Self-assessment

Provability check: what can your system prove when it matters?

Ten questions taken from real audits, security questionnaires and incident reviews. You need no documents, only an honest assessment. The result appears right here.

The questions are deliberately binary. A “probably yes” counts as no in an audit because the evidence is missing — so the same strictness applies here.

For each question you can expand what requirement sits behind it and what is usually there instead.

Nothing is stored or transmitted. The result is computed in your browser and gone when you close the page.

0 of 10 questions answered

  1. 01For any given record, can you show without gaps who changed it, when, and why?

    Not the current state — the full chain of changes including what triggered them.

    Why this question

    The accountability principle in GDPR Art. 5(2) requires you to demonstrate what happened to personal data, not merely that you have a policy for it. For data subject requests or supervisory follow-ups the current state is not enough. Most systems cannot do this: they show the present state and some events, but not the closed chain including the trigger.

  2. 02Is that history technically immutable — including for administrators and the application itself?

    A log in the same database, writable by the application, counts as no here.

    Why this question

    “We have logging” is not the same as “the log cannot be tampered with”. If the audit log sits in the same database as business data and the application can write to it, it is weak as evidence. If you serve financial customers, DORA and its technical standards address this explicitly: logs must be protected against manipulation.

  3. 03Can you reconstruct the state of a case on an arbitrary past date?

    The classic auditor question: “what did this case look like on 14 March?”

    Why this question

    This is where most standard answers break. A SIEM shows you events — it does not automatically reconstruct the full state of a business object on a given day. NIS2 implementation requires the ability to reconstruct incidents, and without point-in-time state every reconstruction is manual work.

  4. 04Is tenant separation enforced technically rather than by filter conditions in application code?

    If one forgotten filter could expose another tenant's data, the answer is no.

    Why this question

    A forgotten `WHERE tenant_id = …` is the classic cross-tenant leak. Auditors and enterprise buyers increasingly ask for technical isolation — row-level security at the database, separate schemas, policy enforcement outside the application — rather than code discipline. Through the NIS2 supply chain requirements this becomes your customers' concern too, not only yours.

  5. 05Can you prove who held which permission six months ago, and who granted it?

    Not today's permission model — the one back then.

    Why this question

    Access control under GDPR Art. 32 is rarely audited as a concept; it is audited as history. Who was allowed to do what back then, and who granted it? Most systems only know the current permission state. In internal investigations and liability questions that exact gap gets expensive.

  6. 06Do you control identity and access management enough to change it without a vendor migration project?

    Sovereignty over identity: your realms, your audit events, no black box.

    Why this question

    If you can only meet a customer requirement through a migration project, the vendor is part of your risk. For regulated customers — especially in finance under DORA — black-box IAM increasingly becomes a disqualifier in supplier assessments.

  7. 07After an incident, could you state within 24 hours which tenants and records are affected?

    The reporting clock starts at awareness, not at the end of your analysis.

    Why this question

    This is the sharpest operational requirement in the whole check. NIS2 requires an early warning within 24 hours of awareness and full notification within 72; the GDPR deadline under Art. 33 is 72 hours from awareness. A documented incident response process only helps if the technical basis for fast scoping exists — otherwise it is a fire plan without hydrants.

  8. 08For every production change, is it traceable what triggered it and who approved it?

    Especially relevant with machine-generated code: provenance rather than author name.

    Why this question

    Traceable change management is anchored in NIS2 and DORA. What is new is the shift in the question: with AI-assisted code, the author name in a commit says little. Provability comes from provenance — which trigger, which context, which approval.

  9. 09Are automated or AI-assisted decisions recorded together with data state and model version?

    Only relevant if you decide automatically — otherwise skip with “unclear”.

    Why this question

    For high-risk systems, Art. 12 of the AI Act requires automatic recording of relevant events across the lifecycle. Independently, GDPR Art. 22 applies to decisions with legal effect. Teams retrofitting AI features usually do not record the data state at decision time or the model version — and therefore cannot explain the decision later.

  10. 10Can the business side answer these questions without developer help?

    If every request becomes a ticket, provability is organisational, not technical.

    Why this question

    The organisational litmus test. If logs are only accessible to security or ops and every evidence request becomes an engineering ticket, provability is not retrievable when it matters — however good the technology is in theory. Enterprise buyers and auditors notice this within a few follow-up questions.

Your result

No open points yet — answer the questions to see your result.

This check replaces neither an audit nor legal advice. It reflects the questions we keep meeting in projects and audits. Which regulation applies to you specifically depends on your sector, size and role in the supply chain.

Answers that look good in a questionnaire

Four phrases appear in almost every security questionnaire. They are not wrong, and they are not meant to deceive. They quickly signal that the topic has been handled, and they lift the conversation to a procedural level where technical detail is not immediately required.

Against surface-level questions this works. It breaks on the targeted follow-up: “show me the state of this record on 14 March — and who held which permissions then.” That is exactly what this check asks about.

  • “We are ISO 27001 certified.”

    ISO/IEC 27001 is the standard for an information security management system. It requires risks to be assessed systematically, controls to be defined and documented, and the whole thing to be audited regularly.

    Covers
    Documented policies for logging, access control and incident handling. Risk assessments, control catalogues, internal and external audits of the management system.
    Does not provide
    Any statement about how good the technical evidence in a specific system is. A certified company can still have mutable application logs, no point-in-time reconstruction, and need days to scope an incident. What is audited is the management system, not the ability to prove immutably what a record looked like on 14 March.

    Leaves open: Questions 1, 2, 3, 7

  • “We have audit logs and a SIEM.”

    Audit logs record who did what and when. A SIEM collects logs from many sources, correlates them and raises alerts — it supports detection and investigation of incidents.

    Covers
    Events are recorded. There is one central, searchable place. In many cases you can establish that something happened.
    Does not provide
    Immutability — most application audit logs sit in the same database as business data and are writable by admins and the application. Completeness of the chain including triggers. The point-in-time state of a business object, because a SIEM shows events, not states. The permission state from six months ago. And accessibility for the business side.

    Leaves open: Questions 1, 2, 3, 5, 10

  • “Tenant isolation is implemented.”

    Tenant isolation means one customer's data and actions are strictly separated from another's — in multi-tenant SaaS the central security promise.

    Covers
    Some form of separation exists, and the clear intention that tenants do not reach into each other.
    Does not provide
    The decisive distinction: enforced technically, or only through filter conditions in application code. If separation runs on `WHERE tenant_id = …`, one forgotten filter or one bug is enough. Real isolation — separate databases, row-level security at the database, policy enforcement outside the application — is rarer and more expensive. The word “implemented” hides exactly the how.

    Leaves open: Question 4

  • “We have an incident response process.”

    A documented flow for security and operational incidents: detection, containment, analysis, remediation, review — usually aligned with NIST or ISO/IEC 27035.

    Covers
    Roles, escalation paths, playbooks, communication plans. This satisfies the procedural side of NIS2 and DORA: procedures must exist.
    Does not provide
    The ability to scope quickly and provably. The process says analysis will happen. It does not guarantee you can name within 24 hours which tenants and records are affected. Without immutable history, fast queryability and permission history, analysis takes days — and the reporting clock runs regardless.

    Leaves open: Questions 1, 5, 7

The reasoning behind these answers is understandable: you have the organisational building blocks that checklists ask for. The check instead asks about technical and organisational provability when it matters. Being able to say “yes, provable” early — and show it — is an advantage with customers in regulated sectors that cannot be argued away.

Questions about the check

Are my answers stored?
No. Everything runs in your browser. No answers are transmitted, stored or analysed.
How reliable is the result?
It is a self-assessment, not an audit. The value lies in walking through the right questions once — most gaps end up named instead of vague.
What if I answer “unclear” several times?
That is a finding in itself. In an audit, “unclear” means the evidence is not available when asked — which is why we count it as an open point.
Isn't ISO 27001 certification enough?
It evidences a working information security management system — policies, risk assessment, audit cycle. It says nothing about whether your system can immutably reconstruct the state of a record on a given day. Both are useful, but they answer different questions.
Does this apply to us if we are not directly regulated?
Usually yes, but indirectly. As soon as a customer falls under NIS2, DORA or the AI Act, they pass the requirements on to you through security questionnaires, data processing agreements and supplier assessments. The trigger is then not an auditor but a deal.

Want to talk the result through?

Describe your situation in a few sentences. You get an assessment of whether and where a cut pays off — and when it does not.