The Nodeward Security Baseline

Five levels. One honest answer to "how secure are we?"

Security is not a product you buy; it is a level you reach and hold. The Baseline is how we tell you where you are today, what the next level costs, and what each plan commits to.

Find your level: free assessment See the plans

The levels

Where businesses actually are.

Exposed

No one is responsible. Updates are whenever someone remembers; the firewall has the rules it shipped with; backups are a USB drive or an assumption.

How you know

Shared passwords or no multi-factor authentication
Windows 10 or older still in use
Backups never restore-tested
Remote Desktop or router admin reachable from the internet
Nobody can draw the network

How you get there

This is where most businesses with no IT provider sit, including ones that feel fine. The free assessment tells you in writing whether this is you.

Patched

Systems are current and someone owns that. Known holes are closed.

How you know

Operating systems and browsers updated on a schedule
End-of-life software retired or isolated
Firewall rules reviewed and documented
An asset register exists
Admin accounts separated from daily-use accounts

How you get there

Reachable in the first 30 days of a managed agreement, or as a one-off remediation project.

Protected

The controls that stop the common attacks are in place and enforced, not optional.

How you know

Multi-factor authentication on every account
Managed endpoint detection and response (EDR) on every device
Email authenticated: SPF, DKIM and DMARC at p=reject
Next-generation firewall with guest, staff and building systems segmented
Least-privilege access to shared data

How you get there

The baseline every Nodeward managed client reaches. It covers the entry points behind the overwhelming majority of SMB incidents.

Monitored

Someone is watching, and would notice.

How you know

Endpoint alerts reviewed, not just generated
Backups verified daily and restore-tested quarterly
Monthly vulnerability scan with findings tracked to closure
Credential exposure checked against breach data
Monthly service report with open risks

How you get there

Standard and Complete plans. This is what an insurer, auditor or enterprise client expects to see evidence of.

Resilient

An incident is a bad day, not the end of the business.

How you know

Immutable backup copies that ransomware cannot encrypt
Written, tested recovery procedure with agreed recovery time
Staff trained and phishing-tested
Quarterly access and configuration reviews
Technology roadmap and budget guidance

How you get there

The Complete plan. For regulated sectors, client-audited firms and anyone whose business stops when IT does.

Framework mapping

How the Baseline maps to what auditors ask for.

Each level implements controls drawn from the frameworks UAE regulators, insurers and enterprise clients reference. The table shows where each level contributes.

Level	CIS Controls v8	NIST CSF 2.0	ISO/IEC 27001:2022 Annex A	UAE IA (NESA)
Level 02Patched	1 · 2 · 4 · 7	ID.AM · PR.PS	5.9 · 8.8 · 8.9 · 8.19	T1 · T7
Level 03Protected	3 · 5 · 6 · 9 · 10 · 12	PR.AA · PR.DS · PR.IR	5.15–5.18 · 8.5 · 8.7 · 8.20–8.22	T4 · T5
Level 04Monitored	7 · 8 · 13	DE.CM · DE.AE · ID.RA	5.7 · 8.15 · 8.16	T3 · M6
Level 05Resilient	11 · 14 · 17	PR.AT · RS · RC	5.24–5.30 · 6.3 · 8.13	M3 · T8 · T9

UAE PDPL (Federal Decree-Law No. 45 of 2021): the Protected and Resilient levels support the law's requirements for appropriate security of personal data and for detecting and reporting breaches.

UAE IA control families: T1 asset management · T3 operations management · T4 communications · T5 access control · T7 systems acquisition, development and maintenance · T8 incident management · T9 continuity · M3 awareness and training · M6 performance evaluation.

The mapping shows where Baseline controls contribute. It is not a certification and does not replace a formal gap assessment against the full standard.

Readiness check

Thirty questions. About five minutes.

Find your level before we meet. Your answers stay in your browser.

Start the readiness check

Services by level

Request your free IT assessment.

A 60-minute review at your site. The written summary is yours to keep.

Request online or call +971 50 383 9557

Five levels. One honest answer to "how secure are we?"

Where businesses actually are.

Exposed

Patched

Protected

Monitored

Resilient

How the Baseline maps to what auditors ask for.

Thirty questions. About five minutes.

What moves you up.

Exposed → Patched

Patched → Protected

Protected → Monitored

Monitored → Resilient

Request your free IT assessment.