# noust ens

Check this server against Spain's ENS (category MEDIUM) and write the evidence.

```bash
noust ens [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`access-review`](#noust-ens-access-review), [`check`](#noust-ens-check), [`inventory`](#noust-ens-inventory), [`profile`](#noust-ens-profile), [`report`](#noust-ens-report)

## noust ens access-review

The periodic review of who may do what (op.acc.4.4).

```bash
noust ens access-review [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`attest`](#noust-ens-access-review-attest), [`list`](#noust-ens-access-review-list)

## noust ens access-review attest

Record that you reviewed the list of accounts and roles (op.acc.4.4).

```bash
noust ens access-review attest [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--notes` | What was looked at and what was changed. | `` |
| `--json` | Print what was recorded as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens access-review list

Show every account, role, second factor and token, and past reviews.

```bash
noust ens access-review list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the list and its digest as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens check

Compare this server with the ens-medium profile, measure by measure.

```bash
noust ens check [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--cached` | Reuse the last hardening checks instead of probing the server again (faster). |  |
| `--all` | Also show the checks that pass. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens inventory

Each application's owner, criticality and classification (op.exp.1).

```bash
noust ens inventory [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`list`](#noust-ens-inventory-list), [`set`](#noust-ens-inventory-set)

## noust ens inventory list

List the inventory, or export it as JSON or CSV for an auditor.

```bash
noust ens inventory list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--format` | How to print it. | `table` |
| `-o`, `--output` | Write to this file (created 0600) instead of standard output. |  |
| `--json` | Same as --format json. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens inventory set

Set an application's owner, criticality or classification.

```bash
noust ens inventory set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--owner` | Who answers for it: a person, a team, a contact. Empty clears it. |  |
| `--criticality` | The category of the service it supports (ENS Anexo I). |  |
| `--classification` | How its information is handled (mp.info.2). |  |
| `--notes` | Anything else the organisation records. |  |
| `--json` | Print the entry as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens profile

Show which security profile is on, and every value ens-medium fixes.

```bash
noust ens profile [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the profiles as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust ens report

Write the evidence bundle for an ENS auditor (JSON and Markdown, hashed).

```bash
noust ens report [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--output` | Directory to write the bundle to (default: ens-reports/ beside the store). |  |
| `--cached` | Reuse the last hardening checks. |  |
| `--json` | Print the report itself as JSON instead of writing files. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |