Solutions
Audit evidence from everyday operations
Docusnap365 inventories your IT infrastructure automatically. When the auditor asks, the evidence is already there.
Over 5,000 organizations document their IT with Docusnap
The problem
What makes audit preparation expensive
Audits come with a fixed date. It still gets stressful when evidence has to be pulled together at the last minute.
Evidence is scattered
Policies in Word, measure lists in Excel, receipts in emails. Before the audit, the search begins across file shares and mailboxes.
Mapping is missing
Which measure covers which control, which asset is affected? Without end-to-end traceability, that question has to be answered manually every time.
Ownership is unclear
Who reviews which control by when? If those questions only come up at the audit date, there is no time left for solid answers.
Gaps surface late
Missing evidence becomes visible when someone asks for it. Not when there is still time to act.
The approach
Continuous evidence instead of audit sprints
Structured audit preparation for standards and legal requirements such as ISO 27001, NIS2 or the GDPR follows a clear process: capture your inventory, assess controls, track measures, provide evidence. Docusnap365 maps each of these steps as a continuous process, so the evidence builds up during daily operations rather than as a last-minute project before the next audit.
Step 1
Capture IT inventory automatically
The Docusnap Enterprise Gateway inventories your IT infrastructure agentlessly and transfers the results to the cloud CMDB. Hardware, software, identities and configurations form the data foundation for every subsequent step.
Step 2
Assign and assess controls
Using the audit and compliance module, you assign controls from pre-loaded frameworks to inventoried assets. Applicability and exceptions are documented with reasoning and stored traceably.
Step 3
Derive and track measures
Every gap produces a measure with an owner, a status and a deadline. The task center tracks execution. Recurring reviews can be set up as scheduled tasks.
Step 4
Provide evidence
Completed measures become the compliance evidence. SmartDocs produces controlled documents with a defined approval process and a signed PDF export. The permissions analysis adds the overview of access rights.
Feature details for the audit and compliance module
Frameworks
Which standards and frameworks you use in Docusnap365
Two standards are included. We developed three frameworks ourselves from the legal texts, so you don’t have to work through them.
Standard or law | Type | What Docusnap provides |
|---|---|---|
ISO 27001 | Standard (ISO) | Risk register linked to the CMDB, measure tracking, permissions analysis, document control through SmartDocs |
BSI cloud catalog (C5) | Catalog (BSI) | Assess cloud security criteria and link them to measures, documents and assets; see completeness and gaps at a glance |
NIS2 Germany (BSIG) | Docusnap framework | Requirements from the German implementing act, each individually assessable, plus vulnerability management with CVE matching, remediation deadlines, responsibilities and documented triage |
NIS2 Austria (NISG) | Docusnap framework | Requirements from the Austrian Network and Information Systems Security Act, each individually assessable, plus the same vulnerability management with CVE matching and documented triage |
GDPR | Docusnap framework | Verifiable requirements, status assessment per requirement, gap overview, links to measures |
Linked controls show where one measure serves several standards, and structured evidence tracking reduces the personal liability risks NIS2 creates for managing directors. The frameworks are not official versions. Docusnap does not certify or advise.
Frequently asked questions about audits and certifications
What does an ISO 27001 audit examine?
An ISO 27001 audit examines whether information security is managed systematically. That includes risk management, access controls, asset management, vulnerability handling and document control, among other areas. In Docusnap365, these areas are covered by multiple modules working on the same CMDB: ISMS, audit and compliance, vulnerability management, permissions analysis and SmartDocs.
Which laws and standards are preloaded in Docusnap?
Docusnap365 includes the ISO 27001 standard and the BSI cloud catalog C5. For NIS2 and GDPR, Docusnap adds compliance frameworks it developed from the current legal texts. The NIS2 frameworks are based on the German BSIG and the Austrian NISG. All three translate the obligations into concrete, verifiable requirements you can use to track your implementation status.
Does Docusnap365 replace an external auditor?
No. Docusnap365 provides the data, structures and evidence needed for audits and certifications. The platform does not certify and does not conduct audits. The assessment of measures and the decision on their adequacy rests with the responsible people in the organization and the appointed certification body.
How does Docusnap365 support NIS2 implementation?
Docusnap365 maps the vulnerability handling process required by NIS2 as a continuous workflow: automated CVE matching against the inventoried estate, triage with documented remediation deadlines and ownership, traceable decisions including the deliberate acceptance of a vulnerability. The permissions analysis adds the overview of access rights. More on this topic under Reduce security risks.
Are the frameworks official standards?
No, not all of them. ISO 27001 and the BSI cloud catalog are the standards and catalogs of their publishers. The frameworks for NIS2 and GDPR are working tools from Docusnap, not official versions and not legal advice. They spare you from working through the legal texts yourself. Assessing the measures remains with you and with the certification body.
Ready for the next audit?
The next audit is coming. The question is whether the evidence will already be in place or still needs to be gathered.
No commitment, 30 minutes, oriented around your environment