Compliance

Your organization sees the frameworks that match its compliance region (chosen in Settings or inferred from billing). You can switch frameworks with the selector; the link includes ?marco=…

European Union (ENS and NIS2)

• Insurance: what cyber insurers usually ask about (same everywhere).
• ENS: measures from Annex II of Spain's ENS that Ward can review with evidence (for companies that work with the public sector).
• NIS2: items from Article 21(2) of the NIS2 Directive that Ward can review (for organizations in scope of NIS2).

United States and rest of world (NIST CSF)

• Insurance: what cyber insurers usually ask about (same everywhere).
• NIST CSF 2.0: subcategories Ward can review with evidence. The CSF is voluntary and is not certifiable.

• Ward only covers the controls listed in each framework tab. Other ENS, NIS2 or NIST requirements are out of scope.
• For checked controls, Ward shows technical evidence from passive scans and connectors (read-only).
• For guided controls, Ward gives a short how-to and an Admin marks «We have this»; the report says declared, not checked.
• The printable report and the verification link always use the framework you are viewing.

• Met: there is no open finding of that kind in any of your monitored domains, and Ward has read it within the last 8 days.
• Not met: there is at least one open finding. An accepted risk or false positive doesn't count as met.
• Not checked: Ward has no recent reading, or the connector isn't connected.
• Declared: an Admin confirmed the guided control; Ward doesn't verify it.

These controls come from Ward's own scans of your domain, with public sources:

• Is remote desktop or other remote access exposed to the internet?
• Is the software exposed to the internet up to date and still supported?
• Is email protected against spoofing (SPF, DKIM, DMARC)?
• Does the website use HTTPS with a valid certificate?
• Are there leaked or stolen team passwords that haven't been changed?
• Is the domain protected against expiry and hijacking?
• Does the company appear in ransomware leaks or on blocklists?

With a connector (Microsoft 365 or Google Workspace), Ward also reads, without changing anything:

• Do administrator accounts use two-step verification?
• Does the whole team use two-step verification for email?

Ward can't see these from outside. Each one has a short guide, questions you can ask Ward AI and a “We have this” button that an Admin presses once it's true:

• Are there backups kept outside the office and tested?
• Is there antivirus or EDR on every computer?
• Does the team get phishing awareness training?
• Is there an incident response plan?
• Are laptops encrypted?
• Do you have a security policy approved by management?
• Have you done a risk analysis in the last year?
• Do you revoke access the same day someone leaves?
• Do you know which suppliers have access to your data or systems?

1. 1

   Download the report

   In Compliance, choose the framework and press “Download report”. You get a printable page: save it as a PDF from your browser.
2. 2

   Copy the verification link

   “Copy verification link” creates a code (like K7Q2-9XMT) and copies its address with the same ?marco= as you are viewing. It works for 90 days.
3. 3

   Send the PDF and the link

   The PDF has the detail and evidence. The link opens a page, with no sign-in, that confirms your company name, your domains, the date of the last scan and the state of each control for that framework. It never shows raw evidence or findings.
4. 4

   Revoke it when you no longer need it

   In Compliance, “Revoke” turns a link off straight away.

The Ward plan includes every framework in your region, connectors included.