Answer the questionnaire and the auditor's sample from the records the work already leaves.

The same questions come back every time: who had access, was it reviewed, does a restore work, who approved the change. Opafra writes the record while the work happens, so each answer is a lookup and not a search through tickets and chat.

The questionnaire

Answers keyed by question ID, including the rows where the answer is no.

The answer pack lists the questions by ID, paraphrased, with what the record gives for each. Where Opafra does not help, because the answer is a policy or a system it does not see, the row says so.

Evidence per point

Four records, one for each point the regulation asks for.

Each record answers a point of Regulation (EU) 2024/2690. See all four on the evidence page.

Supplier access, point 6.7.2(h): Who asked, who approved, the window and how it ended. Supplier access.
Access review, point 11.3.3: Who reviewed, when, and what changed. Privileged access.
Restore test, point 4.2.6: The result and the time to restore. Backup and recovery.
Change, point 6.4.2: The chain from request to outcome, approved for the exact revision. Change control.

ISO 27001 surveillance audits

Your next surveillance audit's samples, ready from the work itself.

An ISO 27001 certificate is audited again every year, and the auditor samples what happened since the last visit. Access reviews and changes are among the records asked for. For what runs through Opafra, the sample is a lookup. Opafra is not a certification and does not replace your management system.

Fig. 1, change record for run #4f2a, revision 7

Change record /Patch nginx across prod, run #4f2a

Sample

@alex → AIDry-run passedApproved by @danaAudited · #4f2a

Origin: Drafted by the AI composer for @alex
Targets: web-01, web-02, web-03 in prod
Dry run: 3 hosts, 12 changes, 0 destructive
Approved: Dana Okafor at 14:32:07, for revision 7 only
Outcome: Completed on 3 hosts, 4 steps

Diffweb-02

/etc/nginx/nginx.conf+3/−2

 --- a/etc/nginx/nginx.conf
 +++ b/etc/nginx/nginx.conf
 @@ -1,7 +1,7 @@
  user  www-data;
−worker_processes  4;
+worker_processes  auto;
  pid /run/nginx.pid;
 @@ -31,6 +31,7 @@
      ssl_prefer_server_ciphers on;
−    ssl_protocols TLSv1.2;
+    ssl_protocols TLSv1.3;
+    ssl_session_tickets off;

What this is and is not

Evidence for a point, not a verdict.

The records are evidence for the points they answer. They do not say that an organization meets them, and whether the Regulation applies to you is a question for your own advisers. Opafra records what goes through Opafra, so work done on a server by another route is not in them.

See the records for your own servers.

Tell us which questionnaires and audits you answer. You get a demo and your price in writing within one business day, with no call.

Get a demo