Services / Audit and compliance
AuditWe run an infrastructure audit with a fix backlog and verification
We design, run, and follow through an infrastructure audit. We start from your systems: data, regulation, RTO, and who signs an exception. Then we collect a scan, CIS, IAM, the edge, copies, and logs. We leave a backlog with an owner, a close date, and a rescan. We map this to ISO 27001, SOC 2, DORA, or KNF, with evidence in the system.
How it fits together
From the systems map to a backlog and a verification rhythm
First we understand the systems, the data, and the regulation. On that basis we put together OpenVAS, Wazuh, the edge, and a dashboard. The report for the board and the list for engineering are two views of the same backlog.
- A CIS exception has an owner and a review date.
- The 30, 60, and 90 day plan is visible on the same dashboard that on-call uses.
We run a scan that feeds a remediation queue
Greenbone OpenVAS, including authenticated scans. A result has CVSS, exposure, and an owner. A rescan after the patch. Critical gaps enter the queue in the same week as the finding.
Scope
Hosts, panels, databases, staging, and production. A separate policy for what is visible from the internet.
Priority
CVSS together with data and exposure. A public origin before a host with no inbound traffic.
Evidence
Closure is verification by scan, with the finding next to the rescan.
Rhythm
A standing cycle plus a scan after change. A report for the board and a list for engineering.
We keep CIS and a change audit trail in one place
SCA shows drift against the benchmark. FIM and logs say who changed a file and when. This is material for access control and for a permissions review, on a standing cycle.
CIS
A benchmark per system. An exception has a justification and a review date.
IAM
Accounts, keys, sudo, cloud roles. Dead accounts and excess permissions go to the backlog.
Audit trail
Deploy, login, group change. Who, when, from which source.
Evidence
Export for the auditor. Retention aligned with policy, with disk space planned for that retention.
We check the edge as a control
WAF, Access, and origin hiding are a control. Audit checks what still listens on 0.0.0.0 and whether a panel entered through identity. Edge logs close the picture together with the host.
Surface
DNS, ports, panels, API. A list of what should be public, the rest behind Access or VPN.
Rules
WAF for the application. Exceptions documented. Rate limit on login and expensive endpoints.
Identity
Grafana, cloud, and staging through SSO. Short session, login log.
Gap
An origin exposed beside Cloudflare is a finding, with an owner and a close date.
We keep a control that works between audits
After the report a dashboard remains: backup, certificates, IAM failures, scan. The next audit starts from what was closed. The 30, 60, and 90 day plan has a measurable state.
Posture
Cloud and on-prem: encryption, logs, public buckets, open SGs.
Trend
Number of open P1s, age of a gap, agent coverage. A chart for the board from the same backlog.
Mapping
ISO 27001, SOC 2, DORA, KNF. Control in infrastructure, together with policy.
People
Owner, deadline, escalation. The auditor gets evidence, engineering gets a work list.
How we work
From the client systems to a 90-day plan
We start from business context and critical systems. Then we collect a scan, CIS, IAM, the edge, copies, and logs. We leave a backlog and a verification rhythm. We stay for change windows, a rescan, and a trend dashboard.
- Scope We check systems, data, regulation, RTO, and who signs an exception. That gives the collection plan.
- Collection We collect a scan, CIS, IAM, the edge, copies, and logs. Findings go to one backlog.
- Report We write risk, cost, order, and evidence for the auditor. Engineering gets a list from the same items.
- Closure We run change windows, a rescan, and a trend dashboard. The next audit starts from what was closed.
Talk
We will discuss the audit scope and the remediation plan
On that basis we will prepare a scope: review, backlog, and verification.
Contact us