Product · CloudNerve
NerveEvidence Compliance
Signed NIS2, ISO 27001, SOC 2 and DORA evidence from your own AWS accounts.
A scheduled collector that reads your AWS configuration across every account and region, maps it to the controls of four frameworks, and writes a signed evidence bundle your auditor can verify offline.
Who it's for
Mid-market companies in the EU preparing for a NIS2, ISO/IEC 27001, SOC 2 or DORA audit with workloads on AWS, and the MSPs and consultancies that prepare them.
When teams call us
A first NIS2 supervisory request, an ISO 27001 or SOC 2 audit on the calendar, or weeks lost to evidence screenshots every audit cycle.
What it does
Inside NerveEvidence Compliance
Four frameworks, one run
NIS2 with the Finnish Cybersecurity Act 124/2025, ISO/IEC 27001:2022 Annex A, SOC 2 and the DORA ICT risk articles.
Your whole organization
Every account and region in AWS Organizations, read-only.
Signed bundles
A manifest of every file, signed with your AWS KMS key and stored under S3 Object Lock.
Offline verifier
Auditors check every file without access to your AWS account.
Honest control states
Passing, Failing, Partial, Manual, Not applicable, Not evaluated. A control without an automated check never shows as Passing.
Manual controls covered
Policy templates, and a place to upload your own attestations per control.
What you receive
On every run
- An offline HTML report with a summary per framework and a status, reason and evidence links per control
- Control tables in CSV and Excel
- The raw evidence per control, account and region
- Policy templates for the manual controls that apply
- A draft inventory for the DORA Register of Information (CSV)
- A signed manifest and a standalone verifier
How it works
Step by step
- 01
Deploy
One CloudFormation stack in your security or audit account, and a read-only role in member accounts through a StackSet.
- 02
Collect
A scheduled AWS CodeBuild job reads configuration, AWS Security Hub, AWS Config and AWS CloudTrail data across accounts and regions.
- 03
Map and sign
Results are mapped to controls; the bundle is written to Amazon S3 with Object Lock and signed with AWS KMS.
- 04
Share
Hand the bundle to your auditor, who runs the verifier and reads the report offline.
Built on AWS
The AWS services it uses
- AWS CloudFormation
- AWS CodeBuild
- Amazon EventBridge Scheduler
- Amazon S3 Object Lock
- AWS KMS
- AWS Organizations
- AWS Security Hub
- AWS Config
- AWS CloudTrail
- Amazon CloudWatch
Your data
Runs in your account with read-only permissions. Nothing is sent to CloudNerve. Bundles are encrypted with a key in your account and kept for the retention you choose.
Scope, stated plainly
What it does not do
- Give an audit opinion or a certification
- Give legal advice on NIS2 or DORA scope
- Change anything in your AWS accounts
- Check controls outside AWS, such as HR or physical security, beyond templates and the attestations you upload
- Produce a complete DORA Register of Information (it drafts the inventory)
Questions
Common questions
- Does it make us compliant?
- No tool can. It gives you current, verifiable evidence for the AWS part of your controls and shows which controls still need manual evidence.
- What does our auditor need?
- The bundle folder. The included verifier checks each file's hash and the signature against your KMS key's fingerprint, with no AWS access.
- How long does a run take?
- A single-account, single-region run took about four minutes in our test. Larger organizations take longer; runs are scheduled, so nobody waits for them.
See NerveEvidence Compliance on your own AWS data.
Book a free Intro Call with a CloudNerve architect, or ask us anything about how it would fit your accounts.