Governance and evidence
Compliance and segregation of duties in Nova IAM
Nova IAM is an enterprise IGA platform for your entire IT landscape. It checks segregation of duties and critical actions across all target systems, including SAP, Active Directory and Entra ID, and records who decided what.
- Across all target systemsRisks across SAP roles, AD and Entra ID groups, business roles and other entitlements.
- Before approvalNew risks from your rule set appear in the request, depending on the policy, before anyone decides.
- 19 checks per identityIn the healthcheck, 11 of them with a suggested fix.
Risk engine
SoD and critical actions across all target systems
Segregation of duties (SoD) is meant to stop an identity from combining access that must stay separate, such as creating vendors and releasing payments. Critical actions are access that is a risk on its own. Nova checks both against the same rule set.
How the risk rule set is structured
| Element | Content |
|---|---|
| Business process | Groups functions, risks and controls, and has a responsible owner. |
| Function | A business activity such as “Maintain vendors”. An identity holds the function as soon as it holds one active action of the function. |
| Action | An entitlement of any target system, for example an SAP role or an Active Directory group, one of Nova's own entitlements, or a business role. |
| Risk | Type “Segregation of duties”: occurs when an identity holds all functions of the risk at the same time. Type “Critical action”: occurs as soon as it holds the one function. Every risk has a level: Critical, High, Medium or Low. |
| Rule set | A collection of risks. Switches define whether Nova evaluates them and whether new requests are checked against them. |
Every change to the rule set is recorded in the audit log and in the page's change log.
-
Nested groups
Anyone who is a member of a subgroup in Active Directory or Entra ID also holds every parent group for the check. The access path shows the route. Nova knows the nesting from the group import or reconciliation, and for Entra ID only from reconciliation. Nova does not evaluate nesting in other target systems.
-
SAP composite roles
Anyone who holds an SAP composite role also holds every single role it contains for the check. If the content of the composite role changes, Nova re-evaluates the affected identities.
-
Across systems
A function can contain actions from several target systems. The analysis scope defines whether a risk occurs only within one target system or across systems.
Nova counts all assignments valid on the day: direct entitlements, business roles with the entitlements they contain, and assignments through org units. Today, Nova checks at the level of entitlements and business roles, which in SAP means at role level. Your risk admins maintain the rule set themselves.
When checks run
When Nova checks
The rule set applies to requests, during operation and in recertification.
-
On every request, before approval
Nova checks the target identity once with and once without the requested roles. A finding arises only for a risk the request would newly create and that no valid mitigation covers.
Findings appear in the request form and then in the request, with the risk and the entitlement for each function.
-
Continuously in the risk register
For each identity, the register lists the risks it currently holds as open, mitigated or resolved.
Analysis on change is on by default and re-evaluates an identity shortly after a change. The daily run also reconciles the register.
-
In recertification
When a campaign is created, Nova carries open findings from the register over as flags on the item: “SoD conflict” or “Critical action”, each with its risk level.
This way, reviewers see the risk when they decide.
What a new risk triggers on a request
| Handling | Effect | Default for |
|---|---|---|
| None | No finding on the request. | Low |
| Warn | The finding is shown on the request as a notice. The request continues as normal. | Medium |
| Review step | The request needs an SoD review. If the role's workflow does not contain this step, Nova appends it. | Critical, High |
| Block | Nova does not create the request. Administrators can file it with a justification if overriding is allowed. | No level |
The policy sets the handling per risk level. If the check fails, the request gets an “SoD Review” step by default, and reviewers check the entitlements by hand.
Requests are checked against rule sets with the “Check access requests” switch. Nova does not check assignments that do not come from a request in advance, for example direct assignments by administrators or through org units. The register captures any risks they create.
Analysis and decision
Simulation, access path and mitigating controls
The identity risk analysis shows, for one identity, which risks it holds, through which assignments they arise and which are mitigated. Nova computes it anew each time it is opened.
-
Access path
The access path shows how a risk arises: from a single role or only from several roles combined.
For each function, it lists the actions the identity holds and their route: through which business role, org unit or direct assignment, since when, and whether as current or planned state.
-
Simulation
Authorized people remove or add roles as a trial, without Nova saving anything. The result shows which risks would be added and which would go away.
-
Mitigating controls with a validity period
Sometimes an identity needs both functions. A control then offsets the risk, for example a regularly reviewed report. A control has an owner, a monitor, a frequency and a report as evidence.
A mitigation needs a justification and a validity period. The end date is pre-filled and may be left empty, in which case it applies indefinitely. When it expires, the finding returns to “Open” after the next daily run at the latest.
-
Four-eyes principle
Nobody mitigates their own findings, not even through a mitigation for a role they hold themselves. Nova records creation and removal in the audit log with person, control, validity and justification.
Anyone who approves an “SoD Review” step despite open findings must add a comment. If “Overriding allowed” is off, Nova does not approve the step. The options are then to mitigate or reject.
The risk rule set, identity risk analysis, simulation and policy are available in the “Professional” design, which you switch on in the user menu. Separate entitlements govern reading, maintaining and mitigating: “Risiko-Leser”, “Risiko-Admin” and “Risiko-Minderer”.
Checking identities
Healthcheck and AI user analysis
Alongside the rule set, Nova checks whether an identity's accounts, assignments and master data are consistent. The healthcheck's checks run without AI. AI only comes in if you switch it on.
-
Healthcheck per identity: 19 checks, 11 with a suggested fix
The healthcheck reports findings with a severity. The suggested fixes come from the check itself, from a fixed catalog, and every fix is recorded in the audit log. Only administrators can view and run it.
Optionally, AI assesses the findings and explains them in free text. Only the catalog actions can be run, by administrators.
Checks include, for example:
Leave date passed, account activeDormant accountsDirect admin grantsTechnical account without ownerReconciliation drift
-
AI user analysis
For one identity, AI produces a risk assessment, lists anomalies and recommendations, and compares it with other identities in the same org unit.
The result can be edited and saved. Every save is recorded in the audit log. The analysis does not change ratings or assignments.
Requirements:
Only with AI switched onAdministrators only
AI is off by default. It runs locally or through a cloud provider. The Data Protection Policy in the Trust Center describes what is shared with the optional cloud AI.
Evidence
Recertification, audit log and exports
Auditors want to see who decided what and when. Nova records it and provides it as a file.
-
Recertification
In campaigns, responsible people review whether existing access is still needed. The scope ranges from all identities through department, org unit and target system to AI agents. The reviewer is the manager, the role owner, a named person or, for AI agents, the agent owner.
A revocation requires a justification and takes effect when it is executed on completing the campaign. Today, administrators create campaigns themselves. Automatic recurrence is not available yet.
Risk flags on the items:
SoD conflictCritical actionAccount unusedExternal w/ high access
-
Audit log
The audit log records sign-ins and changes to accounts, roles and requests, with actor, time, target and origin, including actions from the AI chat.
The user interface and API have no function to edit or delete entries. The database server sets the timestamp, and the signed-in session sets the actor. The log is a regular database table: write protection at database level is not part of the standard installation.
Evidence and exports
| Evidence | Content | Format |
|---|---|---|
| Recertification campaign | For each item, reviewer, decision, justification, time, flags and revocation status. | CSV |
| Audit log | Filtered entries, for example by period, category and actor. | CSV, JSON |
| Identity risk analysis | All risks of an identity with functions, actions and roles. | CSV |
| Risk register | Open, mitigated and resolved findings, filterable by status, risk level and rule set. | In-app view |
| Change journal | What Nova wrote to target systems, with the values before and after. The journal does not store passwords. | In-app view, API |
Regulation and status
Public mappings, open certification status
Nova supports requirements. It never meets them on its own. Policies, risk analysis and management accountability remain with you. The mappings are in the Trust Center and can be read without an NDA.
-
GDPR
Mapping for controllers: data subject rights, Art. 25, 28, 32, 33 and 35, key DPA terms and transfers when cloud AI is used.
-
NIS-2
Mapping to Art. 21 and 23 and Sec. 30 and 32 BSIG, with joiner-mover-leaver controls and audit evidence.
-
Cyber Resilience Act
The status of Nova IAM as a product: precautionary classification, Annex I requirements, vulnerability handling, SBOM and reporting duties.
Certification status
| Topic | Status | Date |
|---|---|---|
| ISO/IEC 27001 | No certificate. We will announce the date of the certification audit once a certification body has been engaged. | No date yet |
| SOC 2 | No SOC 2 report. Planned after ISO 27001, no fixed date. | After ISO 27001 |
| External pentest | Still outstanding. We will announce the date once it is contractually fixed. | Date to follow |
What we can demonstrate today is set out in the public documents in the Trust Center.
Trust CenterNot shipped yet
In preparation and planned
These features are not available yet. We list them here so that you can assess the current status correctly. What has shipped is in the changelog.
-
In preparation
Checks at SAP object level
Beyond the role, Nova is to check the transaction or app and the authorization values: object, field and value, even where they only arise from several roles combined.
-
In preparation
Importing SAP GRC rule sets
Nova is to read and write the risk rule set in the upload format of SAP GRC Access Control, with a trial run.
-
In preparation
Supplied starter rule set
A rule set from Nova for SAP finance, purchasing and sales, SAP Basis and security, directories and cloud, and the Nova platform. After installation, it stays inactive until you switch it on.
-
Planned, no date yet
Org rules
Nova is to exclude findings where the functions only apply in separate organizational levels, for example in different company codes.
Frequently asked questions
Questions from audit and procurement
The answers also state what Nova does not do today.
Does Nova check segregation of duties before approval?
Yes. On every new request, Nova checks whether it would create a new risk and shows the finding in the request form and then in the request. Requests are checked against your active rule sets with the “Check access requests” switch. The policy sets per risk level whether Nova shows no finding, warns, appends an “SoD Review” step or blocks the request. Nova does not check assignments that do not come from a request in advance. The risk register captures any risks they create.
Does Nova only check SAP access?
No. Actions in the risk rule set can be entitlements of any target system, for example SAP roles or Active Directory groups, plus Nova's own entitlements and business roles. A risk can combine functions from several target systems.
Does Nova check at SAP object level?
Not yet. Today, Nova checks SAP at role level. Checks on object, field and value, also across several roles, are in preparation.
Does Nova ship a ready-made SoD rule set?
Not yet. Today, risk admins maintain the rule set themselves. A supplied starter rule set is in preparation, as is importing rule sets in the upload format of SAP GRC Access Control.
Does Nova make us NIS-2 compliant?
No, no tool can do that on its own. Nova supports the technical implementation and evidence of access control for connected systems: requests checked before approval, recertification and the audit log. Policies, risk analysis and management accountability remain with you. A password vault and session recording are not part of Nova. PAM products alongside it cover those.
Is Nova ISO 27001 certified?
No. Nova holds no ISO certificate and no SOC 2 report, and the external pentest is still outstanding. What we can demonstrate today is public in the Trust Center.
Is the audit log tamper-proof?
Not by default. The user interface and API have no function to edit or delete entries. However, the audit log is a regular database table, and the standard installation includes no write protection at database level. A database export lets you copy the log to a SIEM.
The field test
Test Nova against your own requirements
In the 90-day PoC, Nova runs alongside your existing tool, with your own approvers, owners and admins. This shows you which findings and evidence Nova provides in your environment.
Read on
- Trust Center
Status, GDPR, NIS-2 and CRA mappings, audit log documentation.
- Usability
Why controls only work when approvers and owners understand them.
- Integrations
Which target systems Nova connects.