Sector add-ons
Some sectors carry extra risk and extra rules. Sector add-ons layer additional controls on top of the core ShieldNet standard, tuned to the realities of your kind of work. They are not a separate standard. You implement the core first, then add the pack that fits you. Every add-on uses the same five Action Zones, so the extra controls slot straight into the framework you already know.
How a sector add-on works
Sector add-on
Common controls
Baseline sector risks that apply to every organization in the sector.
Controls by organization type
Extra controls for your specific role in the sector.
Core standard
48 controls, the baseline for everyone.
First implement the core, then the common controls, then the controls for your organization type.
The five sector add-ons
ShieldNet has five sector add-ons today. Each one names the kinds of organizations it covers, so you can find your place in it.
Healthcare
- Who it is for
- Care providers and the wider health sector, where patient safety and sensitive data are at stake.
- Risk note
- A high sensitivity sector. ShieldNet treats these controls as mandatory enhancements for small and medium healthcare organizations.
- Organization types
- Healthcare providers and clinics, hospitals, medical device makers, laboratories, pharmaceutical companies, and healthcare supply chain entities.
Education
- Who it is for
- Schools, universities and other education providers handling student data, including data about minors.
- Risk note
- A high sensitivity sector. ShieldNet treats these controls as mandatory enhancements for small and medium education organizations.
- Organization types
- Research institutes and universities, primary and secondary schools, and other education providers such as adult education.
Water & Wastewater
- Who it is for
- Operators of essential water and sanitation services, including their operational technology.
- Risk note
- A critical sector for society. ShieldNet treats these controls as mandatory enhancements for small and medium water sector organizations.
- Organization types
- Water utilities, wastewater operators, and water infrastructure contractors.
District Heating & Cooling
- Who it is for
- Operators keeping heating and cooling supply running, where outages can become public safety events.
- Risk note
- A critical supply sector. ShieldNet treats these controls as mandatory for the in scope parts of organizations that meet NIS2 or CER thresholds.
- Organization types
- Network operators, plant and source operators, building node service providers, and heating technology providers.
Ecommerce & Retail
- Who it is for
- Online and physical retailers handling payments, customer data and order operations at scale.
- Risk note
- A sector exposed to fraud and account abuse. Apply the controls that match your business model and sales channels.
- Organization types
- Online merchants with their own store and fulfilment, customer operations and returns, marketplace operators, and physical retail with point of sale.
Which add-on applies to you
Pick the add-on that matches your sector. If your organization spans more than one type, for example a hospital with a research wing, or a utility with its own engineering team, combine the controls from each part that applies to you. When in doubt, start with the common controls, they cover the risks shared across the whole sector.
Get the sector add-ons
Each add-on is a free document, to use alongside the core standard. Download the one that fits you, or read the core standard first.