What auditors, DPOs and CISOs want to know before the pilot.
Security policies, compliance mappings and architecture documentation for Nova IAM: 13 public documents, readable without an NDA or sign-up.
Who you are and where to start
For Auditors
Compliance evidence
Audit trail documentation, architecture security overview, change management and access control policies.
For DPOs
GDPR & Data Protection
Article-by-article mapping, data protection policy, key terms for data processing, incident response.
For CISOs
Security Architecture
Security policy, architecture security overview, vulnerability disclosure, incident response plan.
For Engineering
Deployment & Operations
Deployment security guide, SLA template, change management, production hardening.
Current compliance status
Each item below shows whether it is done, in progress or planned.
Policies and compliance documents
13 public documents: policies, compliance mappings and architecture. Click to read or download as Markdown source.
Security Policy
Security controls, authentication, data protection, audit logging.
Read →Architecture Security Overview
System architecture, security boundaries, data flows and controls matrix. For technical evaluators and pen testers.
Data Protection Policy
Data categories, processing principles, third-party sharing, breach notification procedures.
Read →GDPR Compliance
Article-by-article GDPR mapping, DPA framework, international data transfers.
Read →NIS-2 Compliance Mapping
Mapping to NIS-2 Articles 21 and 23 and Sections 30 and 32 BSIG, IAM as NIS-2 control instrument, evidence for authorities and auditors.
Read →Cyber Resilience Act
CRA classification, Annex I requirements, vulnerability management, SBOM, ENISA reporting and CE conformity timeline.
Read →Audit Trail Documentation
Audit log schema, event categories, integrity and limits, regulatory mapping.
Read →Access Control Policy
RBAC model, inheritance rules, provisioning controls, account lifecycle management.
Read →Deployment Security Guide
Production hardening, TLS setup, network security, monitoring.
Read →Incident Response Plan
Detection, containment, eradication, recovery, communication procedures.
Read →Vulnerability Disclosure Policy
Reporting process, timelines, safe harbor, credit for researchers.
Read →Change Management Policy
Change categories, review process, deployment standards, migration security.
Read →SLA Template
Support response times; availability, backup/recovery and service credits only for the planned hosted variant.
Read →Complete compliance pack
All documents as ZIP bundle, for audit preparation, RFP responses or internal due diligence.
Request packRegulatory coverage
Which regulations our documents relate to, with the status from the overview above. A reference does not replace a certificate or an audit report.
| Regulation | Relevant documents | Status |
|---|---|---|
| NIS-2 / NIS2UmsuCG | NIS-2 Compliance · Access Control · Audit Trail · Incident Response | Documented |
| Cyber Resilience Act | Cyber Resilience Act · Security Policy · Vulnerability Disclosure · Change Management | In progress |
| GDPR / DSGVO | GDPR Compliance · Data Protection · Incident Response | Mapping documented |
| ISO/IEC 27001 | Security Policy · Architecture Security · Access Control · Change ManagementWhat the documents relate to, not a certificate | No date yet |
| SOC 2 | Security Policy · Audit Trail · Access Control · Change ManagementWhat the documents relate to, not a SOC 2 report | After ISO 27001 |
Contact
Security reports
security@nova-iam.com
Acknowledgement within 2 business days, initial assessment within 5 business days, safe harbour under our Vulnerability Disclosure Policy. Machine-readable contact details: /.well-known/security.txt
Trust & Compliance
trust@nova-iam.com
Compliance pack requests, audit evidence, architecture walkthrough for evaluators.