After an audit finding
on access
An auditor for NIS2, DORA or ISO 27001 found that leavers still have accounts, that service accounts have no owner, or that nobody can show who reviewed which access. RapidValue makes each of these visible on your own data in one morning, and records every decision after that as evidence for the next audit.
What the auditor wants to see, and what you can show
| Finding | What the auditor wants to see | What RapidValue shows | The evidence for the next audit |
|---|---|---|---|
| Leavers with active accounts | What the auditor wants to seeThat access ends when people leave, and proof that it did | What RapidValue showsThe accounts in each connected system that no longer match a current employee in HR | The evidence for the next auditEach leaver’s accounts, when they were closed and who decided |
| Service accounts without an owner | What the auditor wants to seeA named owner and a reason for every account that is not a person | What RapidValue showsService accounts, app registrations and AI agents without an owner, each with a proposed owner and its evidence | The evidence for the next auditOwner, reason and review rhythm per account, and when its secrets expire |
| No proof of access reviews | What the auditor wants to seeRegular reviews by people who can judge the access | What RapidValue showsWho holds what in each system, grouped by owner and ready for a first review | The evidence for the next auditEvery review decision with the reviewer, the date and the reason, and reviews approved without real attention flagged |
| Conflicting access | What the auditor wants to seeThat combinations you do not allow do not exist, or are accepted on purpose | What RapidValue showsPeople who hold a combination you do not allow, across systems | The evidence for the next auditEach conflict with its decision: removed, or accepted with a reason |
Start on your own data, before the follow-up audit
The first morning
Connect HR and one application, read-only. Before lunch you see the accounts that should no longer exist.
The week after
In a proof of concept of about a week your team works through the first proposals: owners, leavers, a first review.
From then on
Every decision is recorded with its reason as it is made. At the next audit you show the record, not a spreadsheet made for the occasion.
What we deliver for each obligation, and what not
Each page lists the controls RapidValue scores and the evidence it produces.
The auditor decides, we bring the evidence
RapidValue scores your access controls against the obligation, so you see where you stand.
It records who decided what and why, and exports it for the auditor.
It does not certify compliance and it is not a complete NIS2 or DORA programme.
Questions after an audit finding
Does RapidValue make us compliant with NIS2?
No tool does that on its own. RapidValue contributes the identity governance controls, with a score and the evidence. It is not a complete NIS2 programme or a certification.
How fast can we show progress to the auditor?
The first morning shows the gaps on your own data. From the proof of concept on, every decision your team takes is recorded with its reason, so the record grows from the first week.
What evidence can we hand the auditor?
The decisions with their reviewer, date and reason, the owners of accounts that are not people, and the conflicts with their decision. The sample report on Resources shows what a proof of concept delivers.
Does the pilot change anything in our systems?
No. In the pilot we connect your HR source and one target system read-only. Nothing in your systems changes.