Skip to content
    Opafra
    English
    Get a demo

    The evidence your clients ask for, produced by the work itself.

    When a client sends a questionnaire or an auditor samples your servers, the same four records are asked for: who had access, the review of it, a restore that worked, and what changed. Opafra writes each one while the work happens. Each answers a point of Regulation (EU) 2024/2690. See the full NIS2 page for every point of it.

    1. Access

      Who reached the server, on whose approval, and for how long

      Each grant starts as a request with a reason, is approved by a named person, and ends on its own at the time it was set for. On a server set up for certificates, each connection uses one that lasts five minutes.

      Fig. 1, access record for grant #a91c on prod

      Access record /grant #a91c on prod

      Sample
      Requested
      Alex Moreau @alex at 13:58:12, for patch nginx across prod
      Approved
      Dana Okafor @dana at 14:02:40
      Window
      14:05:00 to 16:05:00, 2h
      Ended
      Expired on its own
      Connections made under grant #a91c
      TimeServerThroughCertificate
      14:32:11web-01run #4f2a5 min
      14:32:11web-02run #4f2a5 min
      14:32:12web-03run #4f2a5 min

      The requirement it answersRegulation (EU) 2024/2690, point 6.7.2(h)

      “allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation”

      Point 11.2.2(d) adds that third-party access is limited “in scope and in duration”. The record shows the request, the approver, the window and how it ended.

    2. Access review

      The review of that access, signed off

      At the interval you set, the reviewer goes through everyone with access to an environment, keeps or removes each person, and signs, so the review is a document and not a recollection.

      Fig. 2, access review of prod for the quarter, signed off
      Access review of prodSample
      1 July to 30 September 2026, reviewed by Ada Lovelace
      The reviewer’s decision for each person with access to prod
      PersonAccessDecision
      Ada LovelaceOwnerOwner roleKept
      Bo ChenAdminNo grant on prodKept, no access
      Alex MoreauOperatorGrants, 2 hours at a timeKept
      Dana OkaforOperatorStanding grant, approverKept
      Eli NovakViewerView on stagingRemoved, left the team
      Signed off

      Ada Lovelace, Owner, 2026-10-05 10:14. 1 change made.

      The requirement it answersRegulation (EU) 2024/2690, point 11.3.3

      “review access rights of privileged accounts and system administration accounts at planned intervals ... and shall document the results of the review”

      The review covers access that goes through Opafra. Accounts that exist on the servers themselves are reviewed where they live.

    3. Restore test

      A restore that worked, with the time it took

      The time from the first step to the passing smoke test is the figure a client or an auditor asks for. A scheduled plan restores onto a scratch host and records it each time it runs.

      Fig. 3, restore test #7c3e of db-01, passed

      Restore test /db-01 to restore-01

      Sample
      Backup
      2026-10-11 02:00
      Started
      2026-10-11 03:00:04
      Result
      Passed
      Time to restore
      4m 10s
      1. 1Pick the latest backup of db-012s
      2. 2Restore onto restore-013m 41s
      3. 3Start the database18s
      4. 4Smoke test: table and row counts match9s
      5. 5Remove the scratch copy6s

      The requirement it answersRegulation (EU) 2024/2690, point 4.2.6

      “carry out regular testing of the recovery of backup copies ... shall document the results of the tests”

      The record proves a restore. It does not show that backups are made, or how recent they are.

    4. Change

      What changed, approved for the exact revision

      A change is a plan. It is drafted by a person or the AI composer, previewed on each host, approved for one revision, and run. Edit the plan after the approval and the approval is void.

      Fig. 4, change record for run #4f2a, revision 7

      Change record /Patch nginx across prod, run #4f2a

      Sample

      @alex → AIDry-run passedApproved by @danaAudited · #4f2a

      Origin
      Drafted by the AI composer for @alex
      Targets
      web-01, web-02, web-03 in prod
      Dry run
      3 hosts, 12 changes, 0 destructive
      Approved
      Dana Okafor at 14:32:07, for revision 7 only
      Outcome
      Completed on 3 hosts, 4 steps

      Diffweb-02

      /etc/nginx/nginx.conf+3/−2
      --- a/etc/nginx/nginx.conf
      +++ b/etc/nginx/nginx.conf
      @@ -1,7 +1,7 @@
       user  www-data;
      −worker_processes  4;
      +worker_processes  auto;
       pid /run/nginx.pid;
      @@ -31,6 +31,7 @@
           ssl_prefer_server_ciphers on;
      −    ssl_protocols TLSv1.2;
      +    ssl_protocols TLSv1.3;
      +    ssl_session_tickets off;

      The requirement it answersRegulation (EU) 2024/2690, point 6.4.2

      “documented and ... tested and assessed in view of the potential impact before being implemented”

      The point asks for documented, tested and assessed changes. The approval, bound to the revision that runs, is what Opafra adds on top.

    Questionnaires

    The same records answer the questionnaire. Including where the answer is no.

    The answer pack lists the questions by ID, paraphrased, with what the record gives and the rows where Opafra does not help.

    What this is and is not

    Evidence for a point, not a verdict.

    The records are evidence for the points quoted above. They do not say that an organization meets them, and Opafra is not a certification. The Regulation applies to, among others, managed service providers, cloud computing service providers and data center service providers (Article 1). Whether it applies to you is a question for your own advisers.

    Opafra records what goes through it: plans, runs, grants and the sign-in to Opafra itself. Work done on a server outside Opafra is not in these records.

    See the records for your own servers.

    Tell us what you run. You get a demo and your price in writing within one business day, with no call.

    Get a demo