ShieldNet
ENPL

Certification for organizations

Show that your organization takes the ShieldNet standard seriously. Organization certification has three levels. Starter is a free self-assessment. Verified and Assured are independent assessments carried out by an Authorized Assessment Body, with the final decision made by the foundation's Certification and Impartiality Committee.

Three levels

  1. Free self-assessment

    Starter

    You assess your organization against all 48 core controls, provide evidence using the Annex A templates, and make a declaration. It is a first-party declaration, not an audit.

  2. Independent assessment

    Verified

    An Authorized Assessment Body reviews your evidence, interviews key staff and spot-checks technical settings. It confirms that the controls are in place and working.

  3. In-depth assessment

    Assured

    The most thorough level: a full evidence review, wider interviews and technical verification, such as vulnerability scans, restore tests and an incident drill.

An Authorized Assessment Body cannot be the company, or part of the group, that helped you implement the standard.

How to start with Starter

  1. Register your organization

    Register your organization with Fundacja ShieldNet. Registration opens when the certification program launches.

  2. Assess yourself against the controls

    Go through the 48 controls across the five Action Zones, and the relevant sector add-on if one applies to you, and judge honestly where you stand on each.

  3. Complete the questionnaire

    Work through the structured questionnaire that follows the ShieldNet controls, provided to registered organizations.

  4. Provide your evidence

    For each area, attach the proof that the control is in place, using the ready templates in Annex A so you are not starting from a blank page.

  5. Declare and earn the Starter mark

    When your self-assessment and evidence are complete, you make your declaration and can use the ShieldNet Starter mark.

  6. Review every year

    Security changes, so revisit your self-assessment at least once a year and keep your evidence current.

  7. Move up when you are ready

    Choose an Authorized Assessment Body from the public partner register to go for Verified or Assured.

Ask about certification

Registration opens when the certification program launches.

What the mark means, and what it does not

  • What it means

    You have assessed your organization against a recognized open standard, you have evidence for your controls, and you are willing to stand behind that publicly. It shows customers, partners and staff that you have done the work.

  • What it does not mean

    Starter is not an independent audit. No ShieldNet level is a government or EU certification, or a guarantee of perfect security.

We are deliberately clear about this, because honest scope is what makes a mark worth trusting.

Before you certify

Not ready yet? Put the standard and a working management system in place first, then come back to certify.