Read-only by default
The assessment reads and analyses. It does not change roles, delete resources or revoke access.
Security
Built to understand access.
With control over the analysis.
An access map is sensitive. Every Corinio assessment starts with clear boundaries for permissions, execution, data handling and responsibility.
Scoped collection
Agree on sources, scopes and read permissions before starting. Only metadata needed for the agreed analysis is included.
Customer-controlled execution
Container-based execution in the customer environment is the delivery direction. The specific installation and acceptance checks are established in the pilot.
Visible limitations
Missing data and unknown coverage must remain visible. Correlation uses stable identifiers where sources make this possible.
An agreed data lifecycle
Retention, output access and deletion form part of the assessment agreement. Specific periods are agreed terms.
Human decisions
Recommendations inform your own workflows. Changes need to be assessed and carried out by the appropriate people.
What gets analysed?
An assessment works with identity, permission and resource metadata. Examples include object IDs, names, group memberships, roles, scopes and grants. This can include personal data and is handled as sensitive operational information.
| Purpose | Analysis of existing access and related control needs |
|---|---|
| Data | Agreed identity, permission and resource metadata |
| Access | Scoped read permissions as required by each source |
| Location | Agreed for each installation and assessment |
| Retention | Established before execution, including output and deletion |
| Changes | Handled through the customer’s approved processes |
A stronger foundation for control.
Corinio can support documentation of access controls and least privilege. Legal compliance, certification and the full organisational control environment need separate evaluation. A dashboard is not a compliance guarantee.
Good evidence starts with clear boundaries04 · Evidence for the auditor
Articles mapped to what your data can prove
NIS2, DORA, ISO 27001, GDPR and SOC 2 are broken down into what can be measured in access data. Each article points to the controls behind it, and a control without data is shown as missing instead of passed.
Article · what backs it
NIS2 · Art. 21(2)(j)
Multi-factor or continuous authentication, especially for privileged accounts.
Privileged accounts hold MFA evidenceGap
Conditional Access baseline existsMet
Phishing-resistant methods registeredNot in this run
There is no overall percentage. It would force the areas we have not seen to count as something.
Know your access.
Move forward with clarity.
Let’s start with your platforms and the questions you need answered.