Skip to main content

Responding to a Security Audit

The Context​

Olivier is the CIO at HealthData, a company that processes health data. An external auditor comes to verify compliance with ISO 27001 and GDPR. He asks to prove: who has access to what, how access is controlled, how departures are managed, and whether passwords comply with best practices.

The Problem Without VaultysHub​

  • Access rights are scattered across each application
  • No centralized tool to produce a complete inventory
  • Impossible to prove that former employees' access has been revoked
  • The password policy is theoretical — no means to verify its application
  • The audit takes weeks of manual information collection
  • No structured report to provide: everything must be compiled by hand
  • No centralized log of security events

With VaultysHub​

Step 1 — Inventory of Access (Immediate)​

Olivier opens the VaultysHub dashboard. The auditor can see:

  • The complete list of users and their status
  • The referenced applications and security folders
  • Who has access to what, organized by folder and by team

Step 2 — Security Policies (Verifiable)​

Olivier presents the configured access policies:

  • The Device Access Policies define access conditions by application
  • Anti-phishing is globally activated
  • VaultysID security levels are enforced for sensitive applications

Step 3 — Real-Time Logging (Provable)​

Olivier opens the Logging (Audit Trail) — the centralized log of all security events. The auditor can:

  • Filter by event type: successful/failed logins, saved passwords, Shadow IT detections, Bastion approvals…
  • Search for a specific user, application, or device
  • Click on a user or application to filter contextually without leaving the page
  • View the log from the user's profile, the application's sheet, or the folder's page

The auditor asks, "Show me all connections of Marc Dupont this month." Olivier clicks on Marc's profile, logging tab: the complete history is displayed instantly.

Step 4 — Compliance Reports (One Click)​

Olivier directly generates the reports requested by the auditor from the Reports menu:

  • Monthly CISO Report — access management, credential hygiene, security incidents, Shadow IT detections, access governance
  • Monthly CTO Report — platform adoption, application portfolio, access groups, license usage
  • ISO 27001 A.9 Report — provisioning/de-provisioning, authentication policies, password hygiene, compliance of access rights

Each report is printable with graphs and downloadable in PDF. The auditor leaves with deliverables ready to be attached to the audit file.

tip

For additional frameworks (NIST CSF, SOC 2, GDPR, NIS2, DORA…), VaultysHub offers integration with CISO Assistant from Intuitem, accessible from the Reports section.

Step 5 — Password Management (Demonstrable)​

Olivier shows that:

  • Passwords are stored in an encrypted vault
  • Users do not know the passwords for critical applications
  • Authentication is done via VaultysID (without a password) or SSO

What It Changes​

Without VaultysHubWith VaultysHub
Weeks of information collectionData available immediately
Difficult to provide evidenceComplete and exportable history
Theoretical policiesApplied and verifiable policies
Stressful and costly auditSmooth and documented audit
No centralized logReal-time logging filterable by user, application, or folder
Reports compiled by handCISO, CTO, and ISO 27001 reports generated in one click

Features Used​

  • Dashboard — Overview of users, applications, and security
  • Logging — Real-time log of all security events
  • Reports — Printable CISO, CTO, and ISO 27001 reports
  • Access Policies — Verifiable access rules
  • Anti-phishing — Protection against phishing
  • SCIM — User provisioning and traceability