything. It tests the product against a defined set of requirements and documents what it finds. Then the CCN decides whether it qualifies. Passing means someone other than us has confirmed that AuthPoint meets the requirements for use in ENS High systems.
Why it matters wherever you sell
For MSPs outside Spain, the value is evidence. When a prospect asks how you know the MFA you recommend holds up, you can point to a national government’s security qualification instead of a vendor datasheet. That's useful at a time when customers are open to change: according to WatchGuard’s MSP Survey 2026, 58% of organizations plan to switch providers within the next three years.
Use it where it counts: in proposals and in security questionnaires.
Identity stays in the attack
Identity is also where that proof earns its keep. Attackers keep changing how they get in, but the login stays in play. In the 2026 Verizon Data Breach Investigations Report (DBIR), vulnerability exploitation became the most common initial access vector. Yet across government agencies worldwide, stolen credentials were still used in 59% of hacking-related breaches, according to the DBIR's public sector findings.
An attacker can get in through an unpatched system, but to move around, escalate privileges, and reach what matters, they usually need a valid session.
MFA is what stands between a stolen password and a valid session.
First endpoint, now identity
This isn’t WatchGuard’s first time in the catalog. Our endpoint security products are already qualified at ENS High. AuthPoint extends that validation from the device to the login. It protects access to cloud applications, VPNs, workstations, servers, and remote desktop sessions with MFA, single sign-on, and phishing-resistant passwordless authentication. AuthPoint and our endpoint products are all managed from WatchGuard Cloud, the same platform our partners already use for their customers’ security.
You can find AuthPoint's entry in the CPSTIC catalog and all of our certifications in the Trust Center. To talk through how this fits your offering, reach out to your WatchGuard account manager.
We pursued this qualification for Spain’s public sector, but the result is something every partner can use: third-party proof that AuthPoint holds up. Independent validation doesn’t replace the work you do for your customers every day. It backs it up.
For more on why identity comes first and how to roll out MFA across every customer, start here:
- Why Multi-Factor Authentication (MFA) Is No Longer Optional
- In the Digital Era, Security Starts with Identity
- How to MFA Everywhere