Compliance: controls and the frameworks that switch them on

Noust does not ship a "compliant" mode. It ships controls, each one a technical thing a server can require, and frameworks, which are presets that turn on the controls that help with a standard and say which clause each serves. Nothing is on unless you choose it.

What a framework is, and is not

A framework turns on the technical controls that help with a standard: sessions that end, backups that are encrypted, a second person for a root-equivalent change. That is a part of what the standard asks, and never all of it. Every standard here also asks for things no setting can do - a risk analysis, a policy somebody approves, people who are trained, suppliers who are managed, an audit by somebody else. Each framework below lists what stays organisational, and what is technical but not enforced by Noust. Neither Noust nor this page says that a server, or an organisation, is compliant: only your auditor can.

A control appears in a framework only where Noust can name the clause it serves. Where a framework leaves a number to the organisation (how long a session may idle), the value is Noust's reading of a reasonable limit and the row says so; where the framework fixes the number (CIS 4.3's fifteen minutes) the row says that instead.

How they combine

• Controls are the unit. Each has its own setting. By default every one is as permissive as Noust has always been.
• Frameworks are presets over the controls. Enabling one turns on what it names.
• More than one at once. ENS together with ISO/IEC 27001 is common in Spain. The value of each control is the strictest any enabled framework asks.
• You may tighten, never loosen. A control's own setting counts on top of the frameworks: set it stricter and it is stricter; set it looser than an enabled framework asks and the framework's value applies. Disable the framework first to loosen it.
• security.profile: ens-medium (and any spelling of it, failing strict as it always did) keeps working and means ENS MEDIA is enabled.

noust compliance status                     what is on, and what forces what
noust compliance frameworks                 the frameworks and what each turns on
noust compliance show iso-27001             one framework's clauses, in full
noust compliance enable ens-media iso-27001 turn frameworks on (shows what changes first)
noust compliance disable iso-27001          turn one off (sudo mode in the console, audited)
noust compliance controls                   every control, its value and who forces it
noust compliance set change_reasons on      a control's own setting
noust compliance check [--framework X]      per framework, clause by clause

The console has the same under Settings > Compliance. Disabling a framework, or loosening a control, asks for sudo mode and is recorded in the audit trail; turning one on does not.

The controls

Access and accounts

Accountability and the audit trail

Backups

Network and host

The frameworks

ENS BÁSICA

Spain's National Security Scheme, category BÁSICA: the measures of Annex II that apply to the lowest category.

Reference: Real Decreto 311/2022, Annex II.

Enable it with noust compliance enable ens-basica. It asks of 16 control(s); 12 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The security policy and its approval (org.1, org.2), the security roles and the committee (org.3, org.4).
• The risk analysis and the categorisation of the system (op.pl.1, Annex I), and the declaration of applicability.
• People: duties, awareness and training (mp.per).
• Physical security of the premises and the equipment (mp.if), and the workstation (mp.eq).
• Service continuity: impact analysis, plan, tests, alternative means (op.cont).
• Suppliers and external services (op.ext) and certified components (op.pl.5).
• Incident management and notification to the CCN-CERT (op.exp.7, op.exp.9), and the periodic security audit (art. 31).

ENS MEDIA

Spain's National Security Scheme, category MEDIA: what Noust has called the ens-medium profile since 3.1.

Reference: Real Decreto 311/2022, Annex II.

Enable it with noust compliance enable ens-media. It asks of 39 control(s); 34 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The security policy and its approval (org.1, org.2), the security roles and the committee (org.3, org.4).
• The risk analysis and the categorisation of the system (op.pl.1, Annex I), and the declaration of applicability.
• People: duties, awareness and training (mp.per).
• Physical security of the premises and the equipment (mp.if), and the workstation (mp.eq).
• Service continuity: impact analysis, plan, tests, alternative means (op.cont).
• Suppliers and external services (op.ext) and certified components (op.pl.5).
• Incident management and notification to the CCN-CERT (op.exp.7, op.exp.9), and the periodic security audit (art. 31).

ENS ALTA

Spain's National Security Scheme, category ALTA: MEDIA plus a backup kept apart.

Reference: Real Decreto 311/2022, Annex II.

Enable it with noust compliance enable ens-alta. It asks of 40 control(s); 35 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The security policy and its approval (org.1, org.2), the security roles and the committee (org.3, org.4).
• The risk analysis and the categorisation of the system (op.pl.1, Annex I), and the declaration of applicability.
• People: duties, awareness and training (mp.per).
• Physical security of the premises and the equipment (mp.if), and the workstation (mp.eq).
• Service continuity: impact analysis, plan, tests, alternative means (op.cont).
• Suppliers and external services (op.ext) and certified components (op.pl.5).
• Incident management and notification to the CCN-CERT (op.exp.7, op.exp.9), and the periodic security audit (art. 31).

Technical, and not enforced by Noust:

• Suspending credentials after a period of non-use (op.acc.6.r7.1, from ALTA).
• Automatic correlation of events and automatic response (op.exp.8.r5, op.mon.3.r1, from ALTA).
• Qualified certificates as authentication (op.acc.6.r3, r4), where chosen instead of a second factor.

ISO/IEC 27001:2022

The international information security management standard: the technical controls of Annex A that a deployment tool can enforce.

Reference: ISO/IEC 27001:2022, Annex A.

Enable it with noust compliance enable iso-27001. It asks of 38 control(s); 33 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The management system itself: context, scope, leadership, policy, risk assessment, the statement of applicability, internal audit and management review (clauses 4 to 10).
• People and physical controls (Annex A, themes 6 and 7).
• Supplier relationships (A.5.19 to A.5.23) and incident management (A.5.24 to A.5.28).
• Vulnerability and malware management on the hosts (A.8.7, A.8.8).
• Certification, which only an accredited body grants.

NIS2

The EU directive on the security of network and information systems: the risk-management measures of article 21(2) a server can help with.

Reference: Directive (EU) 2022/2555, article 21.

Enable it with noust compliance enable nis2. It asks of 21 control(s); 16 of them ask for more than the default.

What stays organisational (no setting does it for you):

• Governance: management approves and answers for the measures (art. 20).
• Risk analysis and security policies (art. 21(2)(a)), supply-chain security (d), secure development and vulnerability handling (e), training (g).
• Reporting a significant incident: early warning in 24 hours, notification in 72, final report in a month (art. 23).
• Registration with the authority, and the national transposition that applies to you.

CIS Controls v8, IG1

The Center for Internet Security's essential cyber hygiene (Implementation Group 1): the safeguards of IG1 a deployment tool can enforce.

Reference: CIS Critical Security Controls v8.

Enable it with noust compliance enable cis-ig1. It asks of 7 control(s); 7 of them ask for more than the default.

What stays organisational (no setting does it for you):

• Inventories of enterprise assets and software (controls 1 and 2).
• Malware defences, email and browser protections, vulnerability management (controls 7, 9, 10).
• Security awareness training (control 14), service-provider management (control 15).
• An incident response process (control 17).

CIS Controls v8, IG2

CIS Controls v8, Implementation Group 2: IG1 and the safeguards of IG2 a deployment tool can enforce.

Reference: CIS Critical Security Controls v8.

It contains everything cis-ig1 asks.

Enable it with noust compliance enable cis-ig2. It asks of 11 control(s); 10 of them ask for more than the default.

What stays organisational (no setting does it for you):

• Everything IG1 leaves organisational, and penetration testing (control 18).
• Centralised account and access management beyond the server (5.6, 6.7).
• Network monitoring and defence (control 13).

SOC 2, Security

The AICPA Trust Services Criteria for Security (the common criteria): the logical access, monitoring and change-management criteria a server can help with.

Reference: AICPA Trust Services Criteria (2017, revised points of focus 2022), CC6, CC7, CC8.

Enable it with noust compliance enable soc2-security. It asks of 24 control(s); 22 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The audit: a SOC 2 report is an independent auditor's opinion, not a setting.
• The control environment, risk assessment and communication (CC1 to CC5).
• Vendor management (CC9.2), human resources, physical access (CC6.4) and disposal (CC6.5).
• Availability, confidentiality, processing integrity and privacy are other criteria; backups serve Availability (A1.2), so they are not part of this preset.

GDPR / RGPD, article 32

Security of processing under the General Data Protection Regulation: the technical measures of article 32(1) a server can help with.

Reference: Regulation (EU) 2016/679, article 32.

Enable it with noust compliance enable gdpr-32. It asks of 17 control(s); 13 of them ask for more than the default.

What stays organisational (no setting does it for you):

• The lawful basis, purposes, records of processing (art. 30) and impact assessments (art. 35).
• Data-subject rights (art. 15 to 22), processor contracts (art. 28), the data protection officer (art. 37).
• Notifying a breach to the authority and to the people affected (art. 33, 34).
• Pseudonymisation of the data your applications hold (art. 32(1)(a)): Noust does not see inside them.

All of them side by side

What each framework asks of each control. A blank cell means it asks nothing.