Security & Compliance

ShieldAD Report™ is a read-only Active Directory audit platform built in Belgium. Every scan runs on-premises, reports stay stored locally on your machine, and no data is ever sent to Mandatory Shield Company. The platform is aligned with NIS2, ISO/IEC 27001, ANSSI, GDPR, CIS Controls® v8.1 and DORA.

View compliance standards Report a vulnerability

Why trust ShieldAD?

Three architectural guarantees, verifiable in the code and on site.

Read-only audits

Your Active Directory is never modified. ShieldAD performs 100% passive scanning: it reads configuration attributes and never writes to your domain.

Fully local reports

HTML reports are generated locally, in the Documents\ShieldAD folder on your machine. Any network communication (where applicable, for the Entra ID module) uses TLS 1.2 or higher.

Nothing sent to Mandatory Shield

Your reports and scan data are never sent to Mandatory Shield Company. They stay stored locally, including to enable historical tracking (trend report) across scans, without ever leaving your infrastructure.

Compliance standards

ShieldAD maps its technical controls to the frameworks your auditors and regulators expect, without ever displaying a synthetic percentage score.

NIS2
Mapped
EU Directive 2022/2555 (critical entities)
Technical controls map to NIS2 risk-management and incident-notification requirements for essential and important entities.
ISO/IEC 27001
Mapped
Security governance & access control
Report structure and control coverage align with ISO/IEC 27001 Annex A domains, including access control and incident management.
ANSSI
Mapped
Active Directory hardening guide
Kerberos, delegation and privileged-account checks follow ANSSI's Active Directory hardening recommendations.
CyFun
Mapped
Belgian CCB framework (2025)
Asset identification, authentication protection and anomaly detection controls map to the Small/Basic/Important/Essential levels of the Centre for Cybersecurity Belgium's CyFun framework.
GDPR
Mapped
Data protection compliance
ShieldAD analyzes technical AD configuration attributes only: no personal data is extracted, stored or transmitted during a scan.
CIS Controls®
Mapped
Technical benchmark v8.1 (IG1/IG2/IG3)
Findings are mapped to CIS Controls v8.1 implementation groups for practical, prioritized remediation.
DORA
Mapped
Operational resilience (financial entities)
Access-management and resilience-testing evidence support DORA's ICT risk-management requirements for EU financial entities.

Security practices

Concrete engineering and governance measures behind every ShieldAD release.

NDA-protected delivery

Every on-site engagement starts with a signed non-disclosure agreement, protecting your Active Directory configuration and findings before any data is touched.

Integrity verification (SHA-256)

The ShieldAD executable's SHA-256 hash is validated together with your consultant, in person, before every scan, so you can be certain nothing was tampered with before launch.

Audit logging

Every scan is recorded and traceable, giving your team a clear operational history of ShieldAD activity.

On-device data storage

Scan results, findings and license data stay in a local folder on the machine you run ShieldAD from: nothing is synced to external servers or cloud storage.

Annual security reviews

Mandatory Shield Company runs an internal security audit of ShieldAD every year.

Shared responsibility

ShieldAD provides evidence and prioritization; your CISO remains the owner of the findings and remediation decisions.

Found a security vulnerability?

Contact us responsibly: we take every report seriously.

contact@mandatoryshield.com

Response time: within 48 business hours
PGP key: see /.well-known/security.txt

  • Description of the issue
  • Steps to reproduce
  • Potential impact
  • Your contact information

We will acknowledge receipt of your report and keep you informed as we work to resolve it.