The ShieldNet Standard
The ShieldNet standard is the heart of the framework. It is a set of 48 plain language controls, grouped into five Action Zones, that take Europe's cybersecurity rules and turn them into things you can actually do. This page shows what the standard covers, how a single control is built, and how the controls connect to ready made templates so you can prove your work.
The five Action Zones
The 48 controls are grouped into five Action Zones. Together they follow the full security lifecycle, from knowing what you have, through protecting and watching it, to responding and improving.
KNOW & PLAN
10 controls
SHIELD & BUILD
9 controls
WATCH & PATCH
10 controls
REACT & RECOVER
10 controls
LEARN & LIFT
9 controls
KNOW & PLAN
Know your assets, risks, and obligations, and plan ahead for security.
10 controls
Lay the foundation. Identify your critical systems and data, understand your legal duties, assess your risks, and assign clear responsibility. Plan now, so you are not improvising later.
SHIELD & BUILD
Shield your technology and build it strong, keep attackers out from the start.
9 controls
Put the protections in place. Control who has access, set systems up securely, encrypt sensitive data, build software safely, and keep only the data you actually need.
WATCH & PATCH
Watch for signs of trouble, and patch problems quickly to stay secure.
10 controls
Stay alert and current. Keep logs, watch for unusual activity, and fix known weaknesses quickly through patching and vulnerability management.
REACT & RECOVER
React fast when incidents strike, and recover to business as usual quickly.
10 controls
Be ready for the bad day. Have a response plan, keep reliable backups, know how to get back to normal operations, and meet your reporting duties.
LEARN & LIFT
Learn from every experience and lift your cybersecurity maturity continuously.
9 controls
Close the loop. Review what happened, train your people, and improve your security one step at a time.
How a control is built
Every control in the standard follows the same simple shape. Once you know the shape, the whole standard is easy to read.
ID and name
A short tag and a title, so you can find and reference the control.
Control text
The action you must take, written as a clear thing to do.
Why
The reason in plain language, so you understand the point, not just the rule.
Evidence examples
The proof you keep to show the control is in place. This is where the Annex A templates come in.
Legal anchors
The EU laws the control connects to, so you can trace it back to the rule.
A real control from the standard
- ID and name
- KP1, Assign Security Responsibility
- Control text
- Designate an internal InfoSec Coordinator (however small the organization) and define their authority to implement security controls.
- Why
- Every organization needs a point person for security, otherwise critical tasks will be missed.
- Evidence examples
- Appointment letter from the CEO, an org chart showing the role, a job description, meeting notes.
- Legal anchors
- GDPR Art. 5(2), NIS2 Art. 21(2)(a), NIS2 Art. 20(6).
This is one of the 48 controls, shown as it appears in the standard, which is published in English.
From control to evidence
Look again at the Evidence examples in a control. It tells you what proof to keep. You do not have to build that proof from scratch. Annex A, the Quick-Start Artefact Kit, gives you ready templates for the records you need, so you start from a structured form, not a blank page. You fill a template in once and reuse it, and the same records become your proof when you certify.
Evidence in a control
an asset inventory
Annex A template
Asset Register
A living list of your systems and data, and how critical each one is.
Evidence in a control
a risk register with ratings, owners and due dates
Annex A template
Risk Register
Your top risks, each with an owner, a rating and an action. The risk assessment control's evidence field asks for exactly this.
Evidence in a control
an incident record
Annex A template
Incident Log
A record of incidents and how you handled them, fed by the incident response controls.
That is the loop. A control tells you what to do and what to keep. Annex A gives you the template. The records you fill in become both your day to day system and your evidence when you certify.
The annexes
Annex A is one of four annexes that support the standard. Annex B maps each control to the EU law behind it. Annex C covers certification. Annex D covers education. All of them are free to download.
Get the standard
This page shows how the standard is built. The full standard has all 48 controls, each with its control text, reason, evidence examples and legal references. It is free to download, with no registration.