What one fix leaves behind.
Every closed finding leaves a signed record: the plan, the approval, the credential, the change, the check and the way back. Your auditor can verify it from an export, without a NEBU account.
Book a callRead the record one proof at a time.
It belongs to the finding followed on the Critical Finding Remediation page: admin rights a production role never used.
-
01 Evidence
It says what happened, and why.
The finding, the reasoning that chose this fix and the check that confirmed it, written at the time, not reconstructed later.
-
02 Plan before execute
The plan came before the change.
The approver signed off on plan version 2 after a fresh MFA check through your identity provider. If the plan had changed afterwards, the approval would no longer apply.
-
03 Least-privilege execution
One step, one credential.
The change ran on a credential scoped to this role alone. It expired four minutes later, when the step was done.
-
04 Tamper-evident audit trail
Signed, and chained to the record before it.
Each record carries a signature and the fingerprint of the one before. Alter any record and the chain no longer verifies.
-
05 Reversible by design
The way back was ready before the approval.
Restoring the previous policy was staged before anyone was asked to decide. It wasn’t needed, and the record says so.
Check any record yourself.
An exported record carries what is needed to verify it. Your auditor can check the signatures and the chain outside NEBU, without an account, and a single altered entry shows.
Where the record goes.
Every record reaches your SIEM as it is written. For audits, evidence packs follow the frameworks you report on, from SOC 2 and ISO 27001 to DORA and NIS2, ready for your compliance platform.
What does the auditor actually receive?
The record itself, not a report about it.
For each control: the findings that touched it, the actions taken, the approver and the plan they approved, and proof that none of it changed afterwards. Questions get answered from the record instead of from memory.
Questions
How long are records kept?
For as long as your retention policy says. You set the period.
Do fixes cleared by policy leave a record too?
Yes, the same record, with the policy that cleared it where an approver’s name would be.
See the record your own fix would leave.
On a call, we walk a finding from your environment through the loop and test your auditor’s questions against its record.