Article 20
Article 21
Export
Doclave
Exportable Audit Trail Evidence
Doclave’s audit trail captures all user activities, document access, permission changes, and incidents. With a single click, generate a full, verifiable audit package for regulators — no manual aggregation required. Export to PDF or CSV for compliance submissions.
Audit Findings
What Auditors Find.
These are the four permission failures that appear in every NIS2 compliance audit of a Dynamics 365 and SharePoint Online environment. Each one is preventable. None are detected by native Microsoft tooling.
01
Former Employee
Terminated user retains SharePoint access
A sales manager left the company 47 days ago. Their D365 account was deactivated on day 1. Their SharePoint access to 3 deal rooms and 2 contract libraries was never revoked. All files remain accessible via their personal Microsoft account.
Business Impact
Confidential customer contracts and pricing models accessible outside the organisation.
NIS2 Art. 21 — Access Control Failure
02
Cross-Team Exposure
Wrong business unit reads competitor deal data
A D365 Business Unit restructure moved 12 users from the Nordic team to the DACH team. SharePoint library permissions were not updated. Nordic deal data — including M&A targets and key account pricing — remains visible to DACH team members with no business need.
Business Impact
Internal data segregation failure. Cross-team information asymmetry creates legal and competitive risk.
NIS2 Art. 21 — Least Privilege Violation
03
Expired Contractor
Consultant access persists 6 months post-engagement
An external consultant completed an 8-week ERP integration project. D365 access was time-limited and expired automatically. SharePoint access to the project workspace — containing integration specs, API credentials documentation, and org charts — was never removed. The consultant's credentials remain valid.
Business Impact
External party retains read access to internal architecture documentation and sensitive org data.
NIS2 Art. 21 — Third-Party Access Risk
04
No Audit Trail
Zero cross-system evidence for the auditor
When the NIS2 auditor requests evidence of access control enforcement over the past 12 months, the organisation can produce D365 role change logs. It cannot produce any record of whether those changes were reflected in SharePoint. There is no cross-system audit trail. The gap is undocumentable.
Business Impact
Inability to demonstrate compliance. Regulatory exposure regardless of actual security posture.
NIS2 Art. 21 — Evidence & Audit Trail
Doclave eliminates all four findings — before the auditor arrives.
Real-time sync. Exportable evidence package. Zero manual remediation.
Request Environment Scan