Compliance
Show who could open what, and why. Whenever you’re asked.
Doclave turns the access you already manage in Dynamics 365 into evidence. Every access change is recorded and traced to the role behind it, and regular checks show where you stand, and what to fix first. Your team works as today.
Illustrative view of the Doclave compliance assessment
Every access change traced to its role
Access history protected against edits
Your documents never leave your tenant
No obligation. We go through the findings with you and your IT lead.
Included in every Doclave plan
The same engine that keeps SharePoint access in line with Dynamics 365 also builds your evidence. This page covers that part.
Dynamics 365
Roles, teams, records
Doclave
● This page: compliance reporting
Record
Every access change, traced to its role
Assessment
Checked against 7 frameworks
SharePoint
Documents and Copilot
01 — The question
Management signs off on it. Management answers for it.
NIS2 makes cybersecurity a management responsibility. The board approves the measures and can be held accountable. Yet roles live in Dynamics 365 and documents in SharePoint, so when the auditor asks, the proof is assembled by hand.
NIS2 Directive (EU) 2022/2555, Art. 20 and Art. 21(2)(i)
The auditor asks
Today
Do former employees still have access?
Checked by hand, if at all.
Who changed teams, and did their access follow?
Two systems, no shared record.
When did the consultant’s access end?
In Dynamics 365, yes. In SharePoint, unknown.
What did access look like on a given date?
Rebuilt after the fact.
Evidence rebuilt for every audit is a claim, not a record.
Role change
Sales → Service
SharePoint access updated
Ref 7f3a…c21
✓ Recorded
02 — How it works
Access follows the role. Every change is recorded.
Doclave builds the evidence while your team works. There’s nothing to collect before the audit.
The model in practice
Each role sees its own documents. So does Copilot.
Access in SharePoint follows the role in Dynamics 365. Copilot works inside the same access. Every change is recorded.
Role in Dynamics 365
Access in SharePoint
What Copilot can reach
Evidence
Sales
Role and team
Quotes and contracts
Open to the Sales role only
Sales content
Nothing outside the role
✓ Recorded
Service
Role and team
Cases and customer files
Open to the Service role only
Service content
Nothing outside the role
✓ Recorded
HR
Role and team
Employee files
Open to the HR role only
HR content
Nothing outside the role
✓ Recorded
03 — The assessment
One assessment. Every framework you report on.
Doclave checks your environment once and maps each result to the frameworks you report on, so one piece of evidence answers several requirements. Findings are ranked by severity, and you can refresh the assessment whenever you need a current view.
Requirement
What Doclave records or checks
What you can show
Access control
NIS2 Art. 21(2)(i) · ISO 27001 A.5.15, A.5.18
Access follows the role in Dynamics 365. Every change is recorded.
Who could access what, and why
Information access restriction
ISO 27001 A.8.3 · GDPR Art. 25
Access granted per role and record, not per folder.
Access limited to business need
Effectiveness and security of processing
NIS2 Art. 21(2)(f) · GDPR Art. 5(1)(f), 32
Regular checks with findings ranked by severity.
Measures assessed, gaps tracked
Checks in the assessment are mapped to
EU law
NIS2
EU cybersecurity law for essential and important entities. Management is accountable.
EU law
GDPR
EU rules for protecting personal data, including who can access it.
EU law
DORA
Digital resilience rules for EU financial entities and their ICT providers.
Standard
ISO 27001
The international standard for running an information security management system.
Standard
SOC 2
An independent audit report on a service provider’s security controls.
Technical baseline
CIS
Consensus-based benchmarks for configuring systems securely.
Technical baseline
Microsoft Security Baseline
Microsoft’s recommended security settings for its own products.
Doclave supports alignment. It doesn’t replace your legal, security or compliance obligations.
Request a readiness assessment
No obligation. We go through the findings with you and your IT lead.
04 — Easy to review
Your auditor will review us too. We made that easy.
Under NIS2, your suppliers are part of your risk. Here’s what Doclave holds, and what it doesn’t.
Documents
Your documents stay in your tenant.
Doclave manages access. Your documents never leave Microsoft 365.
Visibility
Sensitive details hidden by default.
Only users with the right role can reveal sensitive data in the assessment.
Logs
Reference IDs, not names.
Logs hold reference IDs, never names or email addresses.
Hosting
Run from the EU.
Hosted in EU data centres and backed up on a 3-2-1 model.
See your own environment.
Let us run a readiness assessment on your own environment and go through the findings with you. Prefer to see it first? Book a walkthrough.
No obligation. We go through the findings with you and your IT lead.
